CISM Exam Results and Retakes

When CISM results arrive

At the end of the exam, the test center or remote exam flow displays a preliminary pass or fail status. ISACA then sends an official score notification to the email address in your profile, and the result becomes available in MyISACA under Certifications and CPE Management. The 2026 Candidate Guide says official results are generally released within 10 working days. Check the current guide and account notice for the exact process tied to your administration.

Use the official account and email for the final result. ISACA does not provide results by telephone or fax and does not provide question-level results. If your contact email is outdated, correct it before sitting. After the exam, check spam or junk folders and sign in to MyISACA if the message has not arrived.

How to read a CISM score report

The official result uses ISACA's scaled score range from 200 to 800. A score of 450 or more passes. The score is not a raw percentage correct, and it does not disclose the number of questions answered correctly. ISACA includes scored and pretest questions; pretest questions do not count, but candidates are not told which ones they are.

The report also provides domain-level feedback. ISACA says that feedback is for information and that domain percentages are not used to calculate the overall score. If you fail, use the domain information alongside your practice records. It can direct attention, but it will not tell you which exact question was missed or prove that every task within a domain needs equal remediation.

A candidate who passed should check the separate certification requirements. Passing does not grant the credential automatically. ISACA requires five years of professional information security management experience across at least three CISM domains, subject to any accepted waiver, and an application within five years of passing. The application also requires experience verification and a US$50 processing fee.

CISM retake limits and waiting periods

ISACA's 2026 guide allows four attempts within a rolling 12-month period. A failed first attempt can be followed by a second attempt after 30 days. After a second attempt, a candidate must wait 90 days before attempt three. After attempt three, another 90-day wait applies before attempt four. The period is rolling and tied to the first attempt; do not treat it as a new calendar-year allowance.

Each retake requires paying the full registration fee. The member and nonmember prices in the active candidate guide apply to each new registration. There is no reduced retake charge identified in that guide. Use the waiting period to repair specific gaps; registering again immediately when the system permits is not a substitute for changing how you prepare.

Candidates who pass cannot retake the same exam within the five-year application period. A certified CISM holder is restricted from taking the same certification exam while certified. This means the exam is not a continuing practice option after success. Use CPE and professional work to maintain competence instead.

A focused recovery plan after a fail

First, save the official score report and write down what happened during the exam while the experience is fresh. Note whether time pressure, fatigue, interface issues, or repeated uncertainty affected your choices. Then compare domain feedback with your own study log. Look for specific patterns such as choosing a technical fix before identifying the risk owner or confusing governance oversight with program operations.

1. Read the domain feedback and mark the two or three weakest areas for review.
2. Map missed practice items to the official task statements and identify the reasoning error, not only the topic name.
3. Relearn the management principle using the current outline for the next appointment date.
4. Work new scenarios without seeing the answer first; explain why each distractor is less appropriate.
5. Take timed mixed-domain sets and check whether errors have shifted from knowledge gaps to rushed reading.
6. Schedule only after you know the waiting period, current fee, and realistic appointment availability.

A retake study cycle should be long enough to produce new evidence of readiness. For example, a candidate who has 30 days before attempt two can devote the first week to reconstructing the error pattern and repairing one weak domain, the second and third weeks to mixed scenario work and explanation review, and the last week to timed practice and rest. The specific schedule depends on work and prior preparation; it is not a promised pass formula.

Rescoring and exam concerns

A candidate who fails may request a rescore in writing through ISACA support within 30 days after the result release. The 2026 guide lists a US$75 fee. ISACA says PSI performs the rescore. Since no question-level results are provided, a rescore is not a review of particular answers with the candidate; it is a check of the scoring process.

If you experienced an administration problem, the candidate guide has a separate process for reporting concerns. Record the date, time, what happened, and any communications with the proctor. Submit through the prescribed channel within the stated deadline. Keep the report factual and specific; a disagreement with a question's difficulty is not the same as a test delivery problem.

Example retake calendars

Failing attempt one

A candidate sits on October 8 and does not pass. Under the guide's minimum waiting period, the next attempt cannot occur until 30 days after the first test date. The candidate also needs an active registration and a new appointment. If November 7 is within the registration and appointment options, it may be an earliest date by interval, but provider scheduling and account eligibility still control.

Failing attempt two

If the candidate retakes and fails on November 12, attempt three requires a 90-day wait after attempt two. The relevant date is the second appointment, not the date the score email arrived. The candidate should avoid assuming a calendar-quarter boundary changes the waiting rule.

These are interval illustrations, not reserved appointment dates. Confirm the exact earliest date in your ISACA account and provider scheduler. You must pay for each attempt, and the six-month exam eligibility period and any extension have their own rules. A new retake registration may be necessary.

Common mistakes after an exam

• Treating a preliminary result as the full score report; wait for the official account result and review its instructions.
• Assuming 450 is 450 raw points or a particular percent correct; the score is scaled.
• Scheduling before the applicable 30- or 90-day wait has elapsed.
• Forgetting the four-attempt rolling 12-month limit or assuming the count resets on January 1.
• Budgeting for a discounted retake; the guide requires the full fee each time.
• Ignoring the pass-to-application clock after passing; certification application is still required.

