- How to Read the 10 Domains Correctly
- Exam Format and Registration Mechanics
- Foundations: Intelligence, OSINT and Social Media Investigations
- Technical Cluster: Mobile Apps, Digital Evidence and Mobile Forensics
- Research Cluster: Advanced Searching, Deep Web and Communication Platforms
- High-Stakes Cluster: Terrorism-Related Investigations and Legal Fundamentals
- Domain-by-Domain Comparison Table
- Scheduling the Domains Across Your Prep
- Who Hires for This Credential
- Frequently Asked Questions
- The 10 domains are named preparation topics from McAfee Institute's curriculum summary, not an official weighted exam blueprint.
- The exam is 3 hours, closed-book, with a published 70% passing threshold and a $450 standalone attempt.
- Professional eligibility requires 4 to 7 years of paid, full-time investigative or intelligence experience, depending on education.
- Legal fundamentals and digital evidence underpin every other domain, so study them early rather than last.
How to Read the 10 Domains Correctly
Before diving into each content area, one clarification will save you from a common mistake. The ten domains in this guide are the explicitly named preparation topics listed in the public curriculum summary for the Certified Social Media Intelligence Expert (CSMIE) from McAfee Institute. They are not the 19 module titles of the training course, and they are not an official ten-domain exam structure with published percentage weights. No formal public blueprint or per-domain weighting was available when this guide was prepared.
That matters for how you study. Because weights are unpublished, you should not assume one domain carries more points than another. A balanced approach is safer, with extra time for the areas where your own background is thinnest. If you are new to the credential itself, start with our primer on what CSMIE certification is and then return here for the topic-by-topic breakdown.
Exam Format and Registration Mechanics
Understanding the delivery format shapes how you prepare for the domains. Here is what the published sources establish:
- Duration: 3 hours in a single sitting.
- Book policy: Closed-book.
- Passing threshold: 70%. See our deeper explainer on the CSMIE passing score.
- Question styles: The shared examination rules describe true/false, multiple-choice and scenario-based formats. An exact CSMIE-specific question count was not verified, so be wary of any site quoting one with confidence.
- Standalone fee: $450 for one attempt with online proctoring, including a 1-year exam license. The published retake license is $450.
- Proctoring: The shared examination page describes AI-powered proctoring, while its FAQ names ProctorU. Your enrollment-specific instructions govern the actual setup, so read them before exam day.
Scenario-based questions deserve special attention in a credential like this one. Expect to apply a domain concept to a situation, such as deciding how evidence from a social platform should be handled, rather than simply recalling a definition. For the full pricing picture, including the bundle, see the CSMIE certification cost breakdown.
Eligibility in brief
The professional pathway requires relevant paid, full-time investigative or intelligence experience: a bachelor's degree or higher plus 4 years, an associate degree plus 6 years, or a high-school diploma or equivalent plus 7 years. Proof of eligibility and a conduct review apply. The separate Associate Social Media Intelligence Expert credential is not a compulsory prior step on the published professional pathway. Full details live in our CSMIE requirements guide.
Foundations: Intelligence, OSINT and Social Media Investigations
The first two domains set the vocabulary and workflow for everything that follows. They are conceptual but also practical, and scenario questions often draw on them.
Domain 1: Intelligence and OSINT foundations
This domain covers the principles of intelligence work and open-source intelligence as a discipline. Candidates should be comfortable thinking like an analyst, not just a searcher.
- The difference between raw information and finished intelligence
- How open-source collection fits within a broader investigative process
- Planning a collection effort before touching a single platform
- Assessing source reliability and the credibility of what you find
- Documenting your methodology so results are defensible
Domain 2: Social media investigations
Here the foundations meet the platforms. This is the heart of the credential's identity, so expect it to feel central rather than peripheral.
- Identifying and profiling subjects through public social media activity
- Mapping connections, associations and patterns of behavior
- Attribution challenges, including aliases, impersonation and fake accounts
- Preserving what you observe in a way that holds up later
- Staying within platform rules and legal boundaries while collecting
These domains reward candidates who already work cases. If your experience is mostly in one platform ecosystem, deliberately broaden your exposure, because exam scenarios will not assume you only know your favorite network.
