ISACA moves the CISM exam to a new content outline on 3 November 2026. When we checked in October, the only book from ISACA or a major technical publisher written for it was the CISM Review Manual, 17th Edition, from ISACA itself. The McGraw Hill, Sybex and Packt CISM guides, including the All-in-One by Peter Gregory, still target the 2022 outline. That does not make them useless, because the four domains keep their names and two of the four weights do not move, but it does change which book you buy first.
Seven CISM books made this list, ranked by how well each fits the outline your exam date puts you on. We compared the 2022 and 2026 outlines from the ISACA pages and pulled edition, page count, binding and price for every title from the Amazon catalog. Every claim about what is inside a book comes from the publisher description or table of contents.
Checked October 2026 against the ISACA 2026 CISM job practice update notice and press release.
Best CISM books at a glance
Your exam date decides the first purchase. A test on or after 3 November 2026 starts with the 17th edition Review Manual; everything else on this list supports it:
- For the 2026 outline: CISM Review Manual, 17th Edition from ISACA, the only one from ISACA or a major technical publisher written to it.
- Best full study guide: CISM All-in-One Exam Guide, Second Edition by Peter H. Gregory.
- Best question bank in print: CISM Practice Exams, Second Edition, also by Gregory.
- Best for structured reading: Sybex CISM Study Guide by Mike Chapple.
- Best for the new architecture content: Practical Cybersecurity Architecture, 2nd Edition, as far as ISACA has described that content.
The other two picks fill narrower gaps. The Packt guide by Hemang Doshi suits readers who want diagrams and an online flashcard platform, and the Hubbard and Seiersen risk measurement book covers the analysis side of domain 2. Most candidates need the Review Manual, one study guide and one question bank, and nothing more.
Step 1: Check which CISM outline your exam uses
The test date decides the outline, according to the Pocket Prep summary of the change. The ISACA support article on the update says exams taken on or after 3 November 2026 follow the 2026 exam content outline. Exams before that date use the outline that took effect in June 2022. ISACA began releasing its updated prep materials on 1 September 2026 and removed the older versions of its own CISM exam prep from sale the same day.
The four domain names stay as they were. The ISACA outline page lists 150 questions today, and the 2026 update notice announces no change to that count. Two weights move by one point each, as the comparison below shows:
| Domain | 2022 outline | 2026 outline | Approx. questions of 150 (2026) |
|---|---|---|---|
| 1. Information Security Governance | 17% | 18% | 27 |
| 2. Information Security Risk Management | 20% | 20% | 30 |
| 3. Information Security Program | 33% | 33% | 49 to 50 |
| 4. Incident Management | 30% | 29% | 43 to 44 |
The weights barely shift, so the real change sits inside the domains. The ISACA press release says the 2026 exam puts greater emphasis on information security strategy and program development, and adds two new content areas: enterprise architecture and information security architecture. Its stated reason is that a security manager needs to understand the technologies under their purview. A 2022 book covers strategy and program development already; what it was not written to is the architecture material, and that is the gap the rest of this guide plans around.
One more detail matters if you already own ISACA material. ISACA says an existing QAE database, online review course or eBook stays available for the rest of its subscription. It will not be updated for the new outline, and subscription extensions are not available after 3 November 2026.
Step 2: Compare the seven CISM books side by side
Each row below lists what the publisher states about its own book. Practice question counts are copied exactly as the publisher words them, and prices are the range we saw on Amazon in October 2026 between the sale price and list price:
| Book | Published | Outline | Pages | Practice questions | Price range |
|---|---|---|---|---|---|
| CISM Review Manual, 17th Ed. | Sep 2026 | 2026 | 182 (per Amazon listing) | Self-assessment questions per chapter | List $139 (ISACA members pay less) |
| All-in-One Exam Guide, 2nd Ed. | Sep 2022 | 2022 | 658 | 300 online in TotalTester | $27 to $60 |
| Practice Exams, 2nd Ed. | Jan 2023 | 2022 | 264 | 300+ in the book, 150 more online | $30 to $45 |
| Sybex CISM Study Guide | May 2022 | 2022 | 432 | Chapter reviews, 2 practice exams online | $31 to $63 |
| CISM Exam Prep Guide, 2nd Ed. (Packt) | Dec 2022 | 2022 | 718 | Online practice questions | Around $63 |
| Practical Cybersecurity Architecture, 2nd Ed. | Nov 2023 | None (not an exam book) | 388 | None | $46 to $52 |
| How to Measure Anything in Cybersecurity Risk, 2nd Ed. | Apr 2023 | None (not an exam book) | 368 | None | $37 to $60 |
Two numbers in that table are worth reading carefully. The 182 pages for the Review Manual are per the Amazon listing; the ISACA store gives no page count, and the 16th edition listing showed 344. The Practice Exams figure needs care. McGraw Hill says the book holds more than 300 questions and the online test engine adds another 150, so the total is roughly 450, not 300.
1. CISM Review Manual, 17th Edition
Among books from ISACA and the major technical publishers, the ISACA manual is the only one written to the outline that applies from 3 November 2026. That alone puts it first for anyone testing after the switch, whatever its other limits.
