ISACA's Certified Information Security Manager (CISM) certification is designed to validate an individual's expertise in managing, designing, and assessing enterprise information security programs. The CISM certification covers four domains:

1. Information Security Governance: This domain covers the development and management of an information security strategy, as well as the alignment of security goals with business objectives.

2. Risk Management: This domain covers the identification, assessment, and management of information security risks, including the development of risk management frameworks and processes.

3. Information Security Program Development and Management: This domain covers the design, implementation, and management of information security programs, including the development of policies, procedures, and standards.

4. Information Security Incident Management: This domain covers the identification, response, and resolution of information security incidents, including the development of incident management plans and procedures.

The CISM course is designed to provide a comprehensive understanding of these domains and prepare individuals for the CISM certification exam. The course covers the key concepts, principles, and practices of information security management, as well as the tools and techniques required to develop and implement effective information security programs. It also provides practical guidance on how to align information security with business objectives, manage information security risks, and respond to information security incidents.

The CISM certification exam is a computer-based exam consisting of 150 multiple-choice questions. Out of the 150 questions, 25 questions are pretest questions that do not contribute to the final score. The pretest questions are included in the exam to evaluate their effectiveness for future exams. The exam is administered in a four-hour time frame, and candidates must achieve a score of 450 or higher out of a possible score of 800 to pass the exam. The exam covers the four domains of information security management as outlined in the CISM course description: Information Security Governance, Risk Management, Information Security Program Development and Management, and Information Security Incident Management.

Candidates have four hours to answer 150 multiple-choice questions. The exam is administered in a single session and is taken at an approved testing center. Candidates are not allowed to bring any reference materials, electronic devices, or personal items into the testing room. The exam is designed to test the candidate's knowledge and understanding of the key concepts, principles, and practices of information security management, as well as their ability to apply this knowledge to real-world scenarios. It is recommended that candidates prepare thoroughly for the exam by studying the CISM course materials and practicing with sample exam questions to ensure they can complete the exam within the allotted time frame.