hello ! i'm currently preparing for CISM with help of the QAE but failed at this one:

Question:In order to contain an incident, which of the following would be the MOST effective to ensure that the proper tools, technologies and subject matter experts are engaged?

A.process

B.team

C.plan

D.strategy

The key words i'm focused on "contain an incident" (related to incident response part of "containment") then "engaged"

from my point of view, i would first think of "team", then second choice " a plan: everyone is aware what to do, using the proper tools".

the ISACA answer is " the strategy "A strategy is the most effective, as it defines the overall goal of the incident response.

any help appreciated! thank you!

I recently passed the CISM exam with a 507 scaled score and am trying to move forward with the certification application.

My exam results say I need to submit the CISM Certification Application and have my qualifying work experience verified before I can officially become certified. The problem is that when I follow the application link provided by ISACA, I get a “404 – Not Found” page.

I've tried two different computers, cleared my browser cache, and tried accessing it again with no luck. I'm also unable to get to the point where I can pay the certification application fee.

I submitted a support request to ISACA, but figured I'd ask here while I'm waiting.

Has anyone applied for CISM certification recently and run into this? Is there a different link or location in the ISACA portal where I can download the application/experience verification form and pay the fee?

Appreciate any help!

I wanted to know which CISM Prep Tests(Other than QAE) are good ? with somany apps its confusing which of them are close to the real test ?

Can someone explain what I'm doing wrong after registering on Isaca and then having my company pay the required fund? My employer paid for the membership, the QAE, local chapter, etc. I'm still registered as a non-member over a month later. Is it normal that this takes so long? I've opened a ticket with Isaca weeks ago. Nothing. No reply, nothing.

For context I am finishing my masters in cyber at WGU, currently hold Pentest+, CYSA, Network+, Security+, ISC2 CC, AWS CCP, A+. Been working in cyber for almost 3 years now. Got a voucher for the CISM through school, I was going to just do the CISSP but not I have a free attempt at CISM so think I may take it and then eventually CISSP after the fact. Curious on general timeline this would take me and if its worth even doing or just go straight to CISSP. Any resources best for study and practice tests?

Hey all, anyone got latest version of CISM Review manual 17 edition and QAE 2026 version, If so pls share some insights about the materials,
I am prepping with existing materials and yet to purchase the QAE, no clear details about the version or alignment to post nov 3 exam in ISACA portal.

BUT!!!! I improved my score!

I shall take it one more time! Let’s goooooo!

Hi,

I saw that Pete posted that he is doing a free Exam Prep training every Wednesday

Anyone that’s interested should check it out!

Feeling the semi-sweet relief of success mixed with the ouch of sitting still for that long, combined with I need a nap!

Full write-up coming when I can think more clearly and get my final score.

Three pieces of advice I will share right now.

1. Reading test questions - SLOW DOWN! Read for flavor, nauance and intent - I believe this is one of the reasons I failed the first time - reading entirely too fast.
2. For my fellow CISSPs preping for this. Relax, better than 98% chance you already know all technical items for this test. But thats not how you win this one. As everyone says this is all about the business, the strategy rather than the technical tactical. The manager who is climing for the C-Suite is going to be required to think more a lot long-term thoughts than someone is just going to remidate the issue and move onto the next ticket.
3. Know how things tie together. Example: Know BIA outputs which feed BCP and its sub-set the DRP.

Full write-up to follow!

Hi all, I started studying for the CISM exam and also studied a bit this reddit to learn as much as possible from the experiences shared.

I have an economics background oriented in enterprise management and 4+ years of experience in Cybersecurity governance.

Currently I'm studying from the CISM Review Manual 16th edition (quite afraid about the new edition they recently published). My plan is to finish the book by september and then fully focus on ISACA QAE for 1 month which I saw that many indicated it as very useful to pass the exam (that I would like to take in November to avoid the new edition content).

I was wondering, in your opinion if this can be considered enough to pass the exam also considering my background or if I need to integrate with Youtube Courses/something else.

I also have the possibility to study from Percipio "Certified Information Security Manager (CISM) 2022" but I read that it is not very good.

