StationX
Start free

← Free roadmaps

Free CISM — Certified Information Security Manager Roadmap

The management-track certification: governance, risk management, the security programme and incident management. Pairs with CISSP for anyone moving into leadership. ISACA's new CISM outline applies from 3 November 2026; the weights shown are the new ones. Our practice tests follow the 2022 outline. The new outline adds enterprise and information security architecture, which no CISM course here covers yet; Step 5 links the CISSP Domain 3 & 4 boot camp, which teaches it.

5 steps · 39 free videos · 5 free reads

Start step 1 →

Create your free account to open all 2,396 free items

The 44 free items on this page — and every other free lesson, video and guide — open once you have a free StationX account. No card, no trial.

Create free account →Already have an account? Sign in

Before you start

Read these first

The free roadmap

5 steps, in order

The 🔒 rows show what the full roadmap adds at each step. StationX Membership opens every course and its labs: $299 / year ($24.92/mo billed annually).

  1. Start here →

    Step 1 — Domain 1 — information security governance

    Align security with business strategy.

    🔒 The full roadmap adds here: 1 full course (Membership)
    • Course · CISM Certification: CISM Domain 1 Video Boot Camp · 🔒 Membership
    See this step on the full roadmap →

    Try a free hacking lab: Recon to shell (~5 min) → A scripted simulation in your browser. No account needed.

  2. Step 2 — Domain 2 — information security risk management

    Identify, assess and treat risk.

    🔒 The full roadmap adds here: 1 full course (Membership)
    • Course · CISM Certification: CISM Domain 2 Video Boot Camp · 🔒 Membership
    See this step on the full roadmap →

  3. Step 3 — Domain 3 — information security program

    Build and run the programme.

    🔒 The full roadmap adds here: 1 full course (Membership)
    • Course · CISM Certification: CISM Domain 3 Video Boot Camp · 🔒 Membership
    See this step on the full roadmap →

  4. Step 4 — Domain 4 — incident management

    Prepare for, manage and learn from incidents, with business continuity and disaster recovery. The labs are the manager's ones: Analyze and Update a Company BCP/BIA/DRP/CIRP, Recover from Incident, and Report Writing for Presentation to Management.

    🔒 The full roadmap adds here: 1 full course · hands-on labs 1–3 of 3 (Membership)
    • Course · CISM Certification: CISM Domain 4 Video Boot Camp · 🔒 Membership
    • Lab 1 of 3 · Analyze and Update a Company BCP/BIA/DRP/CIRP · 🔒 Membership
    • Lab 2 of 3 · Recover from Incident · 🔒 Membership
    • Lab 3 of 3 · Report Writing for Presentation to Management · 🔒 Membership
    See this step on the full roadmap →

  5. Step 5 — Enterprise and information security architecture

    New in ISACA's 2026 outline: how security architecture supports the programme. No CISM course here covers it yet.

Exam and next steps

Before the exam

Do it hands-on

The full CISM — Certified Information Security Manager roadmap

The same steps with every course and the hands-on labs, and your progress tracked.

The full roadmap with labs →What Membership includes · Full refund within 30 days if you haven't started a lab · cancel anytime
Advanced

AI-Driven Security Engineering

Become the Cyber Security Expert the AI Era Needs.

StationX’s AI Master’s teaches you to create and deploy security solutions by directing AI. “No coding background required. You direct the AI; the AI does the building.”

Explore the AI Master’s →
2,396 free items open with a free accountCreate free accountSign in