The manual is organised around the four domains, and ISACA says each chapter is split in two. The first section gives the definitions and objectives, the task and knowledge statements, self-assessment questions with answers and explanations, and suggested further reading. The second section is the reference material behind those knowledge statements, and the book closes with definitions of terms that ISACA says appear most often on the CISM exam. Its task statements come from the 2026 job practice, so this is where the new architecture wording shows up.
The trade-off is teaching style. The manual reads as a reference rather than a course, so we pair it with a study guide instead of treating it as the only book. The digital version in the ISACA store is a browser eBook that cannot be downloaded or printed, so buy print if you annotate. Amazon carries a paperback listing (ASIN B0HKZYWVTV) that was temporarily out of stock when we checked, so the ISACA store is the reliable place to buy it.
- Outline: 2026 CISM exam content outline.
- Format: browser-only eBook in the ISACA store; Amazon lists a paperback that was out of stock when we checked.
- Price: list $139 on the Amazon listing; ISACA members get member pricing in the ISACA store.
See formats and pricing in the ISACA store.
2. CISM All-in-One Exam Guide, Second Edition
Among CISM-specific books from established publishers, the All-in-One by Peter H. Gregory had the best Amazon sales rank when we checked in October 2026, and it is the study guide we would pair with the ISACA manual.
McGraw Hill describes it as complete coverage of the 2022 CISM exam domains, with learning objectives, exam tips, practice questions and explanations in each chapter, plus 300 practice questions online in the TotalTester engine. At 658 pages it has room to explain governance and program management at length. That is the reason to own it alongside the ISACA book: when a manual paragraph reads like a definition list, Gregory usually has the worked scenario.
It was written to the 2022 outline, so the new enterprise and security architecture content is not organised the way the 2026 task statements are. If your exam is on or after 3 November 2026, read it for the explanations and use the 17th edition manual to check what the new outline adds. A bundle with the Practice Exams book exists (ASIN 1264742754), but it was listed as low stock and saved only a few dollars over buying both separately when we checked.
$27 (list $60) when we checked in October 2026. Check the current price on Amazon.
3. CISM Practice Exams, Second Edition
CISM questions ask what a security manager should do first, best or most, and that judgment comes from volume. The Practice Exams book by Gregory is a printed question set built for exactly that.
The book holds more than 300 practice questions with explanations for both the correct and the incorrect answers, and the TotalTester online engine adds another 150. Reading why three options are wrong is the part that builds the mindset of a manager, since most wrong CISM answers are technically sound actions taken by the wrong person or in the wrong order. McGraw Hill positions it as a supplement to the All-in-One, and the two share an author and a voice.
Like the All-in-One, it targets the 2022 outline, so it contains no questions written for the new architecture content areas. Use it for the governance, risk, program and incident judgment that both outlines test, and lean on the ISACA questions for the 2026 additions.
$29.60 (list $45) when we checked in October 2026. Check the current price on Amazon.
4. CISM Certified Information Security Manager Study Guide (Sybex)
Mike Chapple wrote the Sybex guide, the CISM title readers most often search our site for by name, and it suits candidates who want a shorter, tightly structured read before moving to questions.
Wiley organises the chapters by exam objective, opens with a pre-assessment, and ends each chapter with Exam Essentials and review questions with explanations across all four domains. The Sybex online learning center adds full-length practice exams, electronic flashcards and a searchable glossary. At 432 pages it is about two thirds the length of the All-in-One. Chapple holds the CISM himself, teaches at Notre Dame, and co-writes the Sybex CISSP study guide.
The cover says it covers the June 2022 objectives, and no second edition was listed on Amazon when we checked. Choose Gregory instead when you want more depth per topic; choose this one when you want to finish a first pass quickly and spend the remaining weeks on practice questions.
$31.38 (list $63) when we checked in October 2026. Check the current price on Amazon.
5. Certified Information Security Manager Exam Prep Guide, 2nd Edition (Packt)
In the Packt guide, Hemang Doshi explains complex topics through diagrams and examples, according to the publisher, and the table of contents gives architecture a chapter of its own.
Its ten chapters follow the domain subtopics, from Enterprise Governance and Information Security Strategy through to Incident Management Readiness and Operations, with chapter 7 on Information Security Infrastructure and Architecture. Packt describes concepts explained through diagrams and examples, and the purchase unlocks an online platform with practice questions, flashcards and exam tips, plus a free PDF of the book with print or Kindle copies.
Packt published it in December 2022, after the 2022 outline took effect, so treat it as a 2022 outline book even with the architecture chapter. Packt also gives no question count for the online bank, which makes it harder to compare with the Gregory book. At 718 pages and with no discount shown on Amazon when we checked, it was the priciest third-party exam guide here at its sale price.
$62.99 with no discount shown when we checked in October 2026. Check the current price on Amazon.
6. Practical Cybersecurity Architecture, 2nd Edition
This is not a CISM exam book, and that is the point: it covers the kind of enterprise and security architecture material the 2026 outline adds. Among the CISM study guides here, only the Packt book has a chapter on the subject (Information Security Infrastructure and Architecture), and it was written before the 2026 change.
