ISACA updates CISM exam for November and adds an AI risk credential

ISACA said Sept. 10 that it has updated the content outline for its Certified Information Security Manager (CISM) exam, with the new version available to candidates from Nov. 3, 2026. The change comes months after the association launched Advanced in AI Risk (AAIR), a credential for risk professionals who deal with AI.

CISM is one of the most widely held management-level security certifications, earned by more than 111,000 people since 2002, according to ISACA. Candidates booked for November or later need to switch study material, and managers who already hold CISM or a similar credential now have three ISACA add-ons focused on AI.

What changes in CISM

According to ISACA's announcement, the four CISM domains stay the same, but the exam gives more emphasis to information security strategy and program development. Two content areas are new: enterprise architecture and information security architecture.

The new weights are:

• Information security governance: 18 per cent
• Information security risk management: 20 per cent
• Information security program: 33 per cent
• Incident management: 29 per cent

ISACA released updated preparation materials on Sept. 1, including its review manual, question database and online review course. It recommends that anyone testing on or after Nov. 3 use the updated materials. The announcement did not describe AI-specific changes to CISM itself.

The AI credential track

On April 15, ISACA launched AAIR, which tests the ability to assess AI-related vulnerabilities and manage AI risk across its life cycle. The exam covers three areas: AI risk governance and framework integration, AI life-cycle risk management, and AI risk program management.

AAIR is not an entry-level credential. Candidates need experience in IT risk or advisory roles and one of 25 prerequisite certifications, including CISA, CISM, CRISC, CGEIT and ISC2's CISSP. ISACA CEO Erik Prusch said AI is moving faster than many organizations are prepared for, and that IT risk professionals are "on the front lines."

AAIR joins two AI credentials ISACA introduced in 2025: Advanced in AI Audit, for auditors, and Advanced in AI Security Management, which requires CISM or CISSP. Training provider Training Camp describes the security management credential as aimed at managers responsible for governing and protecting AI systems.

Why it matters

ISACA's approach differs from CompTIA's new SecAI+, which is aimed at hands-on practitioners and has no formal prerequisites. ISACA's AI credentials are add-ons for people who already hold a senior certification, which makes them more relevant to managers, auditors and risk leads than to job seekers trying to break in.

What to do

• CISM candidates testing on or after Nov. 3 should use the updated review materials.
• Current CISM holders do not need to retest; the change affects new candidates only.
• Risk professionals considering AAIR should confirm which of the 25 prerequisite certifications they hold before buying study materials.