CISSP vs CISA: Choosing Between Security Practice and IT Audit

CISSP and CISA are both senior, experience-gated certifications, but they certify opposite sides of the same control: one proves you can design and run security, the other proves you can independently test whether it works. CISSP, from ISC2, covers eight domains of security practice from risk management to software development security. CISA, from ISACA, certifies the information systems audit process and the judgement an auditor applies to governance, operations, resilience and asset protection. This guide compares how each body defines the role, the domains and their weightings, the experience rules, what the labour market data does and does not tell you, and when holding both makes sense. It is for practitioners deciding between a security delivery path and an IT audit or assurance path, and for managers writing role requirements. Exam, fee and experience facts were checked on the ISC2 and ISACA websites on 14 November 2026; confirm them there before you book.

Key takeaways

• The real choice is builder or assessor. CISSP certifies people who design, implement and operate controls; CISA certifies people who plan audits, gather evidence and report on whether controls are designed and operating effectively.
• Both want five years, but of different work. ISC2 asks for five years of security work experience; ISACA asks for five or more years of information systems auditing, control or security experience within the ten years before you apply.
• CISA is narrower on technology, deeper on method. Only one of its five domains is the audit process itself, yet that 18 per cent shapes how every other question is framed: risk-based planning, sampling, evidence and reporting.
• Independence is the hidden constraint. An auditor cannot credibly assess controls they built and run, so the two roles rarely sit in the same person at the same time inside one organisation.
• Holding both is common in GRC and consulting. The overlap in governance, IAM, resilience and encryption topics is large, and both bodies run a 120 hour, three-year CPE cycle, so one learning plan can feed both.

The short answer

If you can only take one in the next year:

• Choose CISSP if your work is building, engineering, architecting or operating security, if you lead a security team, or if you need a US Department of Defense approved baseline (ISC2 lists CISSP as approved under DoDM 8140.03).
• Choose CISA if you work, or want to work, in internal audit, external audit, IT assurance, SOX or regulatory testing, or a second line risk and compliance function that tests other people's controls.
• Plan both if you are heading for GRC leadership, audit-facing security management, or advisory consulting, where you must both explain how a control should work and defend how it was tested.

For the full exam detail on each, see the CISSP Certification Guide and the CISA Certification Guide. This page focuses on the decision.

Side-by-side comparison

Role orientation: builder versus assessor

The difference is not seniority or difficulty; it is the direction you face. A CISSP holder is usually accountable for a control: choosing the design, implementing it, running it and fixing it when it fails. A CISA holder is usually accountable for an opinion about a control: whether its design addresses the risk, whether it operated throughout the period, and whether the evidence supports that conclusion.

Independence: ISACA requires CISA holders to comply with its Information Systems Auditing Standards, set out in ISACA's IT Audit Framework (ITAF), 5th Edition, which addresses auditors' roles, ethics and conduct. An auditor who designed the control under test has an independence problem. That is why a person moving from a security engineering role into the internal audit team of the same organisation often has a cooling-off expectation before auditing their former area. Check your own audit charter.

Typical outputs: CISSP work produces architectures, standards, configurations, runbooks, risk treatment plans and incident reports. CISA work produces audit plans, test scripts, sample selections, work papers, findings with ratings, and an audit report addressed to management or an audit committee.

Typical stakeholders: the CISSP holder works with engineering, operations and the CISO. The CISA holder works with the head of internal audit, the audit committee, external auditors and regulators, and is on the other side of the table from control owners.

What each exam actually tests

CISSP's eight domains, from the ISC2 outline effective 15 April 2024, are: Security and Risk Management; Asset Security; Security Architecture and Engineering; Communication and Network Security; Identity and Access Management (IAM); Security Assessment and Testing; Security Operations; and Software Development Security. The breadth is the point: a CISSP holder is expected to reason across architecture, network, identity, operations and software.

