CISM Certification: Your Path to Security Management

CISM lives in CISSP's shadow globally, but in the Middle East it often outranks CISSP. Central banks in UAE and Saudi Arabia specifically list CISM on tenders - because it's ISACA-branded and ISACA is what regional auditors trust. If your career path is security governance or you're aiming at CISO in a Gulf bank, CISM is arguably more useful than CISSP. Here's how to pass it in two months.

§What CISM tests

4 hours, 150 multiple-choice questions. Pass mark: 450/800 (scaled). USD 575 for ISACA members, USD 760 for non-members. Four domains.

Notice how the weights concentrate on Program and Incident Management - that's 63% of the exam. If you're weak on either, don't book yet.

§CISM vs CISSP - pick correctly

The honest answer: both, if you're serious about a management career. But if forced to pick one and you're in Bangladesh/Middle East, CISM often edges out CISSP for local roles.

§60-day study plan

• Weeks 1–2: Domain 1 Governance - strategy, policy hierarchy, board reporting, compliance
• Weeks 3–4: Domain 2 Risk - assessment methodologies, treatment options, monitoring, KRIs vs KPIs
• Weeks 5–6: Domain 3 Program - resource management, security metrics, awareness, procurement
• Weeks 7–8: Domain 4 Incident - IR lifecycle, forensics oversight, BCP/DR integration, post-incident reviews
• Final week: 4 full practice exams. Focus on translating technical scenarios into management language.

§The ISACA answering style - completely different from CISSP

Where CISSP rewards 'do the process,' CISM rewards 'align with business objectives.' Every question comes with 4 answers that could all technically be correct - you pick the one that most clearly aligns security with business strategy. Rules of thumb:

• The answer that mentions 'business objectives' or 'strategic alignment' is usually right
• The answer that involves the board or senior management is usually right
• Never pick 'buy new technology' - always 'assess risk' or 'align with strategy' first
• Metrics answers usually preface: 'what the board can act on' beats 'raw counts'

§Endorsement and CPE

Same catch as CISSP: pass the exam, then apply for certification with 5 years of infosec management experience within 5 years of the exam date. Waivers up to 2 years for CISSP, CISA, or specific master's degrees. After certification: 120 CPE hours over 3 years, plus a USD 45 annual maintenance fee.

§Salary and regional weight

§Resources

• ISACA CISM Review Manual - official, non-negotiable if you can afford it
• Hemang Doshi CISM course on Udemy - clear, cheap, high value
• Prabh Nair's CISM YouTube playlist - free deep dive, excellent
• ISACA CISM Questions, Answers & Explanations database - closest to real exam
• Boson CISM practice tests - hard, worth the price

§FAQ

Is CISM harder than CISSP?

Different, not harder. CISM is narrower but requires stricter management thinking. Most candidates find CISM easier if they have management experience.

How long is CISM valid?

3 years, renewed by 120 CPEs (min 20 per year) plus the annual maintenance fee.

Do I need ISACA membership?

Not required, but membership saves USD 185 on the exam and USD 20/yr on maintenance.

Can I take CISM online from Bangladesh?

Yes, via PSI remote proctored testing. Also available at Pearson VUE centers in Dhaka and Chittagong.