CISM is the leading information security management certification globally with over 107,000 holders. It is a 150 multiple choice exam across four domains covering the governance and management of enterprise information security. The exam rewards knowledge of ISACA terminology and CISM-specific definitions, not demonstrated management capability. XCISM is built for security managers and programme leads who want to apply security governance, risk management, and programme design skills in real scenarios.
Across five instructor-led days, XCISM covers all four CISM job practice domains at current weighting: Information Security Governance (Domain 1, 17%), Information Security Risk Management (Domain 2, 20%), Information Security Programme (Domain 3, 33%, the highest-weighted domain), and Incident Management (Domain 4, 30%). Coverage reflects the current ISACA CISM outline. Note: ISACA has announced a CISM exam content update effective November 2026. XCISM content will be updated to reflect this when the updated outline is published.
On Day 5, participants navigate a security governance and programme development scenario for a simulated organisation facing new regulatory obligations. A senior practitioner with security management experience assesses governance decisions, risk methodology, and programme design. XCISM certificate and Practitioner Assessment Report issued. Aligned with ISACA CISM four domains, ISO 27001:2022 Clause 5 and 6, NIST CSF 2.0 Govern function, COBIT 2019, ISO 31000, NIS2 Article 20, and DORA Article 5.
