The CISM Exam Changes on November 3, 2026 — Should You Test Before or After?
ISACA has confirmed that the CISM Exam Content Outline is being updated effective November 3, 2026. If you are anywhere in your CISM journey right now — studying, planning, or just considering it — the calendar suddenly matters a lot, because the version of the exam you sit depends entirely on your test date.
The confirmed timeline
Three dates are locked in. September 11, 2026: updated CISM prep materials, including the new Review Manual and QAE question database, go on sale. November 2, 2026: the final day to sit the current version of the exam. November 3, 2026: the new Exam Content Outline takes effect — every exam from this date forward tests the new blueprint.
One detail that catches people out: ISACA has stated that purchasing current prep materials does not grant access to the updated materials later. If you buy the current Review Manual in August and then test in December, you are buying twice.
What is actually changing
This update comes out of ISACA's Job Practice Analysis cycle — a global survey of working CISMs that reshapes the exam to match how the security manager role has evolved. The direction ISACA has signaled is clear: the updated exam places greater emphasis on information security strategy and program development, and introduces two new content areas: enterprise architecture and information security architecture.
That is a meaningful shift. The current exam (in place since June 2022) is weighted heavily toward program management and incident management. The new outline pushes CISM toward business-aligned, architecture-aware security leadership — understanding how identity models, segmentation, and control layers integrate across hybrid and cloud environments, and how architecture choices affect governance and risk. It reflects the reality that security managers in 2026 are expected to understand the technologies in their purview, not just manage the people who do.
The exam format itself is not expected to change structurally: still 150 questions, four hours, scaled scoring with 450 out of 800 to pass.
Test before or after? A decision framework
Test before November 3 if: you have already started preparing with current materials, or you can realistically be exam-ready by October. You qualify under the established blueprint, your existing study investment stays fully relevant, and there is years of accumulated practice content aligned to the current outline — including our CISM question set, which is built on the outline in force today.
One critical scheduling detail: ISACA requires a 30-day wait before retaking a failed exam. If you sit the current exam in mid-October and fail, your retake lands after November 3 — on the new content outline, with materials you have not studied. If you are going the before route, schedule no later than late September to leave yourself a retake window on the same blueprint. We covered the full retake-policy landscape in Failed Your Certification Exam?
Test after November 3 if: you have not started studying yet and would not be ready before October anyway. In that case, do not buy current materials at all. Wait for the September 11 release of updated prep content and build your plan around the new outline from day one. Architecture-heavy content will feel natural if you come from a technical background, and you will hold a credential aligned to the newest job practice from the start.
The bigger ISACA picture
This is ISACA's second major move this year — the organization also launched AAISM, its AI security leadership certification, which we covered in Who Actually Needs AAISM. If you are weighing CISM against other security management credentials, see our CISSP vs CISM comparison.
Preparing efficiently
Whichever side of the cutover you choose, practice questions are where CISM prep lives or dies — the exam tests ISACA's specific way of thinking about governance and risk, and the fastest way to internalize it is high-volume question drilling with explanations. Our CISM question set covers the current blueprint, alongside CISA and CRISC — or browse all ISACA sets. If your date is before November 3, you are studying the exact blueprint in force today.