Study Guide
ISACA CISM Study Guide
Use the companion study guide to organize the material, compare important concepts, annotate key ideas, and build a written reference for review.
ISACA · Free, ad-free audio course
ISACA CISM
A structured, audio-first learning route for ISACA CISM, designed for focused review and practical understanding.
Companion Books
Study with the audio course, then reinforce it in print.
The study guide helps you organize and revisit the material. The flashcards book adds active recall and rapid review across the course objectives.
Flashcards Book
ISACA CISM Flashcards
Use the flashcards book for active recall, terminology checks, rapid review, and repeated practice across the course objectives.
PUT IT INTO PRACTICE
Practice CISM concepts
Try 50 original BMC questions, review every explanation, and return to the lessons behind the answer. No login is required. Earn Challenge achievements and share your progress as you go.
50 original questionsExplanation after every answerAchievements and sharing
Independent BMC learning practice—not official exam items, a full mock exam, or an exam-readiness score.
Complete Lesson Directory
Choose the exact subject you want to study.
Search by topic or narrow the directory by exam domain. Courses with multiple editions are organized below so every season remains easy to find. Each lesson includes its own audio player, full description, transcript when available, and previous-or-next navigation.
71 lessons available
S01E01Transcript
Getting Started
Welcome to the CISM Certification – Overview and Benefits
Listen to Welcome to the CISM Certification – Overview and Benefits in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E02Transcript
Getting Started
Understanding the Exam – Domains, Structure, and Study Strategies
Listen to Understanding the Exam – Domains, Structure, and Study Strategies in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E03Transcript
Getting Started
CISM vs. CISSP vs. CRISC – Choosing Your Certification Path
Listen to CISM vs. CISSP vs. CRISC – Choosing Your Certification Path in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E04Transcript
Getting Started
Essential Skills and Experience for CISM Candidates
Listen to Essential Skills and Experience for CISM Candidates in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E05Transcript
Getting Started
Building a Personalized CISM Study Plan
Listen to Building a Personalized CISM Study Plan in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E06Transcript
Getting Started
Test-Taking Strategies and Exam-Day Tips for Success
Listen to Test-Taking Strategies and Exam-Day Tips for Success in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E07Transcript
Domain 1 · Information Security Governance
Organizational Culture and Its Impact on Security
Listen to Organizational Culture and Its Impact on Security in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E08Transcript
Domain 1 · Information Security Governance
Legal and Regulatory Compliance Essentials
Listen to Legal and Regulatory Compliance Essentials in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E09Transcript
Domain 1 · Information Security Governance
Contractual Requirements and Security Agreements
Listen to Contractual Requirements and Security Agreements in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E10Transcript
Domain 1 · Information Security Governance
Organizational Structures, Roles, and Responsibilities in Security Governance
Listen to Organizational Structures, Roles, and Responsibilities in Security Governance in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E11Transcript
Domain 1 · Information Security Governance
Developing an Effective Information Security Strategy
Listen to Developing an Effective Information Security Strategy in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E12Transcript
Domain 1 · Information Security Governance
Overview of Major Governance Frameworks (COBIT, ISO, NIST)
Listen to Overview of Major Governance Frameworks (COBIT, ISO, NIST) in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E13Transcript
Domain 1 · Information Security Governance
Deep Dive into COBIT Framework
Listen to Deep Dive into COBIT Framework in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E14Transcript
Domain 1 · Information Security Governance
Deep Dive into ISO 27001 and ISO 27002
Listen to Deep Dive into ISO 27001 and ISO 27002 in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E15Transcript
Domain 1 · Information Security Governance
Deep Dive into NIST Cybersecurity Framework (CSF)
Listen to Deep Dive into NIST Cybersecurity Framework (CSF) in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E16Transcript
Domain 1 · Information Security Governance
Strategic Planning Essentials – Budgets, Resources, and the Business Case
Listen to Strategic Planning Essentials – Budgets, Resources, and the Business Case in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E17Transcript
Domain 2 · Information Security Risk Management
Current Cyber Threat Landscape
Listen to Current Cyber Threat Landscape in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E18Transcript
Domain 2 · Information Security Risk Management
Identifying and Managing Emerging Risks (AI, Quantum, IoT)
Listen to Identifying and Managing Emerging Risks (AI, Quantum, IoT) in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E19Transcript
Domain 2 · Information Security Risk Management
Conducting Vulnerability and Control Deficiency Analysis
Listen to Conducting Vulnerability and Control Deficiency Analysis in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E20Transcript
Domain 2 · Information Security Risk Management
Quantitative vs. Qualitative Risk Assessment
Listen to Quantitative vs. Qualitative Risk Assessment in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E21Transcript
Domain 2 · Information Security Risk Management
Conducting Effective Risk Analysis Workshops
