ISACA CISM Study Roadmap

Domain 1: Information Security Governance — Frameworks, policies, governance structures

Domain 1: Governance — Roles, responsibilities, reporting, metrics

Domain 2: Risk Management — Risk identification, assessment, response strategies

Domain 2: Risk Management — Risk monitoring, KRIs, third-party risk

Domain 3: Security Program — Program development, resource management

Domain 3: Security Program — Architecture, controls, awareness and training

Domain 4: Incident Management — Incident response planning, classification

Domain 4: Incident Management — Detection, response, recovery, lessons learned

Cross-domain review: Practice questions, scenario-based analysis

Final review: Practice exams, weak areas, exam preparation

Review and practice — Week 11

Review and practice — Week 12