Skip to main content
Ace Skills Consulting
ISACA logoAdvanced

CISM® – Certified Information Security Manager

Lead information security as a business function — and prepare for the ISACA CISM exam with a manager’s perspective.

  • 32 hours of live, manager-focused preparation
  • All four CISM domains with case discussions
  • Governance, risk, programme and incident management
  • Question technique for ISACA-style scenarios
  • Weekday and weekend batches in IST and Gulf Time
Aligned to ISACA exam CISM
Duration
4 Days | 32 Hrs
Next batch
Batches on request
Delivery
Live Online · Onsite · Corporate
Level
Advanced
Exam
CISM
Language
English

Why learn CISM with Ace Skills

  • Think like a security manager

    Learn to choose the answer that best serves business objectives and governance, as ISACA expects.

  • Build a security programme

    Understand how strategy, risk, controls and metrics fit together in practice.

  • Lead incident response

    Plan for incidents and continuity from a management and communication perspective.

  • A management credential

    CISM is widely recognised for security leadership roles in India and the Gulf.

Course overview

Information security managers sit between technical teams and senior leadership. They set direction, manage risk to an acceptable level, run the security programme and lead the response when incidents happen. CISM is ISACA’s certification for that role, and its questions are written from the perspective of a manager balancing security with business objectives. This four-day course prepares you to think and answer in that way.

Day one covers information security governance: organisational culture, legal and regulatory requirements, roles and responsibilities, strategy, frameworks and metrics. Day two focuses on information security risk management, from assessing threats and vulnerabilities to selecting risk responses, monitoring risk and reporting it to leadership.

Day three addresses the information security programme: developing and managing the programme, aligning it to frameworks, building controls, managing third parties, defining metrics and running awareness. Day four covers incident management — readiness, business continuity and disaster recovery plans, incident response, communication and post-incident review — and closes with an exam-readiness session.

Discussions use practical cases from organisations in India and the Gulf, and each domain ends with practice questions and discussion of why the best answer is best. This course is aligned to the CISM exam and prepares you for it. ISACA has announced an updated outline effective 3 November 2026, so confirm which outline applies to your exam date on the ISACA website before booking.

Key features

  • All four CISM domains with case discussions
  • ISACA-style question technique
  • Governance and metrics templates
  • Risk assessment and treatment exercises
  • Incident and continuity planning workshop
  • Study plan for the weeks after the course
  • Course completion certificate from Ace Skills Consulting

Who should attend

  • Information security managers and aspiring managers
  • Security consultants and advisers
  • IT risk and compliance professionals
  • Senior security engineers moving into management

Prerequisites

  • Experience in information security, including security management (ISACA sets the exact experience requirement for certification)
  • Familiarity with security concepts and terminology

Curriculum

4 Days · 32 Hours · 11 Modules · 4 Labs

  1. Enterprise governance

    • Organisational culture
    • Legal, regulatory and contractual requirements
    • Organisational structures, roles and responsibilities

    Security strategy

    • Developing an information security strategy
    • Governance frameworks and standards
    • Strategic planning, budgets and resources
    • Business case development
    • Lab: Draft a security strategy outline for a case organisation · 45 min

    Metrics and reporting

    • Key goal, performance and risk indicators
    • Reporting to the board
    • Domain practice questions

  2. Risk assessment

    • Emerging threat and vulnerability landscape
    • Risk assessment and analysis
    • Risk appetite and tolerance
    • Lab: Assess and rank risks in a case scenario · 40 min

    Risk response

    • Risk treatment options
    • Risk ownership and accountability
    • Control selection
    • Risk monitoring and reporting

    Third-party risk

    • Vendor risk assessment
    • Contracts and assurance
    • Domain practice questions

  3. Programme development

    • Programme resources and frameworks
    • Policies, standards and procedures
    • Control design and implementation
    • Architecture alignment

    Programme management

    • Awareness and training
    • Integrating security into business processes
    • Third-party security management
    • Programme metrics and continuous improvement
    • Lab: Design a security metrics dashboard for leadership · 40 min

  4. Incident readiness

    • Incident response plan
    • Business impact analysis
    • Business continuity and disaster recovery plans
    • Testing and exercises
    • Lab: Incident response tabletop exercise · 50 min

    Incident operations

    • Incident classification and escalation
    • Communication with stakeholders and regulators
    • Investigation and evidence
    • Post-incident review

    Exam readiness

    • ISACA question technique
    • Cross-domain practice set with review
    • Study plan and outline update guidance
Download full syllabus (PDF)

Skills you will gain

  • Security governance
  • Security strategy
  • Risk assessment
  • Risk treatment
  • Third-party risk
  • Security programme management
  • Security metrics
  • Policy development
  • Incident management
  • Business continuity

Tools & technologies

  • Case study workbooks
  • Practice question bank
  • Risk register templates
  • Metrics dashboard templates

Certification exam

Exam details
Exam nameCISM – Certified Information Security Manager
Exam codeCISM
Number of questions150
Duration240 minutes
Passing score450 / 800 (scaled)
Voucher includedNo — book directly with the vendor
Question formatMultiple choice
DeliveryOnline proctored or Test centre

Skill areas measured

  1. Information Security Governance
  2. Information Security Risk Management
  3. Information Security Program
  4. Incident Management

Exam details are pending verification. Vendors change exams; confirm on the official vendor page before booking. Official exam page (opens in a new tab)

Schedule & Pricing

Live Online

Individual

Price on request

  • 32 hours of live, trainer-led sessions
  • 4 hands-on labs
  • Ace Skills course completion certificate

Onsite

At your office or our centre

Pricing depends on location, group size and dates.

  • Delivered at your premises or an Ace centre
  • Same curriculum and labs as live online
  • Dates planned around your team

Corporate / Team

Private batch for your organisation

A private batch with content adapted to your environment and goals.

  • Customised curriculum
  • Private batch, online or onsite
  • Progress and assessment reports
  • GST invoice and PO-based billing

No public batches scheduled — Talk to an Advisor for a private batch.

Projects & labs you will build

  • Day 1 · 45 min

    Draft a security strategy outline for a case organisation

Your certificate

Certificate of Completion — Ace Skills Consulting

Awarded on completing the course. It records the course title and training hours, and you can share it on your LinkedIn profile.

The ISACA certification itself is awarded by ISACA when you pass exam CISM.

Frequently asked questions

Is the CISM exam outline changing?

Yes. ISACA has announced an updated CISM outline effective 3 November 2026. Check which outline applies to your exam date on the ISACA website; we update the course to match.

What is the exam format?

The exam has 150 multiple-choice questions over four hours, with a passing scaled score of 450 on a scale of 200 to 800.

Can I take the exam before I have the required experience?

ISACA allows candidates to pass the exam and then apply for certification once they meet the experience requirement within the permitted period. Check current rules with ISACA.

How is CISM different from CISSP?

CISM focuses specifically on security management and governance, while CISSP covers a broader technical and managerial range.

Can you run this for our leadership team?

Yes. Private batches can use your governance structures and risk registers as discussion material.

Related courses

Explore more

All Cybersecurity courses ISACA certifications

CISM, CISA, CRISC and COBIT are trademarks of ISACA.

Train your team on CISM

Private batches online or at your office in India and the GCC, with a curriculum adapted to your environment.