snready

CIS-EM exam blueprint, explained

Certified Implementation Specialist - Event Management

ServiceNow's blueprint lists what the exam tests and how much each area counts. This page restates it in plain language, with the domains ordered as published and every objective as a checklist.

Official source: KB0011604, updated Jan 2026. Open the official CIS-EM blueprint

The original is a ServiceNow University knowledge article and may ask you to sign in to Now Learning. If anything here disagrees with it, the official blueprint wins.

At a glance

Domains
6
Heaviest domain
Alerts and Tasks (30%)
Top two domains
57% of the exam
Objectives listed
26+

Where the marks are

Each domain's share of the exam, and what that means for every 10 hours you study.

DomainWeightOf every 10 study hours
1. Event Management Overview
7%
45 min
2. Architecture and Discovery
10%
1 h
3. Event Configuration and Use
27%
2 h 45 min
4. Alerts and Tasks
30%
3 h
5. Event Sources
16%
1 h 30 min
6. Metric Intelligence
10%
1 h

Weights as published in KB0011604. The study-time column only applies the weight; spend more on domains you're weaker in.

What each domain covers

The blueprint's objectives for each domain. Tick them off as you can explain and do each one in a Personal Developer Instance.

Domain 1 · Event Management Overview

7% of the exam
  • IT Operations Management (ITOM) solution
  • Define customer challenges
  • Event Management key features and capabilities
  • Graphical user interfaces (operator workspace, alert intelligence, dependency maps)
  • Common Service Data Model (business, application, and technical services)
Docs: Event ManagementPractice 7 Event Management Overview questions →

Domain 3 · Event Configuration and Use

27% of the exam
  • Event setup (event processing, event rules, event filter, event thresholds, operator workspace)
  • Event Management process flow (event table, message key, event processing jobs, event field mapping, CI binding, best practices)
  • Connectors (preconfigured, customized)

The official blueprint lists more objectives for this domain than we transcribed. See the full list

Docs: Event Management process flowPractice 27 Event Configuration and Use questions →

Domain 4 · Alerts and Tasks

30% of the exam
  • Alert defined (alert record attributes, scheduled jobs
  • Alerts process flow (alert management rules, CI binding, priority scores, priority groups, incidents, best practices)
  • Alert grouping (correlation rules, alert aggregation)
  • Alert intelligence in Service Operations Workspace

The official blueprint lists more objectives for this domain than we transcribed. See the full list

Docs: Alert management rulesPractice 30 Alerts and Tasks questions →

Before you book

  • Prerequisites: Our transcription of the blueprint lists no mandatory prerequisite certification. Check the exam registration page to confirm.
  • Exam fee: $450.
  • Passing score: ServiceNow does not publish the cut score, and the official exam blueprint says it is not always 70%.
  • Booking, retake waits and exam format are covered on the CIS-EM page.

Courses the blueprint points to

Recommended on the blueprint

The blueprint lists these as recommended preparation.

Additional resources on the blueprint

Listed as further reading, not core preparation.

  • ITIL Foundations Certified

Courses without a link are named in the blueprint but we haven't recorded a course URL for them; search for them in Now Learning.

How to use this blueprint

  1. Go through the objectives above and mark each one: done for real, only read about, or new.
  2. Start where heavy weight meets the most “new” marks. Alerts and Tasks alone is 30% of the exam.
  3. Build each objective in a Personal Developer Instance rather than only reading about it.
  4. Use practice questions to find weak domains, then go back to those objectives and their documentation.

Keep going