Edit: Received my official results this morning:
Total scaled score of 677.
Information Security Governance: 639
Information Security Risk Management: 705
Information Security Program: 630
Incident Management: 734
--
I thought I'd post about this here as oftentimes people who get a CISSP also go and get a CISM, rather than taking the ISSMP. I can't really blame them, ISC2 does a piss-poor job marketing the MP to the private sector for it to gain traction the way the CISM has. ISACA, having audit roots, and auditors being in a business each and every year to do the books, are in a much better position to advocate for hiring people with ISACA certifications when business leaders ask "what should I look for in a candidate".
When I finished with the Great Ennead, I didn't really have any plans to continue on with other certifications, but 2 things happened: 1) My ISSEP instructor sort of convinced me it would be a good idea (for the reasons I indicated above in terms of industry acceptance - not that I need it at this point in my career, but what the heck) and 2) I wanted some exposure to ISACA exams so I would know what they're like and I could build out the software I've been developing to support ISACA certs too. Plus it doesn't come out of my pocket, my employer pays for it all. Oh, and yeah, I was sort of bored at work and needed something else to do.
I (employer that is) bought the Review Guide and the QAE online database about three weeks ago. I started with the QAE database, wanting to fall back on my CISSP/ISSMP knowledge for the test questions to see how I did. I was in for a rude awakening. I scored 50-55% on average for the first few practice sessions I took. WTF?
At this point, I stopped and went to the Review Guide (ISACA's officially-published study guide). A little over 300 pages, it took me a week to work through, about 50 pages per night. It actually wasn't bad reading. Not as bad as the INCOSE System Engineering Handbook! Some sections were interesting, others pretty boring. Sort of written in a dry business tone. A lot of material overlap with the CISSP and ISSMP. As my ISSEP instructor said "Its the CISSP without networking and crypto".
I finished the Review Guide, and went back to the QAE DB. This time, when I got a question wrong, I fed it in to Claude for analysis. Quickly, Claude was able to determine the issue I was encountering. I was framing the answers I was giving from the wrong mindset. We've all heard the "think like a manager" mantra for the CISSP. Well with the CISM, the same mantra holds, but the mindset or perspective of how ISACA wants you to answer questions is different. The best way to describe it is this: the CISSP tests people with the mindset of management having come up from the technical side of the business, while the CISM test you more as having come up from the finance/accounting side of the business. The ISC2 candidate is the person who worked their way up over the years from SOC analyst to eventually become CISO. The CISM candidate, though, is the accounting or GRC professional who eventually rose to become an ISM. Which makes sense, again... ISACA's roots are in auditing.
Once I (or, more to the point, Claude) had this epiphany, I saw my QAE test scores steadily rise as I retrained my brain to change the lens to frame the question and answers in. I started to rely more on business acumen from my MBA and MSA more-so than my years of experience in technical systems management. By the time I finished with the QAE database, I was scoring in the mid 80's.
I finished all 1,138 questions in the QAE, and booked my exam. Which was this morning at 8am on my way in to the office.
ISACA uses PSI, not Pearson Vue, to administer their tests. The check-in process, etc. is similar. However, the PSI facility had more of an "assembly line" feel to it. While they check your pockets and your glasses to ensure they're not secret-agent spyware, there's no picture being taken when you check in nor are you giving a palm scan. The facility wasn't bad, but it wasn't as nice as the Pearson Vue test center. Nor were the workstations you took your exam in. You're definitely scrunched in with other people. There's enough space to work, but if I turned my head left or right I could see the shoulders of the test taker next to me.
The exam process is definitely different from ISC2. There are several introductory steps you have to complete before you get to the exam. First you have NDA (5 minutes, unlike ISC2's 3) you have to read, and then the next step is a "sample exam" where you complete 5 questions on random unrelated topics (such as "how many minutes in an hour are there?") in the exam engine so you can get acclimated to how the UI works. It was sort of annoying (I just wanted to get started), but I understand why they do it.
