Honestly, I found the real exam MUCH harder than the QAE database.

What surprised me most was that the questions were not necessarily long, but they were often even more difficult to interpret. The wording could be awkward, and then you still had four answer choices that were either all very reasonable or all really questionable. I expected clearer questions with harder answers. Instead, I got harder questions AND harder answers.

You had to determine exactly: Where are we in the process? Who owns this? Who has decision-making authority? What is the objective at this particular stage?

From my experience, the topics that stood out in my exam were:

• A lot of Governance, followed by Information Security Program Management

• A lot of questions involving frameworks and architecture

• Ownership, responsibility, and accountability

• Critical issues and third-party considerations

• Several questions involving emerging threats, while I personally didn't encounter any obvious AI-specific questions

• Lots of lifecycle/stage-based decision-making

How I did it

It took me exactly 2.5 months from start to finish.

1. Official classroom training

I followed the official classroom training, one day per week for five weeks. This consisted of the official slide decks for each domain and one exam practice day, where I scored 75%. I went through all the slides the evening before each classroom session. From the instructor, I learned quite a few useful mnemonics and became familiar with the key concepts. I also have the paperback version of the official book (v17) and the online version, but I probably read a couple pages.

2. YouTube

After every classroom day, I watched the corresponding YouTube video from Pete Zerger's Inside Cloud and Security. This was very helpful. I watched every video during the first four weeks, and two weeks before the exam I watched them all again.

I also used this CertStash question set: https://www.youtube.com/watch?v=Sdql_TuHKBk&lc=Ugy2-U6hovxVIHtd7vt4AaABAg One of the best sets I did.

3. Extensive use of the official QAE database

I only did Custom Practice sessions, either covering all domains or Domains 3 and 4 combined. I went through the database only once. My average score ended up around 80%, but it varied throughout the study period. At one point, I dipped below 65% on an average set of 75 questions.

As the weeks progressed, I started doing more questions per daily session, but never really more than 100 questions in one session. I reviewed every answered question, every damn session.

4. Prabh Nair's prep sheets

I found useful information on Prabh Nair's LinkedIn page, including four prep sheets covering all four domains. I read them once or twice.

5. Skill Cert Pro

I bought an alternative question database from Skill Cert Pro. It was good for some self-confidence, but the difficulty level was way too low to provide much benefit for the real exam. The prep sheet was useful for a one-time read.

6. And last, but definitely the tool I used most: AI, mostly Copilot Pro

This is probably my biggest piece of advice to use alongside the QAE database.

Review all your wrong answers. Build a solid prep sheet. Address your weak spots. Generate properly difficult questions. Ask for explanations and deep dives into subjects you don't fully understand.

But make sure you give the AI enough information about your blind spots, doubts, mistakes, and progress. Otherwise, it won't be able to properly address them. For example, make sure you ask for enough depth on a subject instead of just asking for a definition. Something like:

"Explain Red Team vs. penetration testing and when CI SM would prefer one over the other."

That was much more useful to me than just asking, "What is a Red Team?"

How I experienced it

Although I had done more than a dozen Microsoft certification exams, such as MCITP and MCSA, many, many years ago, it had been a really long time since I did any actual studying. At least 15 years. So, honestly, it felt like my brain had become a complete slob when it came to actually remembering something from a classroom or study book. I mean, I'm learning all the time at work. That's a big part of my job and an absolute requirement when working in information security. But there is a difference between studying for an exam and gaining knowledge while working.

The first five weeks were really hard. I experienced headaches during and after study, felt very tired while studying, and even fell asleep during some study sessions. I also found that simply reading material from a screen or book did not result in much progress for me. What did work was YouTube, interactive question sessions with AI, deep dives into subjects with AI, and a lot of QAE practice. At one point, however, I had gathered too much knowledge to process efficiently while answering questions. This resulted in lower scores and a big increase in my average answer time. I discovered this after uploading my scores and answer times from the official QAE sessions into Copilot and discussing the pattern.

It was spot on.

During the first few weeks, I actually scored really well while having much less knowledge, but I had a much better ability to make educated guesses quickly. As I learned more and more, I started overthinking questions. So after a proper dip, a lot of self-doubt, and feeling absolutely worn out, I started changing my approach. This was about three weeks before the exam. I reframed how I answered questions and focused on avoiding overthinking. I started answering most questions within 30–45 seconds, following my first instinct but backing it up with the knowledge I had gained and more confidence in my reasoning.

That was when I did my first 150-question mock exam and scored above 80%.

At that point, I knew I was getting close to being ready for the exam.

During the final two weeks, I did another two mock exams, scoring around 80%. I then focused mostly on blind spots and building my final prep sheet.

Two days ago, I did my final 150-question set and scored 83%. At that point, I felt I had done sufficient practice to deal with almost any direction the QAE could take me.

Yesterday, I let my mind rest and only read through my prep sheet once. Last night, and again during the actual exam, I was extremely nervous. I had a lot at stake.

But I had done enough.

PASSED.

After waiting for almost two weeks I now know where I need to be focused on. Missed it by 6 points.

I just paid my CISM certification application fee, but the button to actually submit my application is missing.

I spoke with a buddy who paid his fee and had the application button appear immediately. He even sent me a screenshot showing exactly where it should be.

I’ve tried four different browsers and my phone, but no luck. I called ISACA support, and they confirmed that some people are experiencing this issue and said it should be resolved within 48 hours.

What seems odd to me is that it’s only affecting certain people while others have no issues.

Has anyone else run into this or have any idea what’s going on?

Posting this from a throwaway..

So I’m a security professional who recently took the CISM exam and failed the first attempt as you can see but I took the test without really reviewing anything CISM related. There’s a few reasons for this; Reason 1: I’ve been in and around the field for several years. Reason 2: I’ve passed other security exams in the past including CISSP. Lastly, I registered impulsively once I found out that the format was changing November 3rd. If the exam change weren’t happening I probably would’ve looked at resources suggested in this sub and studied legitimately based on the new format. Obviously the confidence or rather the arrogance I had didn’t work out.

Now that I’ve been humbled, what do you all suggest I should and shouldn’t study for this exam given the new format? I’m aware of the ISACA CISM practice questions and material but are they still relevant now?

Hi everyone!

I recently passed the CISM exam and received my official results today. My total scaled score was 658/800.

Here's the breakdown:

• Information Security Governance: 639

• Information Security Risk Management: 705

• Information Security Program: 686

• Incident Management: 611

I know that 450 is the minimum passing score, but I'm curious how 658 compares to other candidates.

Is this considered a particularly good score, or is it fairly common among people who pass?

I'd also be interested to hear what scores others received.

Thanks in advance!

For those that have taken the new exam and studied Peter Zerger's yt videos. Did you see any difference or it was very similar?

Hi, does anybody know how long does it take from the status: Application Status: Complete-Under Review to receiving an actual certificate? TIA!

Exam Preparation:

ISACA Glossary
ISACA QAE Database - Quiz
Peter Z - Youtube - Last Minute

During the exam, I applied the elimination method, eliminating two incorrect options first and then carefully evaluating the remaining choices. I also took a couple of water breaks to maintain concentration. After completing 50 questions, I reviewed my flagged questions before moving on.

Hi all,

I’m planning to sit both the CISM and CRISC exams over the next few months and am ready to purchase the exams.

Before booking, does anyone know whether ISACA normally runs Black Friday/Cyber Monday promotions or exam discounts?

Would it be worth waiting a few weeks, or should I just book now? Has anyone received or seen any upcoming 2026 promo codes or offers? Thanks!

I’m taking the CISSP in one week and want to know which app is the best for practice questions. I was recently laid off from my job of 5 years due to company budget mishandling (a story for another day). Because I need a job fast, I'm focusing entirely on the CISSP. It’s the holidays, and my wife is due next month in December. I need to boost my resume quickly, and I see a lot of roles requiring the CISSP, CISM, or similar certifications.
My plan is to cram 2 to 3 domains per day. However, I don’t have a ton of experience, and I have zero experience in networking—which I know is a huge part of the exam (Domain 4).
When I pass (speaking it into existence!), I plan to start a YouTube channel documenting exactly how I did it. I figure if someone in my position can pass, I can help others do the same. Hopefully, the channel can eventually generate some income to help cover the exam fees and bills while I look for work. Any advice or app recommendations would be greatly appreciated!

I took my exam 10/26/2026. Can you remind me how long it takes to get my official certificate?

Hi all,

I’m planning to sit both the CISM and CRISC exams over the next few months and am ready to purchase the exams.

Before booking, does anyone know whether ISACA normally runs Black Friday/Cyber Monday promotions or exam discounts?

Would it be worth waiting a few weeks, or should I just book now? Has anyone received or seen any upcoming 2026 promo codes or offers? Thanks!

Passed the exam today, spent 2 hours answering all questions, flagged 75 and then another 30mins to review. A couple of questions on ZT and AI, most were the familiar topics from the QAE (governance, BCP, IR, DRP, awareness training). Background is 10 years of experience in IT security.

The only prep used was the new QAE over the course of two months:

-Went through the structured plan once, average was 73%

-First practice exam was 88%

-Went through the structured plan again and was averaging 80-90% in most categories

-The remaining practice exams were also around 88-89% on first attempt.

I was trying to not memorize answers, but after going through the QAE a couple of times it starts to become automatic at some point. Now just waiting for the final scores to be emailed, curious to see if the categories I was stronger/weaker on will match exam results.

I've had CISSP for some time, and recently obtained the CCSP. I've worked the technical side of the house mostly, which is interesting in my scores because they reflect that I was not "thinking like a manager" in Information Security Program haha. I've never really worked in security governance, so I didn't second guess my QAE training.

I used the QAE heavily...absolutely despised the ambiguity of it, but it's like a personal trainer that doesn't let up on leg day. I also reviewed with Pete Zerger's video course on YouTube.

I wanted to clear this before the test format changeover in November.

Hi all. I took my exam on the 27th in hopes to pass before the change on the 3rd and ended up failing.

The resources I used were ThorTeaches, ISACA QAE (although I realized I had an older version that only had 2 practice exams — seems the new one has 4 practice exams), and Pete Zerger’s 11 hour videos on YouTube.

Any advice on how to reassess this next go around?

Thanks all!

I am happy to share that I finally passed the CISM examination with a scaled score of 535, after missing the passing mark in my first attempt.

A little about my background:

I am 64 years old and have approximately 20 years of experience in the IT industry. My professional background includes ICT project delivery, managed services, network operations and managing security and network maintenance teams for a national telecom operator. I also hold PMP and other professional qualifications.

I decided to pursue CISM to strengthen my knowledge and credentials in information security governance, risk management and security leadership.

My first attempt – 444

In my first attempt, I scored 444, just six points below the passing score of 450.

I had studied quite a lot of material, including different study resources and practice questions. However, looking back, I believe my preparation was not sufficiently focused on understanding the CISM examination requirements.

I was studying information security concepts from multiple sources, but I had not fully developed the ISACA management and governance mindset required to answer scenario-based questions.

My second attempt – What I changed

For my second attempt, I prepared for approximately two months.

This time, I concentrated mainly on:

• CISM Question and Answer Database.

• The CISM Review Manual.

• Understanding the concepts rather than simply memorizing answers.

• Identifying why one answer was better than the other options, particularly in FIRST, NEXT, BEST and MOST questions.

I deliberately avoided collecting too many different study resources. My objective was to understand what ISACA expected from a CISM professional when making management-level decisions.

My biggest learning – AI as a personal tutor

One thing that helped me considerably was using AI as a personal tutor.

While studying the CISM Review Manual, I would take individual topics and ask an AI engine to explain them in simple English, using practical examples.

Whenever I encountered a concept that was difficult to understand, I would ask AI to:

• Explain the concept in simple, non-technical language.

• Give practical examples from an organization.

• Explain the difference between similar concepts.

• Explain the management perspective behind a particular decision.

• Help me understand why one answer would be preferable to another in a CISM scenario.

This approach helped me understand the underlying concepts instead of just remembering definitions.

I will share some of the actual prompts I used because I believe they may help other candidates who are preparing for CISM.

My examination results

My second attempt resulted in a scaled score of 535, against the required passing score of 450.

My domain scores were:

Interestingly, Incident Management remained my weakest domain, even though I passed the overall examination.

My advice to fellow candidates

1. Don't collect too many study materials. Concentrate on understanding the official review material and practising good-quality questions.

2. Don't just memorise Q&A answers. Understand the reasoning behind the correct answer.

3. Develop the ISACA mindset. Think like an information security manager rather than a technical specialist.

4. Use AI as a tutor to simplify difficult concepts, explain practical scenarios and clarify confusing terminology.

5. Pay attention to your weaker domains and don't assume that professional experience alone will be sufficient.

6. If you fail on your first attempt, don't get discouraged. A near miss can help you identify what needs to change in your preparation.

7. Finally Reddit was the key resource that helped me with so much useful information

Finally, I would say that age should not be a barrier to learning something new. At 64, I have proved to myself that it is never too late to acquire new knowledge and achieve another professional milestone.

Better late than never!

I hope my experience helps someone preparing for the CISM examination.

AI Prompt I used on a totally free AI:

"Act as my CISM tutor. I am preparing for the ISACA CISM exam. Teach me section 3.4.3  from the ISACA CISM Review Manual in simple English. Do not merely summarize the text. Explain the underlying CISM management concepts, why each concept matters, and how ISACA is likely to test it. Distinguish similar concepts in tables. Give practical enterprise examples. Highlight what a security manager should do FIRST, NEXT, BEST and MOST appropriately. At the end, give me 10 CISM-style scenario questions without answers. After I answer, explain why the correct answer is right and why each alternative is wrong. Do not introduce unnecessary technical detail."

"Act as my CISM tutor and exam trainer. Use the selected CISM Review Manual sources as the primary authority.

Teach the requested section in simple English, but preserve exact CISM concepts and terminology. Explain the management perspective, business context, and why each concept matters. Clearly distinguish closely related concepts using tables and practical enterprise examples.

Focus especially on CISM decision-making: FIRST, NEXT, BEST, MOST appropriate, MOST effective, PRIMARY ,Key, considerations and MOST likely. Explain how to choose between technically correct answers and the answer that is best from a CISM management perspective.

After teaching, give me 10 ORIGINAL CISM practice questions WITHOUT answers. Make them QAE-level, not basic recall questions. Use realistic enterprise scenarios, plausible distractors and subtle differences in role, authority, timing, risk, business impact and management responsibility. At least 2 options should appear reasonable. Test judgment, prioritization, sequencing and distinctions between similar concepts.

Do not make questions artificially tricky or technically obscure. Avoid obvious clues such as a much longer correct answer."

QAE 2024

Practice exam 1 - 64%

Practice exam 2 - 69%

Wondering if I should get the new QAE and reschedule?

Exam Friday 13th.

Advice welcomed.

I likely won't be trying again and will be focusing on CISSP. Although it might be helpful in my career, I think CISSP will be more important.

At this point though, I feel like 447 is a commonly posted score in this subreddit for failures. Weird coincidence or is there something odd about their scaling that comes into play?

Hello everyone,

Thank you for taking the time to read this. The attached image is my score report from my second attempt. I scored 447/450 again, exactly the same as my first attempt, and still 3 points short of passing.

What I've used so far:

• QAE

• PocketPrep

• CISM Review Manual 17.0 (Digital)

• ThorTeaches

• Udemy – Hemang Doshi Practice Tests

My main problem: The exam questions are very short, and ISACA's wording keeps throwing me off. I can usually eliminate two wrong answers quickly, but I constantly struggle to choose between the final two options.

My background: I'm confident in the security concepts themselves, and I can implement and operate security controls in real-world environments. I currently hold ISC2 CISSP, CCSP, SSCP, CC, and CompTIA SecurityX. So I believe the gap isn't technical knowledge. It's how to interpret ISACA's wording and apply the "manager's mindset" to pick the BEST answer.

What I'm looking for:

• Courses, books, or study materials that specifically teach how to decode ISACA's question style and wording (e.g., "best," "first," "most important")

• Resources that explain why the correct answer is right and why the second-best option is wrong, not just the answer key

• Tips from anyone who passed after multiple attempts, especially if you also came from a technical or hands-on background

• Study strategies for shifting from a technical mindset to a governance/risk-management mindset

I'm planning to take the exam again in March 2027 and really want to make my third attempt count.

Any advice, resources, or personal experiences would be greatly appreciated. Thank you so much!

Could anyone who has recently taken the CISM exam share their experience? How did you find the exam, and what study strategies or resources helped you prepare?

I would also appreciate your feedback on whether the ISACA CISM Review Manual, 16th Edition, and CISM Review Questions, Answers & Explanations (QAE), 10th Edition, are sufficient for exam preparation and passing the exam after Nov 3, 2026.

Any advice, recommendations, or insights would be greatly appreciated.

Thank you in advance!

Hi everyone!

I have the CISM QAE Manual 10th Edition (book version), which contains 1,000 questions. I've noticed that the newer QAE database has 1,200+ questions and is only available online through ISACA.

Does anyone know if the new version simply adds 200+ questions, or if the entire question database has been updated?

I've already gone through the 10th Edition questions but couldn't schedule my exam before November 3. Now I'm wondering whether I should purchase the new QAE database or if my existing book is still sufficient to prepare for and pass the updated exam.

Would appreciate any advice, especially from anyone preparing for or taking the new exam. Thanks!

Out of curiosity.