The result gives you one of two paths. After a pass, verify the credential application and experience timeline. After a fail, use the report as evidence for a targeted plan, then follow the waiting, registration, and appointment rules. In both cases, keep the official guide and account notice as the authority for your specific administration.

Use the score report to choose a next step A score report answers whether the candidate met the passing standard. It does not identify a missing fact or reveal what would have happened after changing one response. Avoid building a retake plan from a single memory of a difficult item. Immediately after the appointment, write down which parts of the preparation process felt uncertain, without recording or reconstructing protected exam content. When the official report arrives, compare its domain feedback with that preparation log. If a domain is flagged as an area for review, break it into the tasks in the current outline. A weak result in information security governance could reflect an unclear role, a risk treatment decision, or a program measurement question. Narrow the gap to a concept and decision, then use fresh examples that require the same reasoning. A candidate who passed narrowly may still use domain feedback to plan professional development, but should not treat it as a second certification threshold. A high scaled result also does not prove that every domain is equally strong. The certification decision is based on the overall score. Domain detail is useful for study, not an invitation to reverse engineer the exam. If the result is missing, first distinguish a delivery delay from an exam outcome. Look for the official report through the account and email associated with the registration. Keep the candidate ID and exam date available when contacting support. Buying another registration before the result is posted can create a duplicate expense and does not speed up reporting. A practical plan between attempt and result During the wait, keep the next step modest. Organize notes by domain, record topics that were hard to explain, and avoid overreacting to how many questions seemed familiar. Once the official report is available, turn the broadest weakness into a short list of work tasks. For example, a candidate who struggles to connect governance with incident handling can map who owns a risk decision, who coordinates response, and what evidence should be reported to leadership. Then schedule study around the actual retake interval and the candidate's work calendar. If the minimum wait permits an early date, compare it with the amount of practice needed to show improvement. The purpose of waiting is not merely to let days pass. A second attempt should follow a changed preparation method, such as explaining each answer choice, reviewing the relevant domain task, and returning later to a new scenario without notes. Use a readiness check that can be observed. Can you explain why a control reduces a stated risk? Can you distinguish a management decision from a technical implementation? Can you choose a useful measure and explain how it changes action? Can you complete timed practice without relying on remembered item wording? These checks are more meaningful than a feeling that the test looked hard or easy. If your employer or training plan pays for the exam, confirm what the benefit covers before you register again. A retake is another full-fee registration under the candidate guide. Certification application, experience, and maintenance costs are separate decisions after a pass. A calendar that includes the next appointment, payment, and application steps reduces avoidable administrative surprises.

Use the score report to choose a next step A score report answers whether the candidate met the passing standard. It does not identify a missing fact or reveal what would have happened after changing one response. Avoid building a retake plan from a single memory of a difficult item. Immediately after the appointment, write down which parts of the preparation process felt uncertain, without recording or reconstructing protected exam content. When the official report arrives, compare its domain feedback with that preparation log. If a domain is flagged as an area for review, break it into the tasks in the current outline. A weak result in information security governance could reflect an unclear role, a risk treatment decision, or a program measurement question. Narrow the gap to a concept and decision, then use fresh examples that require the same reasoning. A candidate who passed narrowly may still use domain feedback to plan professional development, but should not treat it as a second certification threshold. A high scaled result also does not prove that every domain is equally strong. The certification decision is based on the overall score. Domain detail is useful for study, not an invitation to reverse engineer the exam. If the result is missing, first distinguish a delivery delay from an exam outcome. Look for the official report through the account and email associated with the registration. Keep the candidate ID and exam date available when contacting support. Buying another registration before the result is posted can create a duplicate expense and does not speed up reporting. A practical plan between attempt and result During the wait, keep the next step modest. Organize notes by domain, record topics that were hard to explain, and avoid overreacting to how many questions seemed familiar. Once the official report is available, turn the broadest weakness into a short list of work tasks. For example, a candidate who struggles to connect governance with incident handling can map who owns a risk decision, who coordinates response, and what evidence should be reported to leadership. Then schedule study around the actual retake interval and the candidate's work calendar. If the minimum wait permits an early date, compare it with the amount of practice needed to show improvement. The purpose of waiting is not merely to let days pass. A second attempt should follow a changed preparation method, such as explaining each answer choice, reviewing the relevant domain task, and returning later to a new scenario without notes. Use a readiness check that can be observed. Can you explain why a control reduces a stated risk? Can you distinguish a management decision from a technical implementation? Can you choose a useful measure and explain how it changes action? Can you complete timed practice without relying on remembered item wording? These checks are more meaningful than a feeling that the test looked hard or easy. If your employer or training plan pays for the exam, confirm what the benefit covers before you register again. A retake is another full-fee registration under the candidate guide. Certification application, experience, and maintenance costs are separate decisions after a pass. A calendar that includes the next appointment, payment, and application steps reduces avoidable administrative surprises.