Certified Information Security Manager (CISM) Preparation

Program facts

Study fee

Free

subjects

8

lessons

24

Estimated time

31.5 hours

Content last reviewed

22 October 2026

Access period

30 days

Study language

Arabic and English

About the program

Eight modules and 24 lessons move from governance and strategy through risk, the security program, and incident management. Each lesson explains why a choice works, how to carry it out, and its limits in a professional case, followed by practice and review criteria. Modules map to the current ISACA domains and weights: governance 17%, risk 20%, program 33%, and incidents 30%. Bilingual learning checks, internal assessments, and an original readiness mock are separate from the issuer's official questions and results. ISACA announces a revised outline effective 3 November 2026; the current outline must be checked again for study or delivery after that date.

Practical relevance

Exercises produce decision, risk, control and incident records with review criteria and source boundaries. Cases are fictional and country-neutral; actual obligations need organization-specific specialist review.

Why this program

CISM emphasizes management judgment: who owns the consequence of risk, when a decision changes, and how to know whether a control or incident plan works. Cases start from business objectives and incomplete information, compare plausible professional alternatives, and test assumptions that could reverse a recommendation.

Career relevance

For security practitioners organizing experience in governance, risk, program and incident management before an external exam. It does not promise a job, promotion, or credential eligibility.

What you will learn

• Connect enterprise objectives to authorized security decisions
• Assess scenarios, control evidence and residual risk
• Build an asset, policy and metric based security program
• Coordinate incident response, continuity and recovery
• Interpret mock results as internal practice

Who it is for

• For information security professionals preparing for the external CISM exam, and security managers, program leaders, and risk owners reviewing governance, investment, and incident decisions. Cases span digital services, education, healthcare, and commerce without assuming one sector.
• It suits learners with initial practice who want to explain business impact, decision authority, and effectiveness evidence. It does not issue CISM, administer the official exam, or interpret a particular contract or jurisdiction’s law.

Curriculum

1. Subject 1 Open for free

   Enterprise governance and decision rights

   Connect business goals to security decisions and establish ownership, authority, and constraints before selecting controls.

   3 lessons · 3.5 hours

   1. Translate business objectives into security decisions 1 hours
   2. Assign governance roles and accountabilities 1 hours
   3. Interpret legal, contractual, and cultural constraints 1 hours
2. Subject 2

   Security strategy and investment

   Build a strategy linked to business outcomes, then translate frameworks into policy, business cases, and measures.

   3 lessons · 3.5 hours

   1. Build a security strategy from enterprise objectives 1 hours
   2. Select a governance framework and policy hierarchy 1 hours
   3. Construct a business case and leadership report 1 hours
3. Subject 3

   Risk identification and assessment

   Define scenarios and analyze exposure, weaknesses, evidence, and uncertainty rather than relying on a bare score.

   3 lessons · 3.5 hours

   1. Define risk scenarios and assessment scope 1 hours
   2. Analyze threats, vulnerabilities, and control gaps 1 hours
   3. Estimate and compare risk under uncertainty 1 hours
4. Subject 4

   Risk response and monitoring

   Compare treatments against appetite and tolerance, separate risk and control ownership, and monitor exceptions.

   3 lessons · 3.5 hours

   1. Choose treatment against appetite and tolerance 1 hours
   2. Separate risk and control ownership 1 hours
   3. Monitor risk and communicate exceptions 1 hours
5. Subject 5

   Security program architecture

   Identify and classify assets and dependencies, then link policy, standards, procedures, and useful metrics.

   3 lessons · 3.5 hours

   1. Plan resources and an asset classification process 1 hours
   2. Translate frameworks into policy and standards 1 hours
   3. Design meaningful program metrics 1 hours
6. Subject 6

   Program delivery and effectiveness

   Design and test controls and manage workforce behavior and suppliers using service-specific evidence.

   3 lessons · 3.5 hours

   1. Select and integrate controls 1 hours
   2. Evaluate control effectiveness and improve 1 hours
   3. Manage awareness and external services 1 hours
7. Subject 7

   Incident readiness

   Align response, continuity, and recovery; prioritize from impact analysis and exercise classification and escalation.

   3 lessons · 3.5 hours

   1. Align response, continuity, and recovery plans 1 hours
   2. Use business impact analysis to set priorities 1 hours
   3. Classify incidents and test readiness 1 hours
8. Subject 8

   Incident operations and learning

   Investigate, contain, communicate, and recover with reliable evidence, then convert reviews into tested improvements.

   3 lessons · 3.5 hours

   1. Investigate and contain with evidence discipline 1 hours
   2. Coordinate notification, eradication, and recovery 1 hours
   3. Run a post-incident review and revise risk 1 hours

Subjects unlock in sequence as you progress.

Strengths

• Explicit mapping to four domains and supporting tasks
• Original professional cases with alternative rationales
• Clear separation from issuer exams and credentials
• Equivalent Arabic and English instruction

Evidence basis

The current ISACA outline and relevant NIST publications support scope and methods. Examples and questions are original; sources, assumptions and the upcoming outline change are dated and bounded.

How the route works

Professional Certification Preparation programs help learners prepare for a recognized external certification through structured knowledge, review, practice questions, and readiness assessments. Arab Platform for Professional Studies (ARPS) does not administer the certification owner's official exam.

Structured self-paced study aligned to the current external certification scope, with knowledge review, practice questions, readiness checks, and internal mock assessments.

• Focused preparation for a specific external certification.
• Content aligned to the current official exam scope when available.
• Practice questions and internal readiness assessments.
• Clear separation between Arab Platform for Professional Studies (ARPS) preparation and the official external exam.

Assessment

The route includes an internal assessment for Arab Platform for Professional Studies (ARPS) completion eligibility and separate mock/readiness assessments that are not the external official exam.

Assessment attempts: 2 per assessment, 7 days apart

The pass mark is announced before the program is published.

Certificate

The Arab Platform for Professional Studies (ARPS) credential confirms completion of the preparation program only; the target professional certification requires passing the external issuer's examination under its rules.

Every certificate has a public verification code. Verify a certificate

Verification example: a real issued certificate

Disclaimer: Any internal completion document applies only to this preparation program; it is not CISM or ISACA endorsement.

Program questions