ISACA CISM Study Roadmap

Domain 1: Information Security Governance (Frameworks, policies, governance structures)

Domain 1: Governance (Roles, responsibilities, reporting, metrics)

Domain 2: Risk Management (Risk identification, assessment, response strategies)

Domain 2: Risk Management (Risk monitoring, KRIs, third-party risk)

Domain 3: Security Program (Program development, resource management)

Domain 3: Security Program (Architecture, controls, awareness and training)

Domain 4: Incident Management (Incident response planning, classification)

Domain 4: Incident Management (Detection, response, recovery, lessons learned)

Cross-domain review: Practice questions, scenario-based analysis

Final review: Practice exams, weak areas, exam preparation

Review and practice

Review and practice