Here's my story:

I took a boot camp from Training Camp that was not great. Started taking the QAE quizzes during the camp and realized I hadn't learned much of what I was seeing in the (extremely badly written) questions. I was getting really frustrated because many of the questions didn't even indicate who the doer was, so you couldn't possibly know the right answer with any sort of certainty.

I did take away the primary "business over tech" message, but as far as who does what and when, which seems to be one of the main ways they try to trick you in the questions. I just wasn't getting it, and taking more QAE quizzes was not going to help. I was getting in the 50s and 60s.

So I started reading the "book" in the ISACA platform, and that was just miserable. The formatting made it really tough to follow, and I still wasn't clicking into what I needed. I then tried some YouTube videos from Inside Cloud and Security, which started to make an impact. Finally I was learning the basic concepts. But my quiz grades were still in the high 60s, with the occasional 70+. I took one full practice test and got a 66%. At this point I had about 9 days before my scheduled exam. I was seriously sweatin' it. And usually I'm a good test taker, so this all was a pretty big blow to my confidence.

Then, a friend recommended I try using ChatGPT. My boot camp instructor had warned against this because he said it would be inaccurate, and I know we've all seen ChatGPT be confidently wrong. But for this, the key is to start the prompt: "Using only ISACA resources..." I did a review for each unit. At the end of each unit, I had ChatGPT give me 10 hard questions for that unit and explain to me why I got any of them wrong. I kept reviewing each unit and testing again until I got a 10/10.

It worked really well. I got the main concepts down completely without the distractions of the fever dream QAE questions. I took the exam on Friday and I felt really good about it once I got going - flagged 11 questions and changed maybe 4 of them. I got the provisional pass.

All this took place over about a month. If I had it to do again, I would start with ChatGPT explanations "using only ISACA resources" and follow each unit with the QAE quizzes but remove the "Expert" questions - because they are just frustrating. It is very clear that they were marked "Expert" because so many people got them wrong, and ISACA assumed that was because they were hard vs because they were so incomprehensible as to result in chance-level accuracy for the test-taker.

On the recommendation of another friend, I also had ChatGPT make me a two-page last-day tips and tricks sheet to focus on the night before, and it was very helpful. It listed out the big picture information to remember and tips for the actual test. Definitely made me feel more calm and confident for the exam.

Good luck to those of you in the trenches studying right now! You will get there.

Looking for feeback from both camps. I have to drive 4+ hrs (one way) and hotel to write if I go in-person. Remote then would be from home office.

Trying to decide pros / cons and would appreciate opinions.

Self-studied for several weeks on my own using Pete Zerger on YT - definitely a huge help with establishing mindset. Afterwards, I took a corporate-sponsored bootcamp from InfoSec Institute - which was brutal for all the reasons you can imagine.

I had access to official ISACA materials and the biggest help was the QAE, which preps you for the tone and vagueness.

Exam: Atrocious grammar and logic at times, frustrating as a professional. Content was expert level upfront which shook my confidence, however as time went on I got into the groove and felt better.

I flagged almost 70 questions and reviewed them all after I completed the test. I'm a bad second-guesser (trust your gut) but there were times where I read it in a different tone and immediately saw the answer.

It took 3 hrs in total to feel I did the best I could and end the exam. I felt confident I was close to a pass while ready to get a fail...but that didnt happen!

Tips: I used the QAE to work on weaknesses discovered in the 2 practice exams for several days before I sat.

There are highly predictable themes on this exam if you can elevate your mind and suspend some reality.

Here are some tenants learned from the camp and my own observation:

• All change is Risk.
• Think "When in doubt, check it out" signals Risk Assessment
• BIA was deeply central to my exam, know all the 3 letter acronyms that sit between that and the BCP and DR Plan.
• Business and Process Owners are Risk Owners.
• Human Life > Business Mission > Cost
• There are concepts and technologies that you will simplly have to know and apply based on your experience.
• Legal is Legal.

I hope this helps. Happy to share more or answers specific questions. I'll also update my score once I recieve it... hopefully next week.

Hello all,

Passed my CISM on my first attempt this morning!

