CISM coverage and editorial review
Reviewed 2026-10-17 by Codex (AI).
AI editorial pass for introductory study. Reviewed all 13 lessons, 13 exercises, 80 questions, and 40 flashcards. The reviewer also helped author the material. An independent expert assessment has not been performed.
22 October applied-depth additions and edition map. The ledger above identifies the original introductory material. A separate AI editorial ledger covers 13 applied lesson extensions and 26 new questions; it does not replace or relabel the earlier review.
What the review checked
Conceptual consistency, decision authority, scenario assumptions, exercise arithmetic, answer keys, explanations, and lesson references. The revised bank uses more plausible wrong answers and a new version label; earlier score summaries remain readable.
The source boundary
The target is the exam effective 3 November 2026. ISACA confirms revised weights of 18%, 20%, 33%, and 29%, plus architecture additions and greater strategy/program emphasis. The public detailed outline checked on 2026-10-17 still displays the earlier version. Exact revised topic and task alignment remains unverified.
ISACA revised-exam announcement · ISACA public detailed outline
Confirmed revised emphasis
- Strategy: Connect security decisions to business goals
Build a strategy and a reviewable roadmap - Program development: Organize resources and information responsibilities
Coordinate program delivery across business functions - Enterprise architecture: Evaluate investment and architecture choices
Review enterprise and security architecture together - Information security architecture: Design controls across services and suppliers
Evaluate architecture boundaries
Published baseline inventory
The entries below locate introductory evidence for 35 earlier topic references and 37 supporting tasks. They use the earlier published identifiers and order. A link does not establish comprehensive coverage, sufficient depth, or representative exam difficulty.
Show earlier topic evidence
| Reference | Lesson and section | Practice items |
|---|---|---|
| 1A1 | Turn policy into workable behavior Look beyond awareness completion | governance-11, governance-15 |
| 1A2 | Turn policy into workable behavior Keep the requirement record current | governance-14 |
| 1A3 | Set accountability and decision authority Give each decision an owner | governance-06, governance-07 |
| 1B1 | Connect security decisions to business goals Build a strategy and a reviewable roadmap | governance-01, governance-03 |
| 1B2 | Organize resources and information responsibilities Use a framework without treating it as a certificate | program-06 |
| 1B3 | Evaluate investment and architecture choices Compare outcomes and total cost | governance-16, governance-17 |
| 2A1 | Describe a risk before assigning a score Separate threats, weaknesses, and current exposure | risk-03 |
| 2A2 | Describe a risk before assigning a score Check the safeguards | risk-04 |
| 2A3 | Describe a risk before assigning a score Assess likelihood and consequence | risk-05, risk-06 |
| 2B1 | Choose a response and assign ownership Compare realistic options | risk-08, risk-10 |
| 2B2 | Choose a response and assign ownership Make acceptance an explicit decision | risk-09, risk-12 |
| 2B3 | Monitor changing risk and request decisions Choose signals with a purpose | risk-15, risk-18 |
| 3A1 | Organize resources and information responsibilities Turn direction into a delivery plan | program-02, program-03 |
| 3A2 | Organize resources and information responsibilities Know the information lifecycle | program-01, program-04 |
| 3A3 | Organize resources and information responsibilities Use a framework without treating it as a certificate | program-06 |
| 3A4 | Turn policy into workable behavior Make expectations usable | governance-12, governance-13 |
| 3A5 | Connect security decisions to business goals Build a chain of reasoning | governance-02, governance-04 |
| 3B1 | Design controls across services and suppliers Design for a requirement | program-10, program-12 |
| 3B2 | Design controls across services and suppliers Build security into change and supplier acceptance | program-11 |
| 3B3 | Test effectiveness and improve the program Ask two different questions | program-15, program-20 |
| 3B4 | Test effectiveness and improve the program Manage learning as an ongoing program | program-17 |
| 3B5 | Design controls across services and suppliers Manage the supplier lifecycle | program-08, program-14 |
| 3B6 | Test effectiveness and improve the program Close the improvement loop | governance-02, risk-20 |
| 4A1 | Prepare response and recovery arrangements Make the response plan usable | incident-05, incident-06 |
| 4A2 | Prepare response and recovery arrangements Prepare for business consequences | incident-02 |
| 4A3 | Prepare response and recovery arrangements Build a recovery priority worksheet | incident-07 |
| 4A4 | Prepare response and recovery arrangements Define and test recovery expectations | incident-01, incident-03, incident-04 |
| 4A5 | Prepare response and recovery arrangements Equip teams and define a usable escalation model | incident-08 |
| 4A6 | Learn from incidents and exercises Choose an exercise that can support the claimed result | incident-17, incident-20 |
| 4B1 | Coordinate investigation, containment, and recovery Move from an event to a coordinated response | incident-11 |
| 4B2 | Coordinate investigation, containment, and recovery Establish a shared picture | incident-12 |
| 4B3 | Coordinate investigation, containment, and recovery Balance urgent action and evidence | incident-10 |
| 4B4 | Coordinate investigation, containment, and recovery Plan eradication, recovery, and communications | incident-14 |
| 4B5 | Coordinate investigation, containment, and recovery Recover with decision criteria | incident-13 |
| 4B6 | Learn from incidents and exercises Turn findings into owned changes | incident-16, incident-18, incident-19 |
Show earlier supporting-task evidence
What remains unverified
- Exact revised-exam topic/task coverage is unverified because the public detailed outline still displays the earlier version.
- Practice difficulty, discrimination, and exam equivalence have not been measured with learners.
- Mapping to a section or question records introductory evidence, not comprehensive or exam-ready coverage.
Found a gap or an unclear explanation? Report a correction.