ISACA updated the CISM exam content outline, and the new version takes effect on November 3, 2026 1. Updated preparation materials started rolling out on September 1, and ISACA recommends the updated set for anyone testing on or after the change 1. I passed SecurityX earlier this year and CISM sits next on my list, so the update landed in the middle of my planning rather than behind it.

The four domains keep their names, the weights barely move, and two content areas appear that the current outline does not contain. The weight numbers get the attention, and the content change is the part I have to plan around.

What changed

ISACA published the new distribution with the announcement: Information Security Governance at 18 percent, Information Security Risk Management at 20, Information Security Program at 33, and Incident Management at 29 1. The current outline runs 17, 20, 33 and 30, which is still what the exam content outline page shows next to its notice that the new outline applies from November 3, 2026 2. Governance gains a point and Incident Management loses one, which on a 150 question exam amounts to one and a half questions changing buckets 2. One and a half questions do not move a study plan, which is why the date and the materials get my attention.

The additions carry the weight. ISACA added enterprise architecture and information security architecture as content areas, framing them around a security manager’s need to understand the technologies in their care, and put more emphasis on information security strategy and program development 1. Neither architecture area appears in the subtopic list the current outline page publishes 2, and a study guide keyed to those subtopics has nothing to point me at for either one, which is why the two areas get their own block in my plan.

I book the date before I buy a course

ISACA ties the change to the test date. ISACA set the effective date at November 3, 2026, and states that the exam reflects the new outline from that date 2. Registration does not lock a version. Registration is continuous, eligibility runs six months from the day I register, and appointments open 90 days ahead, so an October registration can land in December 3. Rescheduling is free with at least 48 hours of notice, so a seat I move past November 3 takes me onto the new outline with it 3.

My rule for a moving outline is to pick the appointment before I pick a course, since I have to match the materials to the date I book. The exam fee runs US$575 as a member and US$760 otherwise, with a US$50 application processing fee after I pass 3.

The master’s program I finished this year is where the preparation and the exam fee come from. WGU offers the CISM in the program and points to its courses as exam preparation 4, and it includes a voucher for the exam at no extra cost 5. The handbook describes the route: pass the Cybersecurity Management assessment, request the voucher through the form Student Support Services emails, and no student is required to use it 6. The voucher covers one attempt at the exam; the ISACA membership and the US$50 processing fee sit outside it 3. Prep materials bought for the wrong side of the date get paid for twice.

Materials that match the date

ISACA’s updated preparation covers the Review Manual in print and electronic formats, the Questions, Answers and Explanations database, and the Online Review Course, and the recommendation for exams on or after November 3 is to use the updated materials 1. An older set stays a match for an appointment through November 2 and stops matching the next morning.

I buy on two details. The question database is a six-month subscription to a pool of 1,047 items, so I should start the subscription near the appointment rather than months ahead of it 3. I also check which outline a course was written against before I pay for it, because a bank rebuilt in September can carry the two new areas, and one written for the current outline has no reason to.

Where the architecture areas sit against my work

My seat is the assessment and relay end of security work. I read an advisory or a finding, work out how far it reaches, and hand the order and the reasoning to the people who own the systems. Deployment runs on its own automation, and what I add to a patching cycle is the sequence and the case for it. That work leans on knowing how a set of systems holds together, which is the same question the two new areas ask in a governance frame.

The added areas are also the part of a management exam where my day job helps. I map findings to systems from memory and from the last incident that showed me why the mapping matters. The exam wants the vocabulary and the formal patterns for that mapping, and those I can study.

The plan

The order is settled even though the calendar is not. The appointment goes on the books on the far side of November 3, so everything I buy is built for the outline I will sit 12. The question database arrives close to the appointment, so its six months run against the exam. The two architecture areas get their own block in the study plan, since they appear in the update and not in the current outline 12. The four domains keep the weights I already understood, so the bulk of the study time does not move.

A part of the sequence sits outside the update. Pass the exam, pay the US$50 processing fee, document the experience, and apply within five years of passing 3. An outline change does not touch any of that.

The appointment date is the first study decision I have to make, and the rest of the plan follows from it.

  1. ISACA. (2026, September 10). ISACA updates CISM exam content outline, factoring in today’s technologies, security responsibilities [Press release]. ISACA. https://www.isaca.org/about-us/newsroom/press-releases/2026/isaca-updates-cism-exam-content-outline-factoring-in-todays-technologies-security-responsibilities ↩︎ ↩︎ ↩︎ ↩︎ ↩︎ ↩︎ ↩︎

  2. ISACA. (n.d.). CISM exam content outline. ISACA. https://www.isaca.org/credentialing/cism/cism-exam-content-outline ↩︎ ↩︎ ↩︎ ↩︎ ↩︎ ↩︎

  3. ISACA. (n.d.). CISM certification. ISACA. https://www.isaca.org/credentialing/cism ↩︎ ↩︎ ↩︎ ↩︎ ↩︎ ↩︎

  4. Western Governors University. (n.d.). ISACA certifications. WGU. https://www.wgu.edu/online-it-degrees/it-certifications/isaca-certifications.html ↩︎

  5. Western Governors University. (n.d.). Online master’s in cybersecurity and information assurance. WGU. https://www.wgu.edu/online-it-degrees/cybersecurity-information-assurance-masters-program.html ↩︎

  6. Western Governors University. (2026, June 8). Optional third-party certifications following completion of WGU internal assessments. WGU Knowledge Center. https://cm.wgu.edu/t5/Information-Technology-Student/Optional-3rd-Party-Certifications-Following-Completion-of-WGU/ta-p/33108 ↩︎