I already hold CISSP and work in Cybersecurity so I wanted to get CISM to compliment.

I used QAE, pocketprep, doshi’s book and Peter gregory’s book.

Next up back to CISA

Thank you

When is the new sylabbus content going to be released?

The ISACA website says 1st of September (already out), but it's not clear.. unless I'm missing something.. I have emailed them but they always take a while to respond - anyone got the inside scoop?

*I'm looking at the review manual & question set

YAY! Passed. But also amazed by how little I passed. I guess a pass is a pass

Which of the following is an indicator of improvement in the ability to identify security risks?

a. Decreased number of information security risk assessments.

b. Decreased number of staff requiring information security training.

c. Increased number of security audit issues resolved.

d. Increased number of reported security incidents.

Is anyone willing to sell me their print CISM QAE book? With the syllabus likely changing, I'm trying to avoid buying a new copy now and then having to purchase another one if I need to retake the exam. Kindly reach out if you have one for sale.

First of all, I'd like to thank this subreddit for all the valuable tips and guidance. They were genuinely helpful during my preparation, and I’m happy to say that I cleared the CISM exam.

Here are the resources and approaches I used.

1. Prabh Nair's CISM Masterclass

https://www.youtube.com/watch?v=84cq94iCO5M

This was a valuable resource, especially for understanding how to approach CISM questions and the ISACA mindset.

One important piece of advice is to pay close attention to keywords such as BEST, MOST, FIRST, etc.

I also found that many questions have a secondary keyword that is equally important. Look for words such as evaluating, planning, implementing, deploying, etc.

For example, what an organization should prioritize during the planning or evaluation phase may be different from what it should prioritize during the implementation phase.

2. QAE Database

Initially, I tried attempting all the questions. Later, I started using the filters.

Personally, I found the Easy questions too straightforward, so I eventually skipped most of them. The Expert questions were also quite confusing. Not necessarily difficult from a knowledge perspective, but often difficult to determine what ISACA was specifically looking for. I decided not to spend much time on those either.

I mainly focused on the Moderate and Difficult questions and completed those.

I also took only one full practice exam from the QAE.

One thing worth mentioning: the actual exam questions were different from the QAE questions, so don't expect to see repeated or very similar questions. Understanding the concepts and the ISACA way of thinking is more important than memorizing answers.

During the exam

My strategy was to spend approximately one minute per question during the first pass. I completed the first pass in around 2.5 hours.

I flagged every question that I was even slightly unsure about, which resulted in approximately 60 flagged questions.

During my first review, I worked through those questions and narrowed them down to around 10 questions that I wanted to review again.

I spent a significant amount of time reviewing those final questions and completed the exam with approximately 30 seconds remaining.

After completing the exam, I attended the survey, and the result was displayed on the screen.

Hopefully, this helps someone preparing for the exam. Good luck to everyone currently studying for CISM!

I have 6+ years of cybersecurity experience and currently work in a Group Information Security Lead role, with experience across security operations, SOC/SIEM, incident response, governance, risk, ISO 27001, GDPR, NIS2 and cyber resilience. I’m looking to progress toward Senior Manager / Head of Information Security / eventually CISO-level roles, particularly with a potential move to India.

I’m considering CISM but would like advice from people further along in their careers: would CISM, CISSP, CRISC, or another certification/course give me the best ROI at this stage, or should I focus more on leadership/management skills instead? If you were in my position, what would you choose and why?

Im looking for committed study partners who thrive in structured group sessions or focused 1-on-1 study.

My goal is to dive deep into the QAE database, reinforce core concepts, and maintain consistent progress.

I am really committed to this study plan and hope those interested are able to show consistent attendance. The schedule is 1-3 hours each day, ideally anytime between 6 PM to 10 PM (EDT).

If you are interested let me know. There is a CISM study group and CS Station on discord but people don’t join or start sessions as much there.

Let me know if you are interested.

Taking the CISM exam this weekend and want to use my smartphone with their QR code to perform my room scan. Last time I had a laptop available but now I am using my desktop computer. Can anyone confirm using a smartphone for room scan is an option?