The CISM exam is structured and covers four domains each carrying a different percentage of weightage. The Information Security Governance (24%), Information Security Program Development and Management (27%), Information Risk Management and Compliance (30%) and Information Security Incident Management (19%)