ISACA
CISA
Certified Information Systems Auditor
The leading certification for IT auditors, assurance, and control professionals. Frequently required or preferred for IT audit, risk, and compliance roles and carries a strong wage premium.
Full program: 5 decks, 1,072 cards.
What's on the exam
CISA Exam Content Outline (job practice effective 1 August 2024; unchanged in ISACA's 2026 Exam Candidate Guide)
Information System Auditing Process
18%IS audit standards, guidelines, and codes of ethics · Types of audits, assessments, and reviews · Risk-based audit planning · Types of controls and considerations · Audit project management · Audit testing and sampling methodology · Audit evidence collection techniques · Audit data analytics · Reporting and communication techniques · Quality assurance and improvement of the audit process
Governance and Management of IT
18%Laws, regulations, and industry standards · Organizational structure, IT governance, and IT strategy · IT policies, standards, procedures, and practices · Enterprise architecture · Enterprise risk management · Privacy program and principles · Data governance and classification · IT resource management · IT vendor management · IT performance monitoring and reporting · Quality assurance and quality management of IT
Information Systems Acquisition, Development, and Implementation
12%Project governance and management · Business case and feasibility analysis · System development methodologies · Control identification and design · System readiness and implementation testing · Implementation configuration and release management · System migration, infrastructure deployment, and data conversion · Post-implementation review
Information Systems Operations and Business Resilience
26%IT components · IT asset management · Job scheduling and production process automation · System interfaces · Shadow IT and end-user computing · Systems availability and capacity management · Problem and incident management · IT change, configuration, and patch management · Operational log management · IT service level management · Database management · Business impact analysis · System and operational resilience · Data backup, storage, and restoration · Business continuity plan · Disaster recovery plans
Protection of Information Assets
26%Information asset security frameworks, standards, and guidelines · Physical and environmental controls · Identity and access management · Network and end-point security · Data loss prevention · Data encryption · Public key infrastructure · Cloud and virtualized environments · Mobile, wireless, and Internet-of-Things devices · Security awareness training and programs · Information system attack methods and techniques · Security testing tools and techniques · Security monitoring tools and techniques · Security incident response management · Evidence collection and forensics
Frequently asked questions
How much does the CISA cost?
The CISA costs $575. US$575 for ISACA members, US$760 for non-members; plus a US$50 certification application processing fee.
How long is the CISA and how many questions does it have?
150 items — 4 hours.
What do you need to pass the CISA?
450 on a scale of 200–800.
Can you retake the CISA?
Up to 4 attempts in a rolling 12-month period (30/90/90-day waits).
What is the best way to study for the CISA?
Start from the official outline and your primary study materials: the exam is weighted by domain (Information System Auditing Process 18%, Governance and Management of IT 18%, Information Systems Acquisition, Development, and Implementation 12%, Information Systems Operations and Business Resilience 26%, Protection of Information Assets 26%). Once you've learned the material, spaced-repetition flashcards organized by those domains are an efficient way to retain it and refresh it before test day.
Ready to prepare?
Our CISA — Certified Information Systems Auditor program is organized by this outline's domains and scheduled by spaced repetition, with a path from first card to test day.
Flashcards are a memory tool. Learn the material first, then use NoReread to retain it and refresh what you already know. It doesn't replace studying the subject.