ISACA is replacing the Certified Information Security Manager (CISM) exam content outline on 3 November 2026. Every exam sat on or after that date reflects the new blueprint. The last day to test under the outline that current study materials cover is 2 November, and updated preparation material does not go on sale until September. That leaves a narrow stretch of the calendar where a lot of candidates are going to make an expensive scheduling mistake without realizing they made one.
Running the ISACA programs here means fielding a version of this scheduling question every time a job practice cycle turns over, and the answer is almost never about the new content. It is about how far along you already are. Somebody eight weeks into the current material and somebody who has not opened a book yet should be booking completely different dates, and the fastest way to waste a thousand dollars is to split the difference.
ISACA states plainly that buying current preparation material will not grant access to the updated material later. Buy the review manual in August, test in December, and you are paying twice.
What Is Changing on the CISM Exam on November 3, 2026?
The exam content outline changes. ISACA has posted the notice directly on its CISM exam content outline page, confirming three things. The new outline takes effect 3 November 2026. Updated preparation material becomes available for purchase in September 2026. Current material will not convert to the new version at a later date.
Updates like this come out of ISACA’s job practice analysis, which surveys working CISM holders to see how the security management role has moved since the last revision. The current outline dates to 2022, so four years of cloud consolidation, third party risk, privacy regulation, and AI governance have piled up behind this one. Reporting on the 2026 job practice update points toward heavier emphasis on information security strategy and program development, along with two new content areas covering enterprise architecture and information security architecture.
Here is where I am going to be straight with you rather than filling space. As of this writing, the full replacement outline with final domain names and weightings has not been published. Plenty of pages are already listing specific new percentages. Those numbers are estimates dressed up as facts, and building a study plan on them is a bad trade. Take the dates as settled and the reporting on direction as credible. Anything claiming to know the new weightings is filling a gap ISACA has not filled yet.
What Does the Current CISM Outline Cover?
Four domains, 150 questions, four hours, scaled scoring from 200 to 800 with 450 to pass. If you are testing before 3 November, this is your blueprint and your existing materials line up with it.
Domains 3 and 4 carry 63 percent of the exam between them, which is the single most useful number on that list for anyone allocating study time in the next few weeks. If your preparation has been spread evenly across four domains, it has been spread wrong. Our breakdown of where CISM candidates actually lose points goes deeper on which subtopics inside those two domains do the damage.
Should You Take the CISM Before or After November 3, 2026?
Test before 3 November if you have already started studying with current material or you can be exam ready by October. Hold off until after if you have not begun, or if your realistic timeline runs past the fall. The dangerous position is the middle, where somebody starts now with current material, drifts through September, and ends up sitting a December exam holding a blueprint that expired six weeks earlier. That drift is the common failure rather than any dramatic one, and it happens because people pick their study materials before they pick their exam date. Work the retake math before you commit. A failed attempt in late October leaves almost no runway to resit under the current outline, so a candidate trying to avoid rebuying materials ends up rebuying them anyway and losing a registration fee on top. Anyone whose preparation is thin right now is better served treating 3 November as the start of their timeline rather than a deadline to beat.
| Your situation | Target window | Why |
|---|---|---|
| Already studying with current materials | On or before 2 November 2026 | Your materials match the live blueprint and rebuying is avoidable |
| Ready to start in the next few weeks, disciplined schedule | October 2026, with buffer for a retake | A failed attempt in November leaves no room to resit the old version |
| Have not started, or experience requirement still pending | After 3 November 2026 | Study once, against the outline that will be current for the next several years |
| Employer is paying and the fiscal year closes in December | Register before 2 November, sit after | Budget gets captured this year while preparation follows the new material |
One thing to check before you commit either way. Exam registration carries an eligibility period, so confirm how long yours runs when you pay, and note that a retake means waiting out ISACA’s cooling off period before you can sit again. Neither of those matters much in a normal year. Both of them matter enormously when there is a hard cutoff date on the calendar.
What Happens to Your CISM If You Are Already Certified?
