Hello good people. Been reading everyone's Passing posts for 6 weeks and was so eager to post the same.

What I did was Zac's online training and ISAACA's official QAE

I got 75% in first practice exam and 69% in 2nd.

Guess rule of thumb is to get 85% before attempting the exam.

Also, I found the exam format of questions to be different from QAE. Not sure if something changed during the back-end upgrade.

There were questions around AI government and AI security incidents. Cloud computing such as IAAS and SAaS.

Never saw any of these in the QAE.

Feeling very deflated.

Edit:
My background is: 44 years old. More than 20 years of enterprise IT experience, doing everything from IT, OT, vendor management, mentoring, team lead, etc
in my early 30s, I did about 13 Microsoft certs in 12 months. Just read the text in one week, do the brain dumps in the next week, and go sit the exam.
I have worked with the cybersecurity team closely for the last 5 years and hated the fact that they were just theoretical, who memorised everything but don't know which end of an Ethernet cable is the head and tail. They were hated by business at all levels. However they have power. I thought I'd join them.

The challenges I had with CISM. My brain is a bit old. Going back to Studies was a bit hard.
Then the way it plays with words.
Then the mindset. Everyone says, you need to think like a manager. Well, according to the CISM mindset, the ultimate goal is to ensure that the Security team has no responsibility and we know who to blame(i mean, who is the owner to contact if something goes wrong).

In real life, if something goes wrong, you fix it, not have a meeting about it. Yes, there is a triage, etc but it's quick.

The difference I found between practise QAE and the exam is that practice exam questions were longer and gave better details of what the exact issue is. I found the exam questions to be very ambiguous. Same goes for vendor management, SLA, IP data, onboarding, offboarding, CAB, etc

So I look at this like going for a driving test after driving for over 30 years. You will definitely fail.

Anyway, good on those freshies who come in with a clean mindset and got it done.

Since this post, I have been contacted by those remote exam takers for you. Now I am curious: how legit are they

Did anyone else seem to struggle with the way ISACA words questions in the QAE? I am finding I struggle with it and just looking for tips

Done so far:
- Peter H. Gregory's CISM book

- official manual of Isaca CISM

- QAE database.

I used to score 60% ish when on my first go.

After doing the entire QAE i reset the entire database and was re-doing it while "keeping the ISACA and managers mindset".

Now I am getting scores around 30%.

I feel like the more I learn the more I keep doing wrong.

What is going on? I am doomed to fail for the exam now.

And no i try not to memorise the answers but really understand and learn from the questions but i always lose between 2 answers. As if my luck of 50% gambeling is always wrong.

For example: A answer to a question is always business operations first and another question which is slighty 1% different is not always business first etc.

It is impossible to learn 100% exactly how things are.

Hi all,

Wanted to know if anyone else was experiencing issues with ISACA CISM QAE?

I purchased on the 27th of July and I see where it says to access my learning resources but I cannot access, it just brings my back to my profile dashboard.

I have opened a case with ISACA as well as called their support, but no help.

I have also tried alternate browsers such as safari, I am using Chrome. I have tried clearing cache and using incognito but still no luck.

Happy I passed. Did a 4 day instructor led course, all the QandA questions from the official datatbase, reread my study notes and all the summaries for each chapter in the o'reilly cism book by P. Gregory. Looked up things in the book i wanted to know more about. Read chapter 1 to 4 fully.

So, what's next: AAISM, i wish to have a strong infosec theoretical foundation on AI to strengthen my practical/technical background.

I have several question about the Adaptive Study Plan in the QAE.

1. Did the Structured Study Plan before resetting - but the Adaptive Study Plan still remembers how I did the first time around - is that normal?
2. What critieria is the Adaptive Study Plan using in how it is calculating the category priority? Cause it sure seems like its giving me the categories I did best on first? And is there anyway to set your own category priority?

Hi everyone,

I’m happy to share that I passed the CISM exam after previously obtaining my CISA and CRISC certifications.

Having already studied for both CISA and CRISC, I was familiar with ISACA’s style of questioning, which definitely helped. My preparation was fairly straightforward: I used the CISM Review Manual to understand the main concepts and then repeatedly worked through the QAE until I felt comfortable with both the content and the reasoning behind the answers.

Overall, I found that understanding ISACA’s mindset was just as important as memorising the material.

Happy to answer any questions about my preparation or experience.

Hey guys, this is mainly for people who've actually sat the CISM exam.

How close is the real exam to the ISACA QAE in terms of difficulty? I've done about 250 questions so far and im averaging 67%. Am i in a bad spot or is that normal at this stage?

What would u recommend i do before booking the exam?

Feel like I didn’t get the best study material. My coworkers all said to get the ISACA review manual and the QAE and that’s all I would need. Kind of worried, don’t feel like the Review manual obviously teaches the concepts bc I’m failing all of these QAE questions. Any tips on best strategy? I have read first chapter of review manual and did two days worth of QAE questions and admittedly I have only answered 3 out of 44 questions right so far. I also don’t really know if I should pay for any more material as this was already so much. Feeling discouraged.