Listen to Conducting Effective Risk Analysis Workshops in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E22Transcript
Domain 2 · Information Security Risk Management
Risk Mitigation and Acceptance Strategies
Listen to Risk Mitigation and Acceptance Strategies in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E23Transcript
Domain 2 · Information Security Risk Management
Risk Transfer and Avoidance Strategies
Listen to Risk Transfer and Avoidance Strategies in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E24Transcript
Domain 2 · Information Security Risk Management
Establishing Risk and Control Ownership
Listen to Establishing Risk and Control Ownership in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E25Transcript
Domain 2 · Information Security Risk Management
Best Practices in Risk Monitoring and Reporting
Listen to Best Practices in Risk Monitoring and Reporting in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E26Transcript
Domain 3 · Information Security Program
Staffing and Managing Security Teams
Listen to Staffing and Managing Security Teams in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E27Transcript
Domain 3 · Information Security Program
Selecting and Implementing Security Tools and Technologies
Listen to Selecting and Implementing Security Tools and Technologies in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E28Transcript
Domain 3 · Information Security Program
Information Asset Identification and Classification Fundamentals
Listen to Information Asset Identification and Classification Fundamentals in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E29Transcript
Domain 3 · Information Security Program
Applying Industry Standards and Frameworks to Your Security Program
Listen to Applying Industry Standards and Frameworks to Your Security Program in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E30Transcript
Domain 3 · Information Security Program
Developing Effective Security Policies
Listen to Developing Effective Security Policies in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E31Transcript
Domain 3 · Information Security Program
Writing Actionable Procedures and Guidelines
Listen to Writing Actionable Procedures and Guidelines in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E32Transcript
Domain 3 · Information Security Program
Developing and Using Information Security Program Metrics
Listen to Developing and Using Information Security Program Metrics in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E33Transcript
Domain 3 · Information Security Program
Designing and Selecting Effective Information Security Controls
Listen to Designing and Selecting Effective Information Security Controls in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E34Transcript
Domain 3 · Information Security Program
Implementing and Integrating Information Security Controls
Listen to Implementing and Integrating Information Security Controls in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E35Transcript
Domain 3 · Information Security Program
Techniques for Information Security Control Testing and Evaluation
Listen to Techniques for Information Security Control Testing and Evaluation in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E36Transcript
Domain 3 · Information Security Program
Developing Engaging Information Security Awareness and Training Programs
Listen to Developing Engaging Information Security Awareness and Training Programs in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E37Transcript
Domain 3 · Information Security Program
Vendor Risk Assessment and Selection
Listen to Vendor Risk Assessment and Selection in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E38Transcript
Domain 3 · Information Security Program
Contractual Security Requirements and Ongoing Vendor Monitoring
Listen to Contractual Security Requirements and Ongoing Vendor Monitoring in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E39Transcript
Domain 3 · Information Security Program
Communications and Reporting for the Information Security Program
Listen to Communications and Reporting for the Information Security Program in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E40Transcript
Domain 4 · Incident Management
Designing and Documenting the Incident Response Plan
Listen to Designing and Documenting the Incident Response Plan in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E41Transcript
Domain 4 · Incident Management
Maintaining and Updating Your Incident Response Plan
Listen to Maintaining and Updating Your Incident Response Plan in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E42Transcript
Domain 4 · Incident Management
Conducting Business Impact Analysis (BIA
Listen to Conducting Business Impact Analysis (BIA in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E43Transcript
Domain 4 · Incident Management
Building Your Business Continuity Plan (BCP)
Listen to Building Your Business Continuity Plan (BCP) in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E44Transcript
Domain 4 · Incident Management
Designing Your Disaster Recovery Plan (DRP)
Listen to Designing Your Disaster Recovery Plan (DRP) in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E45Transcript
Domain 4 · Incident Management
Testing, Maintenance, and Improvement of Your DRP
Listen to Testing, Maintenance, and Improvement of Your DRP in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E46Transcript
Domain 4 · Incident Management
Incident Classification and Categorization Methods
Listen to Incident Classification and Categorization Methods in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E47Transcript
Domain 4 · Incident Management
Training, Testing, and Evaluating Your Incident Management Capabilities
Listen to Training, Testing, and Evaluating Your Incident Management Capabilities in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E48
Domain 4 · Incident Management
Incident Management Tools and Techniques
Listen to Incident Management Tools and Techniques in the ISACA CISM audio course.