Technical Cluster: Mobile Apps, Digital Evidence and Mobile Forensics
Domains 3, 4 and 5 form a technical chain. Mobile applications generate the data, digital evidence rules govern how it is treated, and mobile forensics describes how it is extracted and examined. Studying them as a connected sequence makes each easier to retain.
Domain 3: Mobile applications
Social media intelligence increasingly lives in apps rather than websites. This domain asks you to understand how mobile applications behave and what they expose.
- How popular app categories store and transmit user data
- Where investigative value hides inside app features and metadata
- Differences between web-based and app-based data availability
- Privacy settings and how they change what an investigator can see
Domain 4: Digital evidence
This is one of the most consequential domains because it connects investigative work to admissibility and credibility.
- What qualifies as digital evidence and how it differs from ordinary information
- Capture, preservation and chain-of-custody thinking
- Authentication: showing that content is what it claims to be
- Common mistakes that compromise otherwise strong findings
Domain 5: Mobile forensics
Where Domain 3 describes the apps, this domain addresses the devices and the examination of data stored on them.
- The role of mobile devices as sources of evidentiary data
- High-level concepts of acquisition and examination
- How social and communication app artifacts appear on a device
- Knowing when a task calls for a specialist examiner versus an investigator
Research Cluster: Advanced Searching, Deep Web and Communication Platforms
The next three domains are about finding things efficiently and knowing where to look. They are the most hands-on part of the syllabus and reward genuine practice rather than reading alone.
Domain 6: Advanced searching
Strong searchers locate in minutes what casual users miss in hours. Expect questions that test whether you understand how search works, not just that it exists.
- Constructing precise queries using operators and refinements
- Searching within platforms versus across the open web
- Using archived and cached material to recover removed content
- Pivoting from one identifier, such as a username or image, to related traces
Domain 7: Deep-web research
Much valuable information sits beyond what general search engines index. This domain addresses that layer of the internet in an investigative context.
- The conceptual difference between the surface web and the deep web
- Types of content that standard search does not surface
- Research approaches and safeguards when working in less-indexed spaces
- Operational security and risk awareness for the investigator
Domain 8: Communication platforms
Messaging and communication platforms differ sharply from public-facing social networks in what they reveal and how access works.
- How messaging and group-communication services operate
- What is publicly discoverable versus private by design
- Lawful access considerations and the limits of open-source methods
- Investigative value of communities, channels and group structures
If you want a sense of how challenging these areas feel in practice, our guide on how hard the CSMIE exam is discusses where candidates tend to struggle.
High-Stakes Cluster: Terrorism-Related Investigations and Legal Fundamentals
The final two domains carry the heaviest consequences in the real world, and both reward careful, principled reasoning over speed.
Domain 9: Terrorism-related social media investigations
This domain applies the entire toolkit to a specialized and sensitive subject area. Candidates should understand how extremist activity appears online and how investigators approach it responsibly.
- How violent extremist networks use social platforms to communicate and recruit
- Recognizing indicators and patterns without overreaching in conclusions
- Handling sensitive material and protecting the investigator
- Coordination and escalation considerations within a lawful framework
Domain 10: Legal fundamentals
Legal grounding is the thread that ties every other domain together. A technically brilliant collection effort can still fail if it ignores legal limits.
- What is permissible when collecting open-source and social media data
- Privacy expectations and the boundary between public and protected information
- Legal process for obtaining data that open-source methods cannot reach
- How legal missteps undermine evidence and expose investigators
Key Takeaway
Do not treat Legal fundamentals as the last item on a checklist. Its principles shape how you answer scenario questions in Digital evidence, Communication platforms and Social media investigations. Read it early and revisit it often.