CISA's five domains and weightings, from ISACA's exam content outline, are:

The table shows why many people find the two exams feel different even where topics overlap. Encryption appears in both, but CISSP asks which design fits the requirement; CISA asks how you would obtain evidence that keys are managed as the policy says, and what finding you would raise if they were not. Domain 1 of CISA has no real equivalent in CISSP: sampling, evidence sufficiency and audit reporting are a discipline of their own.

Which is harder? Neither body publishes pass rates on the pages checked, so any "harder" claim is anecdotal. The practical answer: CISSP is harder for people without broad technical exposure, because of its breadth across architecture, network and software. CISA is harder for technical people without audit exposure, because its questions reward the auditor's response (plan, test, report, escalate) over the engineer's (fix it).

Experience rules compared

• CISSP: five years of security work experience. ISC2's FAQ states that a bachelor's or master's degree in computer science, IT or a related field may satisfy up to one year, and that ISC2 does not pre-approve experience, so you judge whether your work maps to the domains. Without the experience you can pass and become an Associate of ISC2, with up to six years to gain the experience and complete the application. After passing you submit the endorsement application within nine months, and review typically takes four to six weeks.
• CISA: five or more years of professional information systems auditing, control or security work experience in the CISA job practice areas, gained within the ten years before the application date and verified by a supervisor or manager. You may sit the exam before you have the experience, but you must apply within five years of passing. ISACA describes substitutions and waivers in a separate support article; check it before you count on one.

The overlap that matters: ISACA's wording includes "security work experience", so a security practitioner with five years of relevant work may already qualify for CISA without ever having worked in an audit team. The reverse is less certain: pure audit experience must still map to CISSP's security domains, and ISC2 leaves that judgement to the candidate and the endorser.

Salary and demand: what the data supports

Neither certifying body publishes salary figures on the pages checked, and certification-specific salary surveys vary widely in method. Official occupational statistics are a steadier guide to the two paths. The US Bureau of Labor Statistics (BLS) Occupational Outlook Handbook reports:

Read these with care. The accountants and auditors figure covers a large population, most of it financial, and does not isolate IT auditors; it is not a CISA salary. The security analyst figure is not a CISSP salary either. What the data supports is narrower: security practitioner roles are projected to grow faster than the audit occupation as a whole. Your market, sector and seniority will matter more. Check current adverts in your region and count how many name each certification as required or preferred.

Where demand concentrates: CISA appears most often in internal audit teams, Big Four and mid-tier audit firms, financial services and other regulated sectors where IT general controls are tested every year. CISSP appears across security engineering, architecture, consulting and security management, and in US defence work that applies DoDM 8140.03.

Worked scenarios

• Cloud security engineer, four years in: wants to become a security architect. CISSP first: it matches the next role and the experience is almost there. CISA adds little unless the person plans to move into assurance.
• External IT auditor, three years at an audit firm: tests IT general controls for SOX clients. CISA first: it is the credential their clients and managers recognise, and audit firms commonly support it. CISSP later if they move into security advisory.
• GRC analyst in a bank: writes policies and runs control testing for the second line. Either works; CISA usually fits the testing work better, and pairs naturally with the CRISC Certification Guide path into risk management.
• Security manager preparing for regulatory examinations: needs to stand up to auditors and examiners. Holding CISSP already, adding CISA helps them anticipate test approaches and evidence requests, and write controls that are auditable from day one.
• Internal audit manager moving to head of security: CISA alone can look one-sided. Adding CISSP, or the CISM Certification Guide route, signals the shift from assessing to owning.

Combining both

Holding both is most valuable where a person must translate between control owners and assessors. The practical reasons it works:

• Shared content: CISA domains 2, 4 and 5 (together 70 per cent of the exam) overlap heavily with CISSP domains 1, 2, 3, 4, 5 and 7.
• Aligned maintenance: both require 120 CPE over three years; ISC2 suggests 40 a year and ISACA requires a minimum of 20 a year. Training on a topic such as cloud key management can count for both if it meets each body's rules.
• Order: take the one that matches your current job first, because the experience verification is easier when your manager can attest to it directly.