July 6, 2025
S01E49Transcript
Domain 4 · Incident Management
Incident Investigation Methodologies
Listen to Incident Investigation Methodologies in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E50Transcript
Domain 4 · Incident Management
Digital Forensics and Evidence Collection Basics
Listen to Digital Forensics and Evidence Collection Basics in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E51Transcript
Domain 4 · Incident Management
Effective Incident Containment Methods
Listen to Effective Incident Containment Methods in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E52Transcript
Domain 4 · Incident Management
Incident Response Communications: Reporting, Notification, and Escalation
Listen to Incident Response Communications: Reporting, Notification, and Escalation in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E53Transcript
Domain 4 · Incident Management
Techniques for Incident Eradication
Listen to Techniques for Incident Eradication in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E54Transcript
Domain 4 · Incident Management
Techniques for Secure Recovery and Restoration
Listen to Techniques for Secure Recovery and Restoration in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E55Transcript
Domain 4 · Incident Management
Conducting Meaningful Post-Incident Reviews
Listen to Conducting Meaningful Post-Incident Reviews in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E56Transcript
Domain 1 · Information Security Governance
Identifying Internal and External Influences on Security Strategy
Listen to Identifying Internal and External Influences on Security Strategy in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E57Transcript
Domain 1 · Information Security Governance
Establishing Information Security Strategy Aligned with Organizational Goals
Listen to Establishing Information Security Strategy Aligned with Organizational Goals in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E58Transcript
Domain 1 · Information Security Governance
Implementing Information Security Governance Frameworks
Listen to Implementing Information Security Governance Frameworks in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E59Transcript
Domain 1 · Information Security Governance
Integrating Information Security into Corporate Governance
Listen to Integrating Information Security into Corporate Governance in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E60Transcript
Domain 1 · Information Security Governance
Building Effective Security Budgets and ROI Analysis
Listen to Building Effective Security Budgets and ROI Analysis in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E61Transcript
Domain 1 · Information Security Governance
Communicating the Business Case and Gaining Stakeholder Buy-In
Listen to Communicating the Business Case and Gaining Stakeholder Buy-In in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E62Transcript
Domain 1 · Information Security Governance
Gaining Senior Leadership Commitment and Stakeholder Support
Listen to Gaining Senior Leadership Commitment and Stakeholder Support in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E63Transcript
Domain 1 · Information Security Governance
Defining and Communicating Security Roles and Responsibilities
Listen to Defining and Communicating Security Roles and Responsibilities in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E64Transcript
Domain 1 · Information Security Governance
Compiling and Presenting Effective Security Reports
Listen to Compiling and Presenting Effective Security Reports in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E65
Domain 1 · Information Security Governance
Evaluating and Reporting Information Security Metrics
Listen to Evaluating and Reporting Information Security Metrics in the ISACA CISM audio course.
July 6, 2025
S01E66Transcript
Domain 3 · Information Security Program
Aligning Security Programs with Operational Business Objectives
Listen to Aligning Security Programs with Operational Business Objectives in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E67Transcript
Domain 3 · Information Security Program
Integrating Security Requirements into Organizational Processes
Listen to Integrating Security Requirements into Organizational Processes in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E68Transcript
Domain 3 · Information Security Program
Managing and Monitoring Security Compliance with External Parties
Listen to Managing and Monitoring Security Compliance with External Parties in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E69Transcript
Domain 2 · Information Security Risk Management
Supervising Risk Identification and Assessment
Listen to Supervising Risk Identification and Assessment in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E70Transcript
Domain 2 · Information Security Risk Management
Supervising Risk Treatment and Continuous Monitoring
Listen to Supervising Risk Treatment and Continuous Monitoring in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
S01E71Transcript
Domain 4 · Incident Management
Continuous Improvement through Post-Incident Reviews and Risk Reassessment
Listen to Continuous Improvement through Post-Incident Reviews and Risk Reassessment in the ISACA CISM audio course.
Transcript availableJuly 6, 2025
No matching lessons
Try another term or clear one of the filters.
A Practical Study Routine
Listen, read, and review in the order that works for you.
Listen
Use the free audio course during a commute, walk, workout, or focused study session.
Read
Use the study guide to organize the material, annotate key ideas, and build a reference you can return to.
Review
Use the flashcards book to practice active recall and quickly revisit weak areas.
Related Magazine Features
Connect the course to current cybersecurity analysis.
Related Cyber Wiki
Continue with the concepts behind the course.
AI assurance
AI Control Operating Effectiveness
AI control operating effectiveness evaluates whether an appropriately designed control performed consistently, by the right people or automation, throughout the period under review.
AI risk managementAI Risk Reassessment Triggers
AI risk reassessment triggers are defined events that require risk assumptions, ratings, controls, and approvals to be reviewed before normal cadence.
AI risk managementAI Risk Scenario Analysis
AI risk scenario analysis describes a plausible chain from threat, vulnerability, error, misuse, or change through affected assets, stakeholders, and consequences.
AI risk managementAI Risk Treatment Tracking
AI risk treatment tracking follows mitigation, transfer, avoidance, acceptance, or pursuit decisions from approval through implementation and validation.
AI security managementAI Security Metrics Governance
AI security metrics governance defines which measures support decisions, how they are calculated, who owns them, and how limitations and thresholds are communicated.
AI architectureAI Shared-Responsibility Mapping
AI shared-responsibility mapping assigns control duties across model providers, cloud platforms, application teams, data owners, users, and oversight functions.