CISM Exam and Certification

There are number of certifications which can one can pursue and obtain in the field of Information Security. The main ones are 

           (a) CISSP  (Certified Information Security System Professional) from (ISC)2 -   -  Very technical and exhaustive.
           (b) CISM (Certified Information Security Manager) from ISACA  - Focused on Management aspects and covers various standards and less technical than CISSP           
           (c) GIAC Security Essentials  from SANS. - focused on basics           
           (d) Lead Auditor ISO 270001 - very broad and based on the ISO standard

 In this post I am going to give you a brief overview of CISM certification  in terms of eligibility, procedure and study material required for this exam. ISACA, the body which conducts the CISM exam is a non profit independent organisation involved in providing certifications for Information Systems (IS), Security, Enterprise governance and management of IT. It also develops IS auditing and control standards such as COBIT for IT governance and management. It has four certifications, exams for which are held twice a year in June and December :-

          (a) CISA    -     Most popular one focused on IS auditing.

          (b) CISM    -     Focused on Information Security.

          (c) CRISC   -     Focused on Risk Management.

          (d) CGEIT   -    Focused on IT Governance.

          The CISM credential targets the needs of IT security professionals with enterprise level security management responsibilities. Credential holders require to possess advanced and proven skills in security risk management, program development and management, governance, and incident management and response to such incidents. This certification demonstrates competence in Information Security Manager Role. The CISM exam is held by ISACA twice a year in June and December. ISACA requires the applicant to have 5 years of relevant experience in the field of Information Security with 3 years in the role of Information Security Manager.

The procedure for obtaining the CISM designation is :-

(a)   Check if you meet the eligibility criteria for the exam  from ISACA website.

(b)  Register for the exam by paying the online fees. 350 to 450 $

(c)  Purchase the CISM Review Manual ($85) for studying for the exam  

Once you have passed the exam, you get the CISM credential by doing the following : -

(a)   Agree to ISACA code of Professional Ethics

(b)   Agree to comply with the CISM continuing education policy.

(c)   Submit verified evidence of five (5) years of work experience in the field of information security.

It is advisable to become an ISACA member as it gets you discounts on the exam as well as the study material.

The CISM exam tests your knowledge of Information Security management principles in role of Info Sec Manager in the four domains in the percentages listed below :-

(a)  Information Security Governance  (24% )

(b)   Information Risk Management and Compliance (23% )

(c)   Information Security Program Development and Management (25% )

(d)   Information Security Incident Management ( 18% )

The main sources for study for the exam are the following

(a)   CISM Review Manual 2012 - The manual is available for $85 ($110 for non member) plus $26 for international shipping from the ISACA website. www.isaca.org/cismbooks. It takes a week to 10 days to deliver to India.

(b)     CISM Practice Question Database v12 - This can be purchased from the ISACA website and is available as a software download.  If you feel you need additional material to prepare you can procure these questions from ISACA at a cost of $110.

Unfortunately, no other material is available from independent publishers for this exam. Majority of the applicants study from this manual  and question bank to clear the exam. More on the actual exam in a later post.