Many candidates treat the CISA as a security exam and are caught out by how much of it is about audit process, IT governance and operations rather than security controls alone. This guide sets out what ISACA publishes about the Certified Information Systems Auditor: the five domains and their weightings in the outline effective from 1 August 2024, exam delivery and fees, the five-year experience rule, the application window and the CPE cycle. It adds a preparation plan, a study mapping to NIST frameworks and career context. It is written for IT auditors, risk and compliance staff, and security practitioners moving into assurance work, and for the managers who sponsor them. Facts were checked on isaca.org on 24 October 2026; ISACA changes fees and rules, so confirm on the linked pages before you book.
Key takeaways
- It is an audit credential first. Operations and resilience and protection of information assets each carry 26% of the exam, but the audit process and IT governance together carry another 36%, and every domain is tested from the auditor's point of view.
- The current outline took effect on 1 August 2024. ISACA describes the domains as essentially unchanged from the previous outline, with added testing of risk, security and controls for disruptive technologies and emerging IT audit practices.
- You can pass before you qualify. Certification needs five years of information systems auditing, control or security experience within the ten years before you apply, and you have five years from passing to apply.
- The exam costs US$575 for ISACA members and US$760 for non-members. A US$50 application processing fee follows a pass, and the exam is delivered at PSI test centres or by remote proctoring.
- Holders carry ongoing obligations. At least 20 CPE hours a year and 120 per three-year period, an annual maintenance fee due by 1 January, random CPE audits, and compliance with ISACA's IT auditing standards.
Who the certification is for
ISACA launched the CISA in 1978 and reports that more than 207,000 professionals have earned it. Its job practice covers the full audit cycle and the IT environment being audited, which makes it the reference credential for IT and information systems audit roles.
- Good fit: internal and external IT auditors, technology risk and controls testers, SOX and regulatory compliance analysts, and consultants who assess IT general controls.
- Good fit for security practitioners moving into assurance: engineers and analysts who already know the controls and want to evaluate them independently, plan risk-based audits and report findings. See the Internal Audit for Cybersecurity Guide for how audit functions approach security.
- Weaker fit: people who want to run a security function rather than assess one; the CISM Certification Guide covers that management route. Hands-on technical roles may get more from a technical credential; compare options in the Cybersecurity Certifications Guide.
- GRC careers: CISA is a common credential on the GRC path. See the GRC Analyst Career Guide.
Exam format and domains
What ISACA publishes about the exam
| Item | What ISACA states | Source page |
|---|---|---|
| Number of questions | 150 questions across five domains | CISA exam content outline |
| Outline in force | Updated exam effective 1 August 2024 (announced 1 May 2024) | ISACA press release, May 2024 |
| Delivery | Computer-based, at authorised PSI testing centres worldwide or remotely proctored | CISA credential page |
| Registration | Continuous; eligibility lasts six months from registration | CISA credential page |
| Scheduling | Book as early as 48 hours after payment; appointments released up to 90 days ahead; free rescheduling at least 48 hours before | CISA credential page |
| Exam fee | US$575 members, US$760 non-members | CISA credential page |
| Duration, scoring scale, retakes | Not stated on the ISACA pages checked; confirm in ISACA's exam candidate information before booking | None |
Domains, weightings and subdomains
| Domain | Weight | Subdomains and main topics |
|---|---|---|
| 1. Information System Auditing Process | 18% | A. Planning (IS audit standards, guidelines and codes of ethics; types of audits, assessments and reviews; risk-based audit planning; types of controls). B. Execution (audit project management; testing and sampling methodology; evidence collection; audit data analytics; reporting and communication; quality assurance of the audit process) |
| 2. Governance and Management of IT | 18% | A. IT governance (laws, regulations and standards; structure and IT strategy; policies and procedures; enterprise architecture; enterprise risk management; privacy programme; data governance and classification). B. IT management (resource management; vendor management; performance monitoring; quality management) |
| 3. Information Systems Acquisition, Development and Implementation | 12% | A. Acquisition and development (project governance; business case and feasibility; development methodologies; control design). B. Implementation (readiness and implementation testing; configuration and release management; migration and data conversion; post-implementation review) |
| 4. Information Systems Operations and Business Resilience | 26% | A. Operations (IT components and asset management; job scheduling; interfaces; shadow IT and end-user computing; availability and capacity; problem and incident management; change, configuration and patch management; log management; service levels; database management). B. Business resilience (BIA; system resilience; backup and restoration; BCP; DRP) |
| 5. Protection of Information Assets | 26% | A. Asset security and control (frameworks; physical controls; identity and access management; network and endpoint security; DLP; encryption; PKI; cloud and virtualisation; mobile, wireless and IoT). B. Security event management (awareness; attack methods; security testing; monitoring; incident response; evidence collection and forensics) |
ISACA's preparation materials for this outline, released 1 May 2024, include the CISA Review Manual 28th Edition, the Online Review Course 2024 and the QAE Database 2024, with several titles available in Chinese, French, German, Japanese and Spanish. ISACA's exam content outline page does not announce a further update as of 24 October 2026, but check it before you buy materials, as ISACA has just revised the CISM outline.