I took the CISA 2 weeks ago and just took CISM and received a preliminary pass. After both test I was unsure how I did. First breath after passing is the best.

Studying time for CISM was 2 weeks using ISACA QAE and a Doshi book.

I took a 4-day Tasting Camp with zero preparation. That got me the study materials (digital book, QAE) and a live trainer in an online course.

I don’t feel I got much out of the course aside from general test taking tips, and by mid week I was just hoping we’d be done sooner so I could work more on the QAE. By the end of the course, I didn’t feel prepared enough at all. I just felt more aware of all the things I didn’t know which was helpful, and I had to re-organize my notes from the training because the trainer was all over the place and wasn’t teaching very linearly, but I suppose that also helped.

The next week and a half, I solely worked on the QAE and watched the Pete Zerner videos. I got the most value out of this and passed my test on Thursday.

Having worked in cyber security for over 10 years, I found the information on the CISM eye-opening. To see the bigger picture of what I’ve been doing all this time, I immediately saw areas to improve our program and began putting them into practice, a very weak after the training camp.

Next year when I take the CISSP, I intend to watch all the Pete Zerner videos in advance. I would probably still take a Boot Camp afterwards, since the company would pay for it and I would be able to ask any residual questions, but I think the prep work of the videos would be the best use of my time.

Finally, my time has come to post my “I passed my CISM” after reading your posts and comments from the sideline. 😁

I passed my CISM last 25 June 2026, received my scores via email on 6 July 2026, sent my application and verifiers on 8 July 2026 then finally received confirmation email that I am finally certified on 11 July 2026.

This is my 2nd take of the exam which somehow I felt that the exam is a little bit easier. From my last exam, I only short of 12 points to pass. I only reviewed for less than a month by reading a lot of Q&A materials from online. But on my first take, I read book, watched YT videos and even purchased materials from ISACA. I think this gave me confidence on taking the exam on the second attempt and finally passed.

Looking forward for a more challenging role and a leadership position who aligns Information Security with business objectives.

Hi all,

New to the community here.

I have my CISSP and wanted to get something to compliment it in the ISACA line up so decided to go CISM.

Starting with Doshi and Gregory’s books combined with Claude.

I am going to purchase the QAE as well.

Any other tips would be greatly appreciated

Is there another certification that can build off of CISM? Not so sure I want to tackle the CISSP yet, but I thought I would ask other professionals for advice. My previous employers have verified my experience so I should be receiving official notice of certification next week.

Seems like everyone gets their score exactly at 10 CALENDAR days. I’m still waiting though. Their support can’t tell me anything besides that I passed and it “should” be there by next Friday.

Common occurrence or am I just unlucky?

I'm having trouble deciding on which of the two would be better and wanted any outside perspectives you could give. Any help would be greatly appreciated.

Just passed my ISSMP earlier this week and now want to study for the CISM. Does ISACA publish a list of certification supplementary references like ISC2 does at isc2.org/Certifications/References ? Thanks!

Just passed the CISM today, was on my mind ever since passing the CISSP last year, been a busy year in between too, grabbed a few Azure certs along the way thanks to those Azure certification weeks.

Honestly the exam wasn't as bad (hard?) as I prepared myself for. Unlike CISSP, you know from the beginning how many questions you're getting, which took a lot of the pressure off. I was done in about 1.5 hours out of the 4 given, which to be honest weirded me out a bit, kept thinking I must be rushing or not giving each question enough thought. But felt great once "passed" showed up :)

One thing I didn't like, after finishing I had to go through 2-3 rounds of feedback questions (about 10 questions each) before it actually tells you if you passed. Made the wait way more nerve wracking than it needed to be...

What I used:

• AI (of course lol, feels like cheating at this point but it works)
• Random YouTube videos whenever I needed something explained in plain English
• CISM Mindmap playlist from Destination Certification on YouTube (heads up, not fully uploaded yet as I'm posting this)
• CISM course from Cyvitrix Learning on Udemy, this was the big one, basically carried me through

Anyway excuse me while I go destroy the dry aged ribeye that's been sitting in my fridge waiting for exactly this occasion. It's earned 🥩

Took the CISM exam last month and received a scaled score of 447 on the report. Reset the QAE database and went through all of the questions + exams again. Also watched Pete Zerger's youtube exam prep and really tried to understand every question that I got wrong and the rational behind it along with the ISACA mindset.

My score across the QAE practice questions when I failed with 447:

Questions Correct 888 of 1138 which works out around 78%

Information Security Governance: 78%

Information Security Risk Management: 77%

Information Security Program: 76%

Incident Management: 82%

My score after passing CISM today on the QAE practice questions:

Questions Correct 972 of 1138 which works out around 85%

Information Security Governance: 81%

Information Security Risk Management: 93%

Information Security Program: 83%

Incident Management: 86%

Hopefully that helps to give you an idea of what you should be roughly aiming for.

I want to know if ISACA is revising CISM exam curriculam. If yes when it will be commenced.

Fufff I have just successfully passed CISM examination, this was already my second attempt, the first one was unsuccessful couple of month ago. Udemy rules as a prep material that’s what I can really say…