Domain-by-Domain Comparison Table
Use this table to see the character of each preparation topic at a glance. The "Primary skill type" column is a study aid, not an official classification, and no weights are implied.
| Domain | Primary skill type | Best way to prepare |
|---|---|---|
| 1. Intelligence and OSINT foundations | Conceptual and analytical | Learn the vocabulary, then apply it to sample cases |
| 2. Social media investigations | Applied investigation | Practice profiling and connection mapping across several platforms |
| 3. Mobile applications | Technical awareness | Study what different app types expose and store |
| 4. Digital evidence | Procedural | Memorize preservation and authentication principles |
| 5. Mobile forensics | Technical concepts | Focus on concepts, limits and proper handoffs |
| 6. Advanced searching | Hands-on technique | Build and test queries repeatedly |
| 7. Deep-web research | Conceptual and cautionary | Understand layers, risks and safeguards |
| 8. Communication platforms | Platform knowledge | Compare public versus private discoverability |
| 9. Terrorism-related social media investigations | Specialized application | Review indicators, handling and ethical limits |
| 10. Legal fundamentals | Principles and judgment | Study early and tie to every other domain |
Scheduling the Domains Across Your Prep
One short note on sequencing, tied directly to how these particular domains depend on one another. The order below puts the load-bearing material first and the application-heavy material after it. Adjust the number of weeks to match your own calendar. For a fuller approach, see our CSMIE study guide.
Foundations and law
- Domain 1: Intelligence and OSINT foundations
- Domain 10: Legal fundamentals, so every later topic has legal context
Core investigation and evidence
- Domain 2: Social media investigations
- Domain 4: Digital evidence
Technical chain
- Domain 3: Mobile applications
- Domain 5: Mobile forensics
Research techniques
- Domain 6: Advanced searching
- Domain 7: Deep-web research
- Domain 8: Communication platforms
Specialized application and review
- Domain 9: Terrorism-related social media investigations
- Full review of weak areas using practice questions on the main practice test site
A quick reference sheet can help in the final days. Our CSMIE cheat sheet condenses the must-know facts, though remember the exam itself is closed-book.
Who Hires for This Credential
The eligibility rules themselves reveal the target audience: people with years of paid, full-time investigative or intelligence experience. That points toward roles in law enforcement and public-sector investigation, corporate security and investigations, fraud and risk teams, and intelligence or threat analysis functions. The credential is positioned as a way to formalize and validate social media intelligence skills for people who already do this work, rather than as an entry ticket for newcomers.
Because published salary data specific to this credential was not retrieved, this guide does not quote earnings figures. For a qualitative discussion of career context, see the CSMIE jobs overview, the CSMIE salary guide and the analysis of whether the certification is worth it.
Training route versus exam-only route
Eligible candidates can sit the standalone exam without taking the full course, which is optional for exam-only candidates. Study materials are separate from the standalone license, despite generic training-inclusion bullets on the exam product page. The training-and-exam bundle costs $1,997 and includes 60 instructional hours across 19 modules, 60 course-completion CPE credits, lifetime course access and a 1-year exam license. The training route also requires at least 70% on course assessments, and training completion alone does not award certification. Learn more on the CSMIE training page.
Frequently Asked Questions
No. They are explicitly named preparation topics from the public curriculum summary. They are not the 19 course module titles, not an exhaustive blueprint and not an official ten-domain exam structure with published weights.
No formal public blueprint or exam-specific percentage weights were retrieved. Study all ten areas rather than assuming some count for more than others, and see our pass rate article for what is and is not known about outcomes.
The exam lasts 3 hours in one sitting, is closed-book, and has a published passing threshold of 70%. The standalone attempt costs $450 and includes online proctoring and a 1-year exam license.
The full course is optional for eligible exam-only candidates. If you choose the $1,997 training-and-exam bundle, you must also score at least 70% on course assessments, and finishing the course alone does not award certification.
Scheduling depends on your enrollment and exam license, and the license lasts 1 year. Check our exam dates and scheduling guide and follow the instructions provided when you enroll.
Mastering these ten areas is less about memorizing isolated facts and more about seeing how intelligence method, technical knowledge and legal discipline reinforce one another. When you are ready to test yourself against realistic questions, head to the CSMIE practice tests and use your results to decide which domains need another pass.