Prerequisites and experience
Anyone can sit the exam. The experience rule applies when you apply to become certified.
| Requirement | ISACA rule | What it means in practice |
|---|---|---|
| Experience | Five years of professional information systems auditing, control or security work experience, as defined by the CISA job practice areas | Security operations and control ownership can count alongside audit, so describe the control aspect of each role |
| Experience window | Within the ten years preceding the application date | Apply before early roles fall outside the window |
| Application window | Within five years of passing the exam | Pass early, then apply when experience is complete |
| Verification | Supervisor or manager verifies your experience | Line up verifiers in advance, especially for past employers |
| Fee | US$50 application processing fee, paid in MyISACA after official scores are released | Separate from the exam fee |
| Standards and ethics | Comply with ISACA's Information Systems Auditing Standards, the Code of Professional Ethics and the CPE policy | The CISM maintenance page does not list this obligation; it reflects the audit role |
Experience waivers: the ISACA CISA pages checked do not describe waivers or substitutions, and ISACA's support article on requirements could not be read. If you hope to offset experience with education or other credentials, confirm with ISACA first.
Language: non-English application forms exist for exams passed from June 2019 in Italian, Spanish, German, Japanese, Korean and Simplified Chinese.
Preparation plan
Security practitioners usually find domain 5 familiar and domains 1 and 3 unfamiliar; career auditors often find the reverse. Plan for roughly 10 to 14 weeks part-time and adjust to your baseline.
- Confirm the outline (week 0): check the exam content outline page for any announced update, then buy materials matching the outline you will sit.
- Baseline (week 1): take a timed mixed question set and record scores for each of the five domains.
- Audit process first (weeks 2 to 4): learn risk-based audit planning, sampling, evidence quality, and how findings are reported and followed up. This logic shapes questions in every domain.
- Governance and acquisition (weeks 4 to 6): study IT strategy, vendor management, project governance and post-implementation review, the areas most technical candidates skip.
- Operations and protection (weeks 6 to 9): together 52% of the exam. Focus on change, patch and log management, backup and restoration, BCP and DRP, and access control review from an auditor's angle.
- Auditor mindset drills (weeks 8 to 11): for each wrong answer, note what the auditor should do: assess and report risk, verify evidence, recommend rather than implement. Auditors who design or run the control they audit lose independence.
- Full mocks (weeks 10 to 12): sit at least two timed mocks and stop when every domain is consistently above your target.
- Logistics and application: book inside the six-month eligibility window, test remote proctoring set-up early, and prepare your experience record and verifiers while you study.
Practise on frameworks you will audit
Auditors test controls against a framework. The mapping below is our study aid, not an ISACA mapping, and links each domain to NIST references that appear in many audit programmes.
| CISA domain | NIST CSF 2.0 categories | NIST SP 800-53 Rev 5 controls |
|---|---|---|
| 1. Auditing process | GV.OV Oversight, ID.IM Improvement | CA-2 Control Assessments, AU-1 Policy and Procedures |
| 2. Governance and management of IT | GV.OC Organizational Context, GV.RR Roles, Responsibilities, and Authorities, GV.PO Policy, GV.SC Cybersecurity Supply Chain Risk Management | PM-9 Risk Management Strategy, PL-2 |
| 3. Acquisition, development and implementation | PR.PS Platform Security, GV.SC | CA-2, PL-2 |
| 4. Operations and resilience | ID.AM Asset Management, RS.MA Incident Management, RC.RP Incident Recovery Plan Execution | CP-2 Contingency Plan, IR-8 Incident Response Plan |
| 5. Protection of information assets | PR.AA Identity Management, Authentication, and Access Control, PR.DS Data Security, DE.CM Continuous Monitoring | CA-7 Continuous Monitoring, RA-3 |
Access reviews are a staple of IT general controls testing, and non-human accounts are a frequent gap: service accounts, API keys and automation tokens often sit outside the joiner, mover and leaver process that auditors sample. See the Access Reviews Guide and the Audit Evidence and Continuous Controls Monitoring Guide.
