CISM Complete Review Guide 2026–2027
Every exam topic in a 22-page Arabic PDF, ordered from the heaviest unit to the lightest. The first three chapters alone cover about 82% of the exam questions.
- 22Pages
- 60Key points
- 24Common mistakes
- 32Flashcards
Guide map
Each chapter is one exam unit, ordered by its weight in the real exam.
| Chapter | Unit | Weight | Exam questions | Key points |
|---|---|---|---|---|
| 1 | Information Security Program | 33% | 50 | 15 |
| 2 | Incident Management | 29% | 43 | 15 |
| 3 | Information Security Risk Management | 20% | 30 | 15 |
| 4 | Information Security Governance | 18% | 27 | 15 |
Chapter 1 in full: Information Security Program
33% of the exam, about 50 questions. These are its key points, as in the guide.
- A program charter defines scope, authority, objectives, resources and accountability, and must be approved by senior management.
- Asset classification by the data owner drives the protection level; inventory comes before classification.
- Security architecture applies defense in depth, least privilege, segregation of duties, need to know and secure defaults.
The rest of chapter 1, on this page
- Least privilege grants only the access needed for the role; access should be reviewed periodically and removed on role change or departure.
- Choose controls by risk, cost and fit: preventive, detective, corrective, deterrent and compensating.
- A compensating control provides equivalent protection when the primary control is not feasible.
- Resources: define roles, skills and budget; outsource only what you can monitor by contract.
- Control testing methods include vulnerability scanning, penetration testing, audits and reviews; results go to management with remediation tracking.
- Change management ensures security review of changes; emergency changes still need retrospective approval.
- Security awareness is most effective when targeted by role, repeated and measured (for example phishing simulation results).
- Secure development: security requirements and testing early in the lifecycle cost less than fixes after release.
- Third-party contracts include security requirements, breach notification, right to audit and termination terms; due diligence precedes signing.
- Metrics for the program: coverage, control effectiveness, incidents, time to patch; use trends to show improvement to management.
- A maturity model (such as CMMI) shows how repeatable and optimized security processes are and guides the roadmap.
- Report to management in business language: risk posture, key incidents, compliance and progress against the roadmap.
Common mistakes in this chapter
- Inventory assets before classifying them.
- Awareness alone is not a control for determined attackers; it supports layers.
- Outsourcing the function does not transfer accountability.
- Emergency changes are not exempt from approval.
- A compensating control must be equivalent, not just any partial measure.
- Technical testing results mean little to management until tied to business risk.
The other chapters are in the full guide
One purchase · lifetime access · review guide included
7-day review plan
The chapters are spread over 6 days by weight so each day carries a similar load. Day 7 is a full exam.
Day 1 · 33% of the exam
Chapter 1: Information Security Program
Day 2 · 29% of the exam
Chapter 2: Incident Management
Day 3 · 20% of the exam
Chapter 3: Information Security Risk Management
Day 4 · 18% of the exam
Chapter 4: Information Security Governance
Day 5
Full mock exam: 150 questions in 240 minutes, then review the common mistakes in the units where you lost marks.
Before you read: see your score today
10 free questions from the main units, no sign-up. Then you know which chapter to start with.
Try 10 free questions and see your levelA look at each chapter
The first three key points of each chapter, as they appear in the guide (in Arabic in the PDF).
Chapter 1: Information Security Program
- A program charter defines scope, authority, objectives, resources and accountability, and must be approved…
- Asset classification by the data owner drives the protection level; inventory comes before classification.
- Security architecture applies defense in depth, least privilege, segregation of duties, need to know…
Chapter 2: Incident Management
- Incident phases
- An incident response plan defines roles, escalation, communication, severity classification and playbooks; it needs…
- Classify incidents by impact to business so response and escalation match severity.
Chapter 3: Information Security Risk Management
- Risk is the combination of the probability of an event and its impact on…
- Assess risk in business terms
- A threat is a potential cause of harm, a vulnerability is a weakness, and…
Chapter 4: Information Security Governance
- Information security governance is the set of responsibilities and practices the board and executives…
- The first priority is aligning security with business objectives; a technical control chosen without…
- Senior-management commitment is the most critical factor for a successful security program.
The full guide comes with lifetime access
The full guide (22 pages) is included with lifetime access to this exam, together with every question and full mock exam. Chapter 1 is free for everyone.
Questions about the guide
Is the guide free?
Chapter 1 is free to read on the guide page. The full guide comes with lifetime access to this exam; 7-day access does not include it.
Is it up to date for 2026–2027?
Yes. Unit weights and exam facts follow what the exam body last published, and the last check date is printed in the guide. If the standards change we update the file and buyers download the new version.
Does the guide have questions?
No. The guide covers key points and common mistakes; scoring, weak-area practice and full mock exams are on the site.
Can I read it on my phone?
Yes. A5 pages in a single column, with chapters linked from the contents.
- Pages
- 22
- Edition
- 1448 AH · 2026–2027
- Language
- Arabic
- Last updated
All Engineering Exams review guides
Back to CISM – Certified Information Security Manager (ISACA)
Buy this exam
Pick the access that lasts until your test date.
Included
- Full mock exams: 150 questions in 240 minutes, with a score for every unit
- 752 questions, every option explained with its source
- Practice that starts with your weakest units, plus a review of your mistakes
- Complete Review Guide 2026–2027 (PDF), with lifetime access only
Continue with your Google account and you go straight to the payment page.
You pay on the Waffo Pancake checkout page (in English). The amount is in US dollars and your bank converts it to riyals. One payment with no automatic renewal, by Visa, Mastercard (a mada card with either logo works too), Apple Pay or Google Pay. Your statement shows "WAFFO". Purchases are not refundable.