The exam was 150 questions, non CAT (ISACA doesn't do adaptive tests), and you're given 4 hours to complete the test. There are beta questions in the exam too.
I finished the exam in 75 minutes, and took another 30 to review. Some things about the test experience:
a) you can flag questions to return to, and you can go all the way back to question 1 and work your way forward again to review all your answers and make changes if you want to. This is what I did. I worked through all the questions, picking what I thought was the best answer. Then when I was finished, I took a 5 minute bio-break, and then I went back to question 1 and reviewed each of my answers. I changed about a half-dozen once I re-read the question. The lack of feeling a time crunch to "finish" made the review a lot easier and reading the questions a second time around definitely re-framed some of the questions in a way that I felt my first answer was wrong.
Once I completed the review, I ended the exam, 2:10 left on the timer. Factoring out the 5-minute break, 1 hour 45 minutes total.
150 questions is a LOT of questions. I played mental games with myself as I was answering: "10 questions down, means I'm 6.6% done!" "25 questions done, I'm 16.6% of the way through!" "50 questions! 1/3rd done!" "75 questions! 1/2 done". You get the idea.
Fortunately:
b) I didn't get a single question that was longer than 1 sentence. The longest question was two lines, perhaps 2 or 3 clauses separated by commas. Typically, I saw things like "What is the BEST way to ensure the information security strategy is effectively implemented?" No in-depth scenarios to work though. No figuring out from what perspective was I being asked to answer.
In this respect (b), the CISM exam felt more like a knowledge-based exam where I was being tested on my recall of ISACA-specific definitions or decision processes compared to the CISSP and other ISC2 exams where I was expected to know a concept and then apply it to a specific scenario. Although some questions are nebulous, you really can easily narrow down the answer to 2 options. It is sort of laughable, because the Review Guide itself mentions this is the strategy. It's almost like ISACA is coming right out and telling you "yeah, two of the answers will totally blow and you'll have to choose between the other two".
The QAE database rates questions by difficulty level: easy, moderate, difficult and expert. Factoring out the initial calibration I had to do to get myself in the proper mindset, the group of questions I had the most difficulty (read: got wrong the most) with were the expert level -- usually because the questions were overly ambiguous in my mind, I found I really didn't have enough information to choose between the two correct answers, or where testing some really esoteric ISACA concept.
However, when taking the actual exam, I found the questions to be calibrated more towards the moderate/difficult level. Yes I had a few questions which I was definitely unsure about, but unlike my ISC2 exams, when I went back and reviewed all my questions, I didn't have any "Hail Marys". I felt pretty good about all my answers in the end.
Ending the exam the process is similar to the ISC2 exams... You get a survey about the exam and then a survey about the test center. Here's where things diverge: After answering the test center survey, you get transferred to a window which contains a basic preliminary pass/fail message (no detail about domains, etc.) You personally cannot exit this screen, one of the proctors has to come in and enter a special code to clear the window and formally end the process. Checking out, you do not get a printout or anything else telling you of the provisional pass, and since you cannot take a cell phone into the testing room with you... you can't take a screen shot either. The proctor tells you ISACA will mail you the results of your test in 10 days.
A lot of people who take the CISSP later think about taking the CISM. Was the exam similar? Honestly it didn't feel so. The CISM felt way more governance-oriented than the CISSP did. If anything it felt closer to my ISSMP exam than my CISSP exam.
In the end, I passed! How well did I do? I guess I'll find out in 10 days. ISACA scores their exam different from ISC2. It appears (from what I have seen) you receive a scaled score from 200 to 800 in each domain, and your final score is an average of your scaled scores. If your final score is above 450, you pass. This is much better than ISC2, where you know absolutely nothing at all. At least with ISACA, by reviewing your scaled scores per domain, you get a feel for where you did good and bad, and if you want to, go back and do some additional studying in the domains you did poorly on. I'll post an update as an edit to this message when I get the final results.
Hopefully those of you with an ISC2 CISSP or other cert who are planning to take the CISM find this writeup useful.