Cost, renewal and continuing education
| Cost or obligation | Amount or rule (ISACA) |
|---|---|
| Exam registration | US$575 members; US$760 non-members |
| Application processing | US$50, one time |
| Annual maintenance fee | US$45 members; US$85 non-members, due by 1 January for the coming calendar year; invoices sent from September |
| Third and further ISACA certifications | US$25 members; US$50 non-members each per year, once you hold more than two |
| CPE | At least 20 hours each year and 120 hours per three-year reporting period, relevant to CISA |
| CPE audit | Random selection for a given calendar year; keep evidence for 12 months after each three-year cycle ends |
| Reinstatement after revocation | Written appeal to the CISA Working Group; if approved, outstanding fees plus US$50 per certification; if denied, retake the exam and reapply |
- CPE sources: ISACA lists conferences (up to 32 CPE), webinars and online training (up to 36 free CPE a year), on-demand courses (up to 28 per course), training courses and labs (up to 32 per course) and volunteering (up to 20 free CPE a year). Chapter and other sponsor activities are self-reported in MyISACA.
- Shared hours: one activity can count for several ISACA certifications where relevant to each, useful if you add CRISC or CISM.
- Evidence: keep a record with your name, sponsor, title and description, date and hours for each activity.
- Non-compliance: failing CPE, fee or audit requirements leads to revocation. Non-practising and retired statuses are available to those who qualify. You may use the CISA acronym after your name but not the logo.
Where it fits on the career path
CISA is typically the first ISACA credential for audit and assurance staff, and a common second credential for security practitioners who move into risk or compliance.
| Credential | Focus | When it complements CISA |
|---|---|---|
| CISM | Managing the information security programme | When moving from assessing controls to owning them. See the CISM Certification Guide. |
| CRISC | IT risk and control ownership | For technology risk roles. See the CRISC Certification Guide. |
| CDPSE | Privacy engineering and data protection | For audits with heavy privacy scope. See the CDPSE Certification Guide. |
| ISO 27001 Lead Auditor | Auditing an ISMS against ISO/IEC 27001 | For certification-body and ISMS audit work. See the ISO 27001 Lead Auditor and Lead Implementer Guide. |
| AAIA | ISACA's AI audit credential | For auditing AI systems; check ISACA's current eligibility rules. See the ISACA AAISM and AAIA AI Certifications Guide. |
Common mistakes
- Studying only security: neglecting domains 1 to 3, which together make up 48% of the exam.
- Answering as an implementer: choosing to fix the control when the auditor's job is to evaluate, evidence and report.
- Thin experience records: describing tasks without showing the audit, control or security element.
- Missing deadlines: letting the five-year application window or the ten-year experience window lapse.
- CPE gaps: reporting fewer than 20 hours in one year, or lacking evidence when selected for audit.
Practitioner checklist
- Confirm the current outline on isaca.org and buy matching materials.
- Compare the US$185 member exam saving and lower maintenance fee with ISACA membership cost.
- Take a timed baseline and record per-domain scores.
- Study the audit process domain first, then governance and acquisition.
- Practise every domain from the auditor's view: evidence, independence, reporting.
- Draft your experience record and confirm verifiers while studying.
- Book inside the six-month eligibility window; reschedule at least 48 hours ahead if needed.
- After passing, pay the US$50 fee and apply within five years.
- Track 20 CPE hours a year and the 1 January maintenance fee, with evidence stored centrally.
Standards and references
- ISACA: CISA Certification
- ISACA: CISA Exam Content Outline
- ISACA: ISACA's CISA Exam Updated to Reflect Innovations and Evolving Technologies Impacting IT Audit
- ISACA: Get CISA Certified
- ISACA: Maintain CISA Certification
- NIST: Cybersecurity Framework 2.0
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: Cybersecurity Certifications Guide · CISM Certification Guide · CRISC Certification Guide · ISACA AAISM and AAIA AI Certifications Guide · Internal Audit for Cybersecurity Guide