The cost is real: two annual maintenance fees, two CPE logs, two codes of ethics, and two sets of renewal deadlines. Do not take the second certification unless a target role or client base needs both perspectives.

Trade-offs and common mistakes

• Choosing by perceived prestige. CISSP is better known outside audit, but in an audit team it does not replace CISA. Match the credential to the work you will be judged on.
• Assuming audit experience counts for CISSP. ISC2 does not pre-approve experience; audit work that never touched security domains may not satisfy an endorser.
• Missing the application windows. CISSP candidates have nine months after passing to submit the endorsement application; CISA candidates have five years after passing to apply. Diarise both.
• Studying CISA as an engineer. The "fix it" answer is often wrong in a CISA question; the right answer usually involves reporting to the appropriate level or gathering more evidence.
• Ignoring independence after a move. Moving from security to audit in the same organisation and then auditing your own former controls undermines the audit, whatever certification you hold.

For hiring managers: writing the requirement

Avoid "CISSP or CISA" as a blanket filter for every security role; it screens in auditors for engineering jobs and engineers for audit jobs.

How to approach it: a phased plan

1. Map your last five years. List each role and tag the work to CISSP domains and CISA domains. Whichever list is fuller is usually your first certification.
2. Confirm eligibility. For CISSP, check whether a degree reduces the requirement by one year; for CISA, check ISACA's waiver article. Decide whether you are aiming for full certification or the Associate of ISC2 or five-year CISA window.
3. Book against the current outline. Read the official outline in the week you book; ISACA lists exam eligibility of six months from registration.
4. Study in the right voice. For CISSP, practise the risk-based, managerial answer. For CISA, practise the auditor's sequence of plan, test, conclude and report.
5. Prepare verification early. Line up an ISC2 endorser, or confirm a supervisor who will verify your ISACA experience.
6. Set up CPE tracking. Track each body's minimums from day one, and tag courses that can count for both.
7. Reassess after 12 to 18 months. Add the second certification only if your role or target role now needs it.

Measuring whether it paid off

• Interview conversion: share of applications for target roles that reach interview, before and after certification.
• Role match: proportion of your working time spent on work in the target domains (design and operation for CISSP, audit engagements for CISA).
• Scope growth: number of audits led, or systems owned, compared with the year before.
• CPE on track: hours logged against the annual minimum for each body.
• Finding quality (CISA holders): share of findings accepted by management without challenge to the evidence.

Framework mapping

For how audit evidence and continuous testing work in practice, see the Audit Evidence and Continuous Controls Monitoring Guide.

Practitioner checklist

• Decide whether your next role builds controls or assesses them before choosing.
• Map your experience to CISSP domains and CISA job practice areas.
• Check the experience window: ten years before application for CISA.
• Confirm fees and outlines on the ISC2 and ISACA sites in the week you book.
• Study in the voice of the exam: manager for CISSP, auditor for CISA.
• Diarise the nine-month CISSP endorsement window or five-year CISA application window.
• Set up CPE tracking against each body's annual minimum.
• Check independence rules in your audit charter before auditing an area you used to run.

Standards and references

• ISACA: CISA Certified Information Systems Auditor
• ISACA: CISA Exam Content Outline
• ISACA: How to Get CISA Certified
• ISACA: IT Audit Framework (ITAF)
• ISC2: CISSP Certified Information Systems Security Professional
• ISC2: CISSP Certification Exam Outline
• ISC2: Member Policies
• US Bureau of Labor Statistics: Information Security Analysts

Related NHI Mgmt Group resources: CISSP Certification Guide · CISA Certification Guide · ISC2 CISSP Concentrations Guide · CISSP vs CISM · Cybersecurity Auditor Career Guide