Nothing. An outline update changes what future candidates are tested on and has no retroactive effect on credentials already earned. More than 107,000 people have earned CISM since 2002 and none of them need to do anything on 3 November beyond what they were already doing, which is 20 continuing professional education hours a year, 120 across a three year cycle, and the annual maintenance fee.
The practical angle for existing holders is different. If the new outline does bring enterprise architecture and information security architecture into scope, that is a signal about where the role is heading and what boards are going to expect from security leadership. Reading the new outline when it publishes is worth an hour of anyone’s time, certified or not.
Does an Exam Update Change Whether CISM Is Worth Getting?
No, and anyone telling you to hold off on CISM because a revision is coming is giving you a reason to procrastinate rather than a reason to plan. ISACA refreshes the job practice on a cycle. Waiting for a period with no upcoming change means waiting forever, since there is always another analysis running.
The real decision sits upstream of the calendar. CISM is a management credential, so it pays off for people who own or want to own a security program, set strategy, report to executives, and handle incidents at the coordination level rather than the console. Somebody whose day is spent configuring and defending systems should be looking at a different credential first. We covered that fork in detail in CISA vs CISM, and the same logic holds regardless of which outline is live when you sit down.
CompTIA candidates went through the same exercise this year with the Security+ refresh, and the pattern repeats across vendors. Timing decisions around a blueprint change follow the same logic every time, which we walked through in the Security+ 701 version of this question. Read that one if you want the reasoning applied to a different exam.
How to Spend the Next Six Weeks
Pick your date before you buy anything else. That single decision determines which materials you purchase, and buying in the wrong order is what turns this into a duplicate expense. Anyone targeting the current blueprint should be booking an October seat now, while anyone targeting the new one should be holding their money until September when the updated review manual and question database appear.
Then check ISACA’s CISM credential page in September rather than trusting any third party summary, this one included. The replacement outline will publish there first, and the sites currently guessing at domain weights will quietly correct themselves once it does.
Frequently Asked Questions About the CISM Exam Change
When exactly does the CISM exam change?
The updated CISM exam content outline takes effect 3 November 2026, according to ISACA’s own notice on its exam content outline page. Exams sat on 2 November 2026 or earlier follow the current outline, and every exam from 3 November forward follows the new one.
Will my current CISM study materials still work?
They work fully for any exam taken on or before 2 November 2026. For exams after that date, ISACA has stated that purchasing current material does not grant access to the updated material later, so plan on buying the new review manual and question database when they release in September 2026.
What are the current CISM domain weights?
Information Security Governance is 17 percent, Information Security Risk Management is 20 percent, Information Security Program is 33 percent, and Incident Management is 30 percent. Those weights apply through 2 November 2026, and the last two domains together account for 63 percent of the 150 question exam.
What new topics is ISACA adding to CISM?
Reporting on ISACA’s 2026 job practice update points to greater emphasis on information security strategy and program development, plus two new content areas covering enterprise architecture and information security architecture. ISACA has confirmed the update dates but has not yet published the full replacement outline with final domain names and weightings, so treat any specific new percentages you see elsewhere as estimates.
Does the CISM exam change affect my existing certification?
No. An exam content outline update applies to future candidates only and has no retroactive effect on credentials already earned. Existing CISM holders continue with the same maintenance requirements of 20 continuing professional education hours annually, 120 across each three year cycle, and the annual maintenance fee.
Should I rush to take CISM before the November deadline?
Only if you are already prepared or can realistically be ready by October with buffer for a retake. Rushing an unprepared attempt to beat a blueprint change usually costs more than the material you were trying to avoid rebuying, since a failed exam means a new registration fee plus a mandatory waiting period.
How much does the CISM exam cost in 2026?
Exam registration is 575 US dollars for ISACA members and 760 US dollars for non-members, with a separate 50 dollar application processing fee after you pass. Study materials, membership dues, and any training are additional, which is part of why buying materials on the wrong side of the November cutoff stings.
Vice President of Sales. Training Camp
Ken Sahs is the Director of Sales at Training Camp, where he leads the company's sales team and oversees all ISACA certification programs. He helps organizations navigate the world of IT governance and risk management certifications – including CISA, CISM, and CRISC. He works directly with enterprise clients to create training programs that not only get their teams certified but also solve real business challenges.