CISM passing score
The CISM passing score is 450 on ISACA's scale from 200 to 800, and the pass is decided on the whole exam rather than domain by domain.
CISM
450 to pass
The CISM exam is scored from 200 to 800, and 450 or higher passes.
Your result
450 to pass. The CISM exam is scored from 200 to 800, and 450 or higher passes. It has 150 questions in 4 hours, and the pass is decided on the whole exam, not domain by domain.
Start on security management
How the CISM exam is scored
- 450 to pass. ISACA reports every exam on a scale from 200 to 800. 800 means every question right, and 200 is the lowest score possible.
- The whole exam decides it. Your score comes from all the scored questions together. Domain results are for information only.
- 150 questions in 4 hours. Some are unscored pretest questions.
- Results. A preliminary pass or fail shows on screen, and the official score arrives within 10 working days.
CISM domains
| Domain | Share |
|---|---|
| 1. Information Security Governance | 17% |
| 2. Information Security Risk Management | 20% |
| 3. Information Security Program | 33% |
| 4. Incident Management | 30% |
Retakes and applying
- 4 attempts in 12 months. Wait 30 days after your first attempt, then 90 days after the second and 90 after the third.
- 5 years to apply. After passing, apply for the CISM with 5 years of experience; waivers cover up to 2.
More here: Security certification passing score · Experience requirements
Security Leader Genius Pro
US$149one payment
- 27 interactive lessons
- 338 practice questions
- 2 full 150-question practice exams
- 3 free tools
Full refund within 14 days, for any reason. Terms
One payment. No sales tax is added. Access until October 31, 2027.
Questions? support@unigenius.co.uk
Questions people ask
What is the CISM passing score?
450 or higher on a scale from 200 to 800. 800 means every question right and 200 is the lowest possible score.
Do you need to pass every CISM domain?
No. The score is based on all the scored questions together; domain results are for information only.
How many questions are on the CISM exam?
150 multiple-choice questions in 4 hours. Some are unscored pretest questions.
What are the CISM domains?
Information Security Governance 17%, Information Security Risk Management 20%, Information Security Program 33% and Incident Management 30%.
How soon can you retake the CISM?
30 days after a first attempt, then 90 days after the second and 90 after the third, with at most 4 attempts in 12 months from your first.
When do CISM results come out?
A preliminary pass or fail shows on screen, and the official score follows by email within 10 working days.
How long do you have to apply for the CISM after passing?
5 years from the exam. You also need 5 years of experience, with waivers for up to 2.
How we work this out
What it does
The CISM exam passes at 450 on a scale from 200 to 800. Enter the score on your report to see how far it is from 450, and when you can sit again.
The CISM exam.
Method
- The scale, pass mark, exam length, domain weights and retake policy are from ISACA's 2026 candidate guide.