In this post, I will discuss the CISA certification.
When an organisation needs to know whether its technology, controls and business systems are doing what they are supposed to, it turns to information systems auditors. ISACA’s Certified Information Systems Auditor certification confirms that a professional has the skills this work demands, and it is recognised around the world as a standard of excellence in IS auditing.
ISACA itself calