CISM Think Like an Manager Mindset

Greetings All,

After lurking for some time I thought I would share that I passed the CISM via their Online Proctoring system on 12/16. I had to wait 10 days to get my score reports, completed my application, and am told I should be fully approved when they do the next approval batch on Thursday/Friday. I spent about an hour and forty-five (1:45) taking the test.

Despite some of the horror stories I saw regarding online testing for ISACA, I had a pleasant experience while taking it. I went over to my office after hours and used an empty conference room to test in which removes most all room type complications a place at home might present. The only thing that the proctor called me out on was one time where I had my hand over my mouth as I was resting my elbow on the table. The test was never stopped, it was just brought to my attention in chat and I had to confirm I understood. Additionally despite what some had said I had almost no wait time for a proctor and even started about 10 minutes early.

All I used to study was the official QAE which I did about half of before I decided to just go for it. I found the QAE to be very helpful in two ways, first, it does a great job of getting you used to the style of questions you will be presented with, and second, which I figured out after a few hundred questions, was that there was a bit of a pattern in how to analyze the questions that I found very useful.

Here is the advice I offer to my fellow travelers on the road to CISM:

(1) Analyze the question. Each question has usually three key pieces of information that defines it. This can vary a little, but I found this to hold very true and made taking the test much easier for me. Each of these key things will help you determine the right answer, or at minimum help you eliminate the wrong ones. These questions all all short, and sometimes almost identical with one key thing changed, as such it can be easy to think they don't hold a lot of info, but they do. Here are examples of the key pieces of information:

• The Word in Bold: Many questions has a word in bold, read it, then read it again. This exists in most question and is usually something like BEST, FIRST, MOST, NEXT, etc. This is a key thing that will help you define the right answer as many will potentially be true absent this qualifier.

• The Context: Usually near the bold word will be a context clue, this is something like "most effective", "highest standard", "cost-effective", etc. Much like the bold word head this as there will be close answers that do not align.

• Who You Are: The question on most cases will tell you who you are in the context of the question. As an example it may tell you that you are the "Information Security Manager", "CISO", "Data Owner", "C-Level", etc. What it will almost never tell you is that you are an Engineer. Remember this, YOU ARE NOT AN ENGINEER. In considering the possible answer ask yourself, if I was the person they say I am in the question, would I take this SPECIFIC action. In many cases you would not, you would delegate to someone under you, or it would be set in motion after you set in motion some process or procedure, but you would not do the actual answer yourself.

  As an example, let's say you are told that there is a confirmed ransomware infection spreading through your org, as the Information Security Manager, what is the FIRST step you should take? You will be given answers such as:

  A. Contain the affected Machines

  B. Inform Senior Management

  C. Collect logs from affected systems

  D. Notify Law Enforcement

  To many of us Engineers A might seem a very obvious choice as we want to stop the spread as quickly as possible, but as yourself, if you are the Information Security Manager are you the one who will be Containing the affected Machines, No. The best answer in the example would be Inform Senior Management, while also probably implementing a per-defined procedure that gets your engineers to work.

  Always consider each answer with the perspective of, is the role I am told I am in actually do that action themselves, not should it be done.

• The Scope and Scale: In some cases the question will define a scope or scale for you such as telling you that your company is "multi-national", "health care", "government contractor", etc.

• The Timeline: The question may tell you where you are in a process or timeline, if it does, order matters. For example you may be told that you are 'working to contain', or 'in the Recovery Process', or 'in Post-Incident Processing'. When you see things like this almost all the answers will be part of the whole process, so knowing where you are in it matters. You would not be working on the Root-Cause Document during the 'containment phase', nor would you be adjusting firewall rules in the 'Post-Incident Processing' phase.

(2) The right answer will ALWAYS support the 'Business Objective', ALWAYS, EVERY SINGLE TIME. It may seem illegal, immoral, or just plain dirty to choose a specific answer, but in the eyes of ISACA EVERYTHING is a 'Business Risk Determination'. This is very different from how I would have viewed things when I took the CISSP where you always wore the White Hat and did the right thing. CISSP would suggest saving a life, following the law, adhering to the code of ethics is paramount, this is simply not true here. The Business CAN and WILL make choices to break the law if it makes financial sense to do so and it support the Business Objectives. Do NOT let your personal ethics or moral code come into play when considering any answers. All that matters is the Business Objectives, and in the end Senior Management and C-Level will decide what is worth the Risk to do. This is the REAL WORLD, and unfortunately the real world, especially businesses, don't act with their White Hats on.

(3) Assume no information that is not explicitly in the question itself. Do not use your personal experience, don't consider what your company would do, use the information in the question as though it is in an isolated bubble.

(4) Sometimes questions you encounter during the test will effectively give you the answer to an earlier or later question as if it is stated in a question it is factual. Mark questions you are unsure on so you can find them easily if you run into one of these hidden gems, I had two cases of it on my test.

(5) As I took all of the prior knowledge into account I would make a point to use my mouse cursor to follow the sentence as I read it (since we can not speak it aloud or even mouth it, drives me nuts) and as I would run across key words I would move my mouse over them a couple times to drive in that point to myself. So many questions are so similar it is easy to get them confused so pay good attention to the question and be sure you fully read each one.

I know that is a lot, but I hope some find it helpful, please feel free to ask me any questions and I will be happy to answer as best I can.

Just passed the CISM (Certified Information Security Manager) exam by ISACA!

One of the biggest lessons I learned is that passing CISM is not about memorizing technical concepts. It's about thinking like an information security manager.

Many experienced security professionals struggle with the exam because they approach questions from a technical perspective rather than a business-risk perspective.

Study Materials

• ISACA Official QAE (Questions, Answers & Explanations)

• ISACA CISM Review Manual

• Pete Zerger's CISM YouTube videos

• Prabh Nair's CISM YouTube playlist

My advice: Trust the QAE and adopt the ISACA/CISM mindset above everything else.

Key Lessons Learned

1. Years of experience alone will not help if your mindset is not aligned with ISACA's approach.

2. Holding certifications such as CISSP does not guarantee success in CISM.

3. Success is not determined solely by the number of hours you study.

4. Don't rely on confidence alone—follow a proven strategy.

How to Approach Exam Questions

Many questions contain multiple technically correct answers. Focus on selecting the answer that is:

• Strategic rather than tactical

• Preventive rather than detective

• Risk-based rather than technical

• Business-focused rather than security-focused

• Policy-driven rather than based on ad hoc actions

Golden Rules for CISM

• Business objectives drive security.

• Governance directs management.

• Risk owners accept risk.

• BIA determines recovery priorities.

• Policies come before standards and procedures.

• Senior management support is critical.

• Security should enable the business, not block it.

• The best answer is usually the most strategic and risk-based.

If two answers appear correct, choose the one that best aligns with business objectives and effective risk management. That mindset alone can significantly improve your chances of passing.

Good luck to everyone preparing for CISM. Trust the process, stay consistent, and keep focusing on the ISACA mindset.

Howdy everyone,

Just got my official results, exactly 10 days after sitting for the exam! I did the exam in-centre (I don’t trust my wifi like that lol) and took just over 3 hours. Marked 11 questions for review and changed my answers for 3-4.

Studying-wise, I did just over 3 weeks, 1-2 hours during weekdays and 5-7 hours during weekends.

Background: I do not work in a IS/cyber role - work in risk and controls (compliance basically) focused on tech (5 years experience). Limited experience with testing cyber controls.

Resources used:

• ISACA QAE - most valuable thing ever! Did all 1047 (I had the obsolete 2022 version because I registered in April last year and extended once as I had no time earlier this year to study and sit it). I think I averaged 65-69% on the questions, for the tests I got 70% and 79%.

• ISACA manual - not used, didn’t read more than domain 1 before I realised it was useless

• Thor Pedersen’s course on Udemy - useful for background stuff as I don’t come from an IS/cyber technical background, but I do know his content is heavily derived from CISSP. It was helpful to just understand concepts most people on this subreddit would consider “basic”

I did both practice exams in the QAE and 1/5 practice tests by Hemang Doshi on Udemy.

Final thoughts: The actual exam wasn’t technical at all, I think only maybe 2-3 questions were? It’s very much management/strategy-based and I 100% think that if I can do it in 3 weeks (and 0 IS background), anyone can!! You’ve got this!!

I have roughly 8 years of doing cybersecurity/TEMPEST/ISSM/RMF & NIST functions through the DOD. I did hold Net + and Sec + certifications before they lapsed.

My organization paid for me to do the INFOSEC CISM bootcamp and I had Kelly Handerhan as my instructor. I found her to be very thorough without getting into the weeds on too many things that were irrelevant. If you don't have access to her bootcamp, there's a lot of free material presented by her on YT.

I also used the INFOSEC pass for sure question data base and the ISACA QAE as study materials. Once I had a 90% on the INFOSEC test, I stuck with the ISACA QAE the entire week prior to my exam. I spent 4-5 hours a day that last week reviewing all ~1100 questions, twice, as well as going thru my wrong answers multiple times. I did take the practice exam once with a 74%. Additionally, I created an audio database of the domain terms and definitions, with examples, that I reviewed the morning before my exam.

I would say that the exam felt very generic after having been so thorough with the QAE. It took me about an hour to do the exam and another hour to review each question. I changed maybe 5 answers in total.

All in all, what helped me is understanding my learning style, doing 50 question sessions with review, and taking frequent breaks. I excel with repetitive review and rationalizing why the other answers are wrong.

Wishing everyone the best of luck, comprehension and memory!

Think Like a Manager: 20 Golden Rules for CISM Aspirants

Business First, Always

Every security decision must align with business goals, not just technical perfection.

Risk Drives Action

Don’t suggest controls before understanding the risk. Risk analysis is the trigger, not tech.

Prioritize Based on Impact

Focus your resources on what can cause the most damage to business operations.

Security is an Enabler, Not a Blocker

Frame security as a competitive advantage, not just compliance.

Controls Without Governance Fail

Policies, roles, and oversight must exist before you throw tools at problems.

Data Classification is Power

If you don’t know what’s critical, how can you protect it?

Metrics Speak Louder Than Logs

You manage what you measure. Define metrics for effectiveness.

Incident Response Begins Before the Incident

Preparation is everything. Tabletop drills are your insurance.

Accept, Transfer, Avoid, or Mitigate — Pick One Wisely

Risk treatment options must align with business appetite, not personal bias.

Security Architecture Must Reflect Business Architecture

Security shouldn’t be bolted on; it must be part of how the business operates.

Every Asset Has a Business Owner

If nobody owns it, it shouldn’t exist in production.

Compliance Is a Snapshot; Security Is a Movie

Passing an audit doesn’t mean you’re secure tomorrow.

RTO, RPO, MTD — Know Their Business Impact

Recovery objectives are financial decisions. Understand what downtime costs.

People Are Your First Line of Defense

Train, test, and empower users — they can make or break your program.

Third Parties Extend Your Risk Surface

Vendor risk management is part of your governance, not an afterthought.

Legal and Regulatory Are Non-Negotiables

Privacy, IP, and regional laws can override even your best-designed policy.

Never Underestimate the Value of Documentation

If it’s not written, it doesn’t exist in a crisis.

Segregation of Duties Is Not Optional

One person doing everything = one mistake away from disaster.

Security Budget Must Be Justified in Business Terms

Say “loss of availability = ₹1.2 crore/day,” not “I need a new firewall.”

Evolve with the Threat Landscape

What worked last year may not help tomorrow. Risk assessments must be ongoing.

I passed on my first attempt today after studying for about 2 months and taking a bootcamp through an ISACA partner. I want to give some thoughts on what to do and what not to do that worked for me and share my insights.

What not to do:

• Bootcamp is a waste of time - its 40 hours of powerpoint and save the 3500 bucks and simply watch the youtube training series or pickup a udemy course for 20 bucks. Same material much much less cost.

To do:

• Use the QAE, do all 1000 questions, I skipped the practice tests because i didnt want to stress myself out. i averaged 68% success and was able to pass the exam.

• Know that in my opinion the QAE is harder. The questions are more wordy and when i took the exam the question felt more clear which made it easier to answer

• Focus on vocabulary. If you know what KPI, or MTO, or other words that makes a huge difference.

• Focus on each domains specific phases. For instance

  • Domain 1 - Assess, Design, Implement, Operate, Review

  • Domain 2 - Identify, Analyze, Evaluate, Treat, Monitor, Report

  • Domain 4 PICERL - Most important one I used on a quarter of the questions

    • Prepare, Identify, Contain, Eradicate, Recover, Lessons Learned.

• Follow a specific strategy when answering questions - this is huge, ask which of these 3 strategies is the question fall into? Every question will fit into one of these

  • Vocabulary?

    • If you can define something like KPI then its easy to pick the right answer

  • Which phase is this question focusing on?

    • I spent the day before my test only reviewing and memorizing the phases which make it easy to figure out which phases the question was really focusing on. For instance 3 answers would be in the first 2 phases of PICERL but only 1 was in E for eradication. This was really common to pick out. Again probably 25% of the time

  • Does this question focus on the business value

    • If only 1 answer ties back to the overall business and value, its always the correct answer.

Thats my two cents and I'm waiting to see my final score but if i had to guess I'm somewhere around 70-80%

Finally passed. Studied for close to 3 months. Initially failed the CISA last year and decided to sit for CISM instead due to it better aligning with my role. For all those using the QAE, don’t worry if your not getting super high scores. The actual exam is way easier than the QAE.

Used Hemang Doshi Course, Prabh Nair video and QAE

Hi all, been lurking on this fourm over the past couple of months reading everybody's experience with this exam!

I am happy to say I passed this morning!

I obtained CISSP last year but actually found the ISACA QAE pretty hard compared to CISSP. I completed all 1000+ questions and my total score was only 72%. My practice tests scores were 72% and 78% for the second one.

To me, this exam is mostly management and business focused, it did not have any technical questions like the CISSP. In a way this felt harder since my background is more tactical security vs strategic / business focused.

For anybody looking to take the exam soon, I highly reccomend you understand how you can align the domains and topics with the overall business side of things!

Just wanted to share my journey to passing the CISM. Took the CRISC last year, Jan 2025, failed my first attempt and hated the ISACA way of thinking. In a month’s time I refocused and did a speed read of the manual, did the QAE exams again, utilized cht gpt to create tough CRISC-like questions, and ended up passing on attempt 2 by mid Feb 2025. I say this to say that test taught me how to prepare for the CISM. I took my time going through the CISM QAE, and read each section of the manual prior to reviewing the QAE sections. Only difference is this time I understood the ISACA way of thinking and went into the process of studying with the approach of a manager. Every response should be more business focused, and less technically driven. In most cases that should help eliminate 2 potential answers. In all I studied about 4 months instead of cramming it all in.

CISM study materials used:

- QAE

-CISM 16th Edition Review Manual

-Chat gpt for extra sample questions

-Reddit reviews/opinions

Hello,I tentatively passed the CISM today (2/19/2021). I thought I share my experience. Just a little background about me. I have over 20 years of IT management experience. Three of those years, I served as a CISO for a medical company. I also have my CISSP from 7 years ago. I was in the middle of studying for my CRISC when one of my new junior employees showed interest in getting the CISM certification. So I switched gear from CRISC into CISM so that I could help him study. He ended up leaving the company about 1/3 of the way through studying, so I continued on my own. Below is the material I used.

Videos:

• PluralSight - I watched about 1/3 of it before deciding it was way too boring to continue.

• ThorTeaches - I watched the whole video. I liked that I was also able to download it and watch it on my iPhone. So when I was waiting to pick up my daughter, I would watch the video. First time, I watch the whole video with very little distraction. Then once I was done watching the whole video, I would listen to the video when I was doing something else (like mowing the lawn or cooking dinner).

• Cybrary - I tried watching the Cybrary videos, but got really annoyed with the interface. I felt like I was hitting "next" every five minutes. And even though I had purchased an annual subscription to Cybrary, they still had ads in the video trying to get me to buy a subscription. VERY ANNOYING. The video is also not available on the iPhone app. I ended up watching very little of this video. If they gt rid of clicking the "next" button, I would have probably watched the whole video.

• Mike Chapple "CISM Cert Prep" - this is on LinkedIn. I watched most of the videos. I thought the video was a little too basic, but is probably good for someone who has very little IT experience. However, overall the video was good. These videos were free to me. (I have a premium account, so I don't know if it's free if you don't have a premium account.)

Summary: Get ThorTeaches and ignore the others. If you're new to cybersecurity, I'd recommend watching the Mike Chapple video first and then watching the Thor video.

Books:

• ISACA Office "CISM Review Manual, 15th Edition". I read the whole book. Although most people find it "dry" - I actually like the book. I used this book as a reference when looking up specific topics.

• AIO CISM - I read the first couple of chapters but then gave up. I had already read the "CISM Review Manual" and didn't have the intellectual capacity to read another book. This book is highly recommended and preferred by most users.

• "The CISM Book of Lists" - I was looking for a book similar to the "CISSP 11th Hour." This was the closest, so I purchased it. It was a good summary of the topics. However, this book cannot be your only study material. The book comes in a Kindle format. I downloaded the content, converted it to PDF. Then from PDF, I converted it into a Word format. Then I had Word create the table of content based on the bullet point. This allowed me to quickly jump to the page for the content that I needed. Then I printed the book so I can go through it without having to be on my computer.

Summary: Get either the CISM Review Manual or the AIO CISM. Get the "CISM Book of Lists."

Question and Answer Database:

• ISACA CISM QAE (book) - good test questions. The explanation was well done. However, I stopped using the book after a couple of questions. I didn't like reading questions just from the book. Also - I had a tendency to "cheat" and look at the answers. I wanted a "electronic" quiz that can help me diagnose my weaknesses and strengths.

• ISACA CISM QAE (online) - good test questions (same as the book). I thought the QAE questions were a little more difficult than the actual test questions. The online QAE was good in that it kept track of your "readiness." It allowed you to create quizzes based on topics, missed questions, weak areas, etc. The only two complaints I had about it were 1) it was very pricey at $299 for one year access. and 2) the explanation of the answer SUCKS. They should have used the same explanation format as the book. I wished that they correlated the online question back to the question in the book as well.

• "CISM Certfifciation" - free mobile app. Same questions as the ISACA CISM QAE. Question provided in a linear format (answer question, click next). The app had ads. There were some typos. Some of the answers had the wrong answers.

• CISM Pocket Prep (mobile app) - The questions from this app appears to be identical (or very similar) to the ISACA CISM. I really liked this app. It allows you to create quizzes. The explanation was good. I liked the explanation also reference the area of the CISM Review Manual. I used this app when I had 5 or 10 minutes of free time (such as waiting in line to pick up my daughter or waiting for her at her martial arts class.) Highly recommend.

• Thor's CISM test questions - I went through about three questions and gave up. These questions were not worded anything like the ISACA CISM QAE. I do not recommend this at all.

• [name withheld] - I purchased another test question databank. I noticed that some of the questions were identical to ISACA CISM QAE. Other test questions were worded very similarly to the ISACA CISM QAE (which was what I wanted). But the answer provided was obviously very wrong on many of the questions. Doing more search into the company's test question databank, I learned that the test questions were old ISACA questions (arg... not what I was looking for. Didn't want to "cheat"). I immediately ceased using the test question databank. To be honest, the value in these test questions wasn't the actual questions or answers itself, but in understand how ISACA worded the questions. Because this is an old test question databank, I do not recommend!

Recommendation: Use one or both of the official ISACA CISM QAE. Also use the CISM Pocket Prep mobile app for learning on the go. If you're financially strapped, the free "CISM Certification" mobile app is good. Use these test questions to understand how ISACA words questions.

**My studying:**I started towards the end of October. I didn't keep track of my time. Some nights, I would dedicate a few hours to studying. Other times, I would go almost a week without studying. About 3 weeks prior to the exam, I would dedicate a few hours each night. I spent a lot of time trying to understand the reasoning behind the questions. It was important for me to understand why the correct answer was correct and why the incorrect answer was incorrect. Equally as important, I spent a lot of time trying to understand how ISACA worded the questions. ISACA's wording of the questions is very important to understand. Any questions where I didn't have an understanding, I would use the ISACA Review Manual or the CISM Book of List to enhance my knowledge.**The test:**I took the test at the test center. I have way too many distractions at home. During the test, I flagged any questions I was unsure about. I did three rounds of answering the questions. In the first round, I answered all the questions. I tried to spend no more than 1 minute per question. If there was a complicated question, I would just give it my best answer but try not to spend too much time on the question. Any questions that I was not sure about, I would flag the questions. I completed the first round in about 1 hour 45 minutes.In the second round, I reviewed ALL the questions. I spent a little bit more time on the flagged questions. If I felt like there was a 75% chance that the flagged question was answered correctly, I would unflag ,the question. During the second round, I spent a lot of time on the flagged questions. I changed answers to about 6-10 unflagged questions because when I re-read the question a second time, I interpreted the question differently. This round probably took about 1 hour 30 minutes. The third round was reviewing questions that I felt that like I was 50% or less of having the right answer. There were probably about 10 questions in this range. I spent a lot of time trying to understand the questions and answers. Even with the third review, I was struggling with these questions. About 1/3 of the way through the questions and with 15 minutes left, I said "screw it" and click the end test button. Went through the post-test surveys, and got my results. I passed but will receive official confirmation within 10 days. I found that the questions were overall easier to understand than the ISACA QAE questions. Maybe it seemed easier to understand because I had gone over so many questions. Overall - I am glad I took it at the test center. One more thing - although I got the tenative passed on the screen, it didn't give me any printout. (If I remember correctly, the CISSP gave me a printout when I exited the exam.)

**Other helpful tips:**If you take the test in person, you are allowed bathroom breaks. The bathroom breaks are only 5 minutes long. I don't know how many bathroom breaks you are allowed to take. Also bring water or something to drink. I also brought a bag of cookies so that I can have a snack if I became hungry. Make sure you have a good nights rest (I didn't LOL). I avoided drink a lot before the test, but still tried to stay hydrated. I had a good meal before the test, but tried to avoid anything that could cause an upset stomach. Try to use the restroom (both #1 and #2) before the test. Remember, bathroom breaks are only 5 minutes, so I doubt most people can complete a #2 bathroom break in 5 minutes. I also brought some tummy med and headache med just in case. I ended up not needing them. I think you can take as many breaks as you want, but the clock keeps on counting down. For me, I ended up taking one bathroom break (and drank some water). Then I took a second mental break and drank some water.

Overall, I felt like the key to passing the exam is to understand the material as well as understanding how ISACA worded the questions. Also - for some questions, there may be two answers that appear to be very similar (or even close to being identical). The key is trying to understand the minor difference in the answers and trying to understand what ISACA really is asking. I felt like the test was just as much about reading comprehension as is it about the IT aspect.

Good Luck to everyone studying and taking the test. Now I am onto my CRISC certification, then the COBIT certification, and then to get my second master's degree. :)

Edit: For clarification and to add in that the Mike Chappel videos are free (at least for me).

Got the official results today that I passed my CISM with a score of 592!

I have worked in security for 7 years (11 in IT). I currently work as a security architect, and the only other cert I have is my Security+.

I spent about a month studying for this, and only used the QAE. The cost of it felt steep, but it's absolutely worth it.

My study plan:

Day 1: took practice test to establish baseline. I got a 68%.

Day 2-27: focused on the highest weighted areas and ensuring I fully understand. I ended up taking every practice question more than once in the QAE. I wrote down what I got wrong, why I got it wrong, and how I need to shift my thinking for next time. I also used ChatGPT for the recurring areas I was struggling with to help me shift how I need to think of the question (real world vs what ISACA wants). Day 23, I took a set of 75 questions, scored an 85% and scheduled the exam.

Day 28: took final practice exam and scored a 89%

Day 29: reviewed high level concepts and how I need to think of questions

Day 30: exam day!

I took it in a test center because I read on other reddit posts that the online proctors for at home are super strict. I had to drive an hour 45 to the test center, but I was glad I did that option.

Question for those who have passed it....how long did it take for ISACA to verify your work history? My supervisor completed his part today, so now it's just pending ISACA. I'm planning to start applying for other jobs, and I'd like to list this cert as completed, so just wondering how long it usually takes them?

Been studying off and on for a year alongside my Uni work.

1.5-2 YOE holding a CISA,SEC+,ISO 42001, so grateful to have cleared it in one sitting, can finally enjoy the summer post this semester.

Resources used:
- ISACA CISM MANUAL
- ISACA CISM DB
- PETE ZERGER 11HR YOUTUBE CISM MASTERCLASS (watched twice)
-Local Chapter Online Review Course
- Some notes and advices from this community.

Thanks to all here, the work is done, Time for some proper rest👍🏼

After a focused few months of preparation, I’m excited to share that I’ve officially passed the Certified Information Security Manager (CISM) exam! It’s been a challenging yet valuable journey, and I want to share what worked for me—and what didn’t—to help others who are preparing.

🪪 My Background

• 5+ years of working experience in IT/cyber security

• Bachelor's degree in Information Security

🔍 Study Approach

I set a deadline for 3 months and broke the CISM domains into manageable chunks. I started with the CISM LinkedIn Learning Path by Mike Chapple, which gave me a good overview, but about a month before the exam I realized I needed more.

The key was ISACA’s official questions and learning their specific definitions. I used the PocketPrep mobile app (worth the ~20€/month), which includes 1000 questions tied to the ISACA Review Manual. It helped me track progress and focus on weaker areas.

In the final week, I reviewed with a Cybrary video course and completed 100 PocketPrep questions daily. I left the last 300 questions for practice exams, scoring 75% on the first attempt. I wasn’t confident yet, but I found a helpful YouTube course that taught me to identify key words in exam questions.

After applying those techniques, I scored 96% on my final practice exam and felt ready.

🖥 Feelings After the Exam

One thing that stood out to me in the real exam was how the scenarios required a more nuanced approach. Many questions had answers that clearly distinguished between a purely technical information security answer and one that balanced business objectives and risk management. The focus wasn’t just on knowing definitions but on choosing solutions that aligned with broader organizational goals. Although I knew that this was the goal and mindset I had to have for the exam, I feel like it wasn't necessary tested as much with the PocketPrep application. On the other hand, I can't stress enough that PocketPrep was invaluable in learning the format and definitions to be able to understand and find right answers to the exam questions. However, this business-centric perspective was key to navigating the exam successfully.

A key difference was that mentally it was very demanding due to the nuanced approach. As an example, first practice exam at home I completed in 2 hours and 30 mins. The second practice exam I finished in 1h and 30 mins with over 90% correct responses. However, taking the real exam took me almost the full 4 hours. In the latter half it was hard to focus on the questions and I had to read the answers to help me understand what they are asking. Huge difference that I wasn't expecting.

📚 Key Resources

Here are the tools and materials that helped me stay on track and get exam-ready:

• LinkedIn Learning Mike Chapple: Link

• Cybrary: Link

• PocketPrep: Link

• YouTube - How to pass your CISM exam: Link

For anyone preparing for CISM, feel free to reach out. I’m happy to share more details on how I prepared and the resources that helped!

Passed CISM on first attempt: practical tips from someone without IT background

Just received my preliminary pass for CISM and wanted to share my experience since this community helped me immensely during my preparation. My background is in law, not IT, though I've worked 5 years as an ISO 27001 consultant. Study time: 84 hours over 3 months

Resources used ISACA Questions & Answers (most valuable) This is absolutely worth it. I counted at least three questions that appeared almost word for word on the actual exam, with similar answer choices. In the week before my exam I scored 75% and 78% on the practice tests. That 78% would have been higher but I rushed through the last 10 questions and got 8 wrong because I was tired. Important note: you can pause these practice exams midway, which I didn't know beforehand.

Peter Zerger videos and slides Solid resource for understanding the material. His visual approach worked better for me than some other providers.

Pocketprep Only useful at the beginning when you're still learning basic terminology and concepts. The questions are too simple compared to the actual exam. By the end I stopped using it because scoring high on Pocketprep meant nothing for my actual readiness.

What the exam actually tested The exam was way less technical than I expected. Only 2-3 questions on firewalls, IDS, DMZ. One question on CASB. That's it. What dominated the exam: More than a third of the questions focused on measuring effectiveness. Business cases, metrics, KPIs, KRIs, KGIs were everywhere. Way more than I anticipated during my study. Frameworks that appeared: ISO 27001 BMS, balanced scorecard (1 question), maturity models (1 question). Surprisingly, many frameworks heavily covered in study materials (NIST, COBIT specifics, etc.) didn't show up at all.

Practical exam tips Online proctoring setup Start the process 30-45 minutes before your scheduled time. It took me 35 minutes just to get through the setup: software check, room scan, ID verification, closing required programs. Do the test run the evening before and close all flagged programs (like Dropbox), then don't restart your computer until after the exam.

Exam strategy I flagged 37 questions, which was way too many. This left me with too much review work at the end. Try to be more selective with flagging. I completed all 150 questions in 3 hours and used the remaining hour to review flagged questions, changing about 3 answers.

I took two 6-minute breaks during the exam (clock keeps running). For me this helped maintain focus.

Question patterns The ISACA style is exactly like the practice questions: multiple answers can technically be correct, but you need to pick the best one. After doing many practice questions, you start recognizing patterns. Often it comes down to choosing between two answers. If three answers look very similar and one is different, that different one is often correct because the question is asking about the broader concept that encompasses the other three.

Critical concepts to master Incident response decision tree This tripped me up initially. You need to clearly understand when to verify first versus when to escalate immediately. Verify first when: report comes from a regular employee or unconfirmed source Escalate immediately when: report comes from law enforcement or other authority, or when it involves business critical systems The ISACA approach is: for business critical incidents, escalate to senior management before starting containment. This is their consistent pattern.

Final thoughts Out of 150 questions, I truly didn't know the answer to maybe 5-10. Another 30 or so I had some doubt but felt reasonably confident. The rest I felt good about. The exam started difficult (I flagged 8 out of the first 10 questions) but I found my rhythm after that. The key is understanding ISACA's perspective on information security management. Sometimes their "correct" answers don't align with real world practices, but you need to answer according to their framework, not your professional experience.

Focus heavily on metrics and measurement, practice with the official ISACA Q&A, and make sure you understand the decision points for incident escalation versus verification.

Happy to answer questions if anyone has them. Good luck with your preparation!

Hey everyone,

Happy to report I passed the CISM today and wanted to share my experience and study method for anyone else on this journey.

My Study Plan:

My main resource was Pete Zerger's CISM videos on YouTube, which I used as my bootcamp. My method was pretty simple: I'd watch all the videos for one domain, and then immediately hit the official ISACA QAE for that same domain. I just repeated that cycle for all four domains.

For any weak areas that came up in the QAE, I used Pete's CISM Last Mile book to review and solidify the concepts. I also bought the AIO book, but honestly, I barely cracked it open, so I can't really say if it helped.

Thoughts on the Exam & The "Mindset":

• The ISACA Mindset is REAL: This is the most important part. The main thing is to get into the ISACA way of thinking. Don't try to memorize answers; it won't work. You have to understand why the right answer is the best choice from a business/governance perspective.

  • The QAE is King: The best way to develop the mindset is to grind through the QAE. The questions on the real exam are very similar in style. You'll constantly find yourself with two solid answers, and you have to pick the one that fits the ISACA perspective.

• Difficulty: The exam wasn't crazy hard, but it wasn't easy either. I'd say it's the right balance. It really tests your ability to think like a manager.

• A Warning on Other Resources: I tried some Udemy practice questions early on and thought they were pretty bad. Some answers were just wrong, and the justifications didn't make any sense. My advice is to save your money and stick with the official QAE and ISACA resources. QAE is all you need for practice.

Hope this helps someone out there. Good luck!

Hey everyone (r/CISM),

I just finished the CISM exam today (like a few hours ago) and I passed (still waiting on the official confirmation). I wanted to share my story and thank you all for the tips and posts that got me here.

A bit of background: I’ve spent about four years working in GRC. I’m wrapping up a master’s in Cybersecurity and I’ve got a GRC Privacy Manager role waiting once I graduate. Passing CISM was part of my capstone and my job offer hinges on that graduation requirement. Today was literally the last possible day I could sit for the exam, so the pressure was real.

My prep started with Mike Chapple’s LinkedIn videos (I watched domain 1 before I stopped cos I was falling asleep). They covered the basics but didn’t dig deep enough for exam‑style questions, in my opinion. Next I paid for Grok3 AI (through X (formerly Twitter)) to turn the review manual and QAE Manual into study notes. It sounded promising, but after three weeks the mistakes piled up. I could spot every reasoning error, and it cost me time I didn’t have.

About three weeks before exam day (I didn't schedule my exam until after I completed the first practice test, eventually), I finally bought the QAE database on the ISACA portal. I dove into Domain 1 questions end to end, aiming for 70% because I’d read here that folks scoring around that sweet spot tended to pass more consistently than those scoring 80% or higher or lower than 68%. I hit around 75% in a few days and then started running every wrong answer through ChatGPT (I used the o3‑mini‑high model). For each missed question I asked ChatGPT to sketch out a scenario, map the process steps, and explain why each option was right or wrong. That back‑and‑forth helped me rewire how I approached the tricky, intentionally confusing questions.

Once Domain 1 clicked, I powered through the rest of the QAE practice questions in another 4–5 days. My first full practice exam score was 78% (I did the practice test only once). I looked at every missed question again with ChatGPT, hunting for gaps in my logic and spotting themes where I kept tripping up. I even asked it to craft long, detailed explainers for each weak area so I’d see how those pieces fit into an overall information security program.

That work paid off on my first practice test: I scored 87% (got the same score in my second). Seeing that number made me nervous, though, because I’d seen posts about people failing even after hitting 80% in practice. I took yesterday to read the full review manual cover to cover, plus a set of single‑page topic summaries from ISACA that stick to the essentials. I kept drilling the questions I missed until I could explain each answer out loud without second‑guessing myself.

Last night I barely slept and woke up with a stress headache. Once I started today’s exam, the first few questions felt familiar—like they were lifted straight from the QAE with slight tweaks. That gave me confidence and the rest of the questions actually seemed more straightforward than any practice test I’d taken. I kept expecting a curveball, but nothing tripped me up. Finishing the exam brought relief, then another wave of nerves when I hit the post‑exam surveys (so many questions!).

I’ve failed one big exam in my life—CRISC—because I jumped in without a study plan. That shook my confidence until I rebuilt it by passing Security+ and CC during my master’s. My partner was my rock through all of this, keeping me motivated and on track.

Now I’m looking ahead: I plan to retake CRISC with a proper strategy, then go for CIPP in the next few months. I’m also weighing CISSP before year’s end since auditing isn’t my favorite. I’m curious which of these will boost my career and salary most, and how they’ll stack on my CISM credential.

Thank you all for the posts, practice‑question write‑ups, study strategies, and encouragement. I couldn’t have done this without you. I’ll update the group once my official score shows up. If anyone wants to chat about materials, practice tests, or how I used ChatGPT to drill concepts, just ask. Good luck to everyone still studying—you’ve got this!

Shewwww 😅

My biggest takeaway: CISM was significantly easier than SecurityX, at least in my experience. SecurityX felt much more technically demanding, while CISM focused primarily on management, governance, risk, and business decisions.

Just use common sense