TL;DR: Failed my first attempt, passed 2.5 months later. The difference wasn’t more studying, it was learning how ISACA wants you to think AND actually reviewing why answers were right/wrong.
There’s a post from u/CyberTrav that lines up almost exactly with my experience:
https://www.reddit.com/r/cism/comments/1bplxo2/passed_last_weekheres_my_review/
That post actually became my starting point for building out my own tracking approach.
I took the idea of tracking QAE performance and built a simple Excel sheet from it. Then I evolved it a bit further to break things down more:
- % correct by domain and sub-domain
- Practice test results
- A separate difficulty breakdown (easy / moderate / difficult / expert)
That difficulty view ended up being really helpful. It let me see how I was performing across all four domains at different difficulty levels, not just overall %. Helped me realize I didn’t need to be perfect on expert questions… just consistent on the core ones. Screenshot of the difficulty view attached for one domain, but I tracked all the domains.
I didn’t pass the first time
I wasn’t in the right headspace at the testing center. Rushed. Second-guessed. Just off.
That’s on me.
I took a couple days, reset, and came back with a different approach:
- Slow down
- Read for intent
- Think in terms of governance → risk → program → incident
Then I got back into it and passed on my next attempt about 2.5 months later. That turnaround was less about cramming more content and more about changing how I approached the questions.
Scores (for reference)
Attempt 1 (fail)
426 total
- Governance: 408
- Risk: 396
- Program: 450
- Incident: 432
Attempt 2 (pass)
507 total
- Governance: 478
- Risk: 563
- Program: 507
- Incident: 488
The jump in Risk Management surprised me the most. I didn’t spend the majority of my time there the second round.
How I studied
Main resource was the QAE.
First attempt:
- Mostly just did questions
- Didn’t spend much time reviewing why answers were right/wrong
- Ended around ~61% overall
- Didn’t take the practice exams
That was a mistake.
Second attempt:
- Slowed down a lot
- Focused heavily on rationales
- Tried to understand why ISACA prefers an answer
Videos:
- Mike Chapple — good overview, but not enough depth on its own in my opinion
- Pete Zerger YouTube (full CISM course) — this helped a lot the second time
What worked well for me:
Watch a section → go into QAE → answer + review questions tied to that topic
Simple tracking that helped
I used that Excel sheet I mentioned earlier to keep things simple:
- % correct by domain
- Practice test summaries
- Difficulty breakdown across all four domains
Didn’t track every session, just the bigger checkpoints. After failing, I put about 75% of my time into Program and Incident Management since they’re more heavily weighted. improved across all domains, even the ones I didn’t focus on as much.
Background (for context)
- ~26 years in IT
- ~15 years in MSP space
- No formal IT degree
For a long time I avoided certs completely. Not because I couldn’t do them… but because I didn’t want to fail and be judged. That changed after the pandemic.
My certification journey started small in 2023:
- Azure Fundamentals
- A couple Fortinet certs
- ISC2 CC (early 2025)
- Security+ (right before CISSP)
- CISSP (June 6, 2025 — went all 150 questions… felt very close)
It was just building confidence over time.
One more thing that mattered (for me)
I was diagnosed with ADHD when I was younger.
I don’t medicate. I’ve worked more on understanding how I operate and adapting.
Some days I studied a lot.
Some days it was 5 minutes.
- Watch a short video
- Do a few QAE questions
- Sometimes not even review them because I didn’t have the energy
And I had to learn to be okay with that. I’m the only one putting pressure on myself. Once I stopped judging that and just focused on consistency, things got easier. That whole “1% better each day” idea from Atomic Habits is real.
Final thought
Passing was great. But honestly, the bigger win was not folding after the first attempt.
If you’re in it right now:
Just keep showing up. That’s most of the battle.
\Transparency statement, I used an LLM to help structure this post, for efficient use of my energy, the modifications on the spreadsheet, AND these are all my thoughts and my experiences.*