Diana Kelley and Ed Moyle open with What is Cybersecurity Architecture? and Architecture, the Core of Solution Building, then work through four Building an Architecture chapters (Scope and Requirements, Your Toolbox, Developing Enterprise Blueprints, Application Blueprints). Two Execution chapters follow, on applying architecture models and future-proofing. Packt frames the book around designs that are goal-based and aligned with the governance strategy of the organisation. That is close to how a CISM question treats architecture: a decision a manager has to justify, not a network diagram to draw.
Leave it on the shelf if your exam falls before 3 November 2026, or if you already work in architecture. It contains no practice questions and no CISM mapping, so it only earns its place as a second book for the new content areas.
$46.22 (list $51.99) when we checked in October 2026. Check the current price on Amazon.
7. How to Measure Anything in Cybersecurity Risk, 2nd Edition
Domain 2 asks you to assess and respond to risk, and Douglas Hubbard and Richard Seiersen wrote a book about measuring that risk with numbers rather than ordinal scores.
Wiley lists what the second edition adds: a Rapid Risk Audit for a first quantitative assessment, research on the real impact of reputation damage, Bayesian examples for working with little data, and new material on simple measurement, estimation and combining expert opinion. For a CISM candidate the value is vocabulary and reasoning, since Wiley pitches it at IT security managers, CFOs and risk professionals, the same people a CISM holder reports risk to.
It is a career book first. Monte Carlo simulation does not appear in the 2022 CISM outline (the 2026 subtopics are not public yet), and a reader with two weeks to go gets more from practice questions. Stock was limited when we checked, so the price swings more than the CISM study guides do.
$36.74 (list $60) when we checked in October 2026. Check the current price on Amazon.
How we picked these CISM books
We started from the full Amazon CISM catalog rather than a search page. A catalog search for “CISM Certified Information Security Manager” returned 138 results. Most were self-published or independently published titles, several labelled 2026-2027 or 2027-2028. Mometrix also sells a set of CISM Study Cards 2026-2027 (July 2026). We kept to ISACA and the major technical publishers whose editions we could trace to a stated outline. We kept titles from established publishers, then checked each one against these points:
- Outline: which CISM outline the publisher says the book targets, or, where it says nothing, when it was published relative to June 2022.
- Edition: edition, binding, page count and publication date from the Amazon catalog, with the cover matched to the same edition.
- Contents: the publisher description and table of contents, not reviews or summaries.
- Availability: sold new on Amazon or by the publisher; used-only listings were dropped.
Two familiar titles did not make the list. The CISM Review Manual, 16th Edition is still listed new on Amazon. It was written to the 2022 outline, though, and ISACA stopped selling that version of its prep on 1 September 2026, so we would not buy it for an exam after the switch. The first edition of the Gregory Practice Exams book, which the old version of this page linked, was replaced by the second edition in January 2023.
If CISM is one stop on a longer path, the same method sits behind our guides to CISSP study books, the CISA books for auditors, CRISC preparation books for risk specialists, and the entry-level ISC2 CC books.
What to look for in a CISM study book
CISM tests decisions, not configuration, so a good book spends its pages on why a manager chooses one action over another. Weigh these before you buy:
- Outline match: the outline named on the cover or in the description, against your exam date. This is the real spec of a CISM book.
- Answer explanations: explanations for the wrong options as well as the right one, because CISM distractors are usually reasonable actions in the wrong order.
- Question volume: a few hundred realistic questions from one publisher beat thousands of unattributed ones. Count them as the publisher states them, book and online separately.
- Management framing: scenarios about business alignment, risk ownership and reporting, not tool setup. Books written for technical certifications rarely make this shift.
- Edition currency: a 2022 book is still useful for three of the four domains as they stand, but pair it with the 2026 ISACA material for the architecture additions.
Readers coming from technical roles sometimes start with a broader cybersecurity reading list or the Security+ books before CISM. That route works, but expect CISM to reward the opposite instinct: the correct answer is usually to follow process and involve the business owner, not to fix the system yourself. Analysts heading toward management can also compare the CySA+ guides, which stay on the technical side.
Match the CISM book to your exam date
Once you know your exam date, the buying decision is mechanical. Follow the line that matches your situation:
- Exam on or after 3 November 2026: the 17th edition Review Manual first, then the All-in-One or the Sybex guide for explanations, then the Gregory Practice Exams book. Add Practical Cybersecurity Architecture if architecture is new to you.
- Exam before 3 November 2026: the All-in-One plus the Practice Exams book covers the 2022 outline you sit under; a new Review Manual adds little.
- Already own the 16th edition or an older QAE subscription: keep using it for the three domains whose names and weights barely moved, and add the 17th edition for the architecture content.
- Budget for one book only: the Review Manual if you test after the switch, the All-in-One if you test before it.
After the 2022 change, the second edition All-in-One from McGraw Hill followed in September 2022, about four months after the outline took effect. No 2026 outline edition from McGraw Hill, Sybex or Packt was listed on Amazon when we checked. Until one appears, ISACA is the only major source written to the 2026 outline, and the other books on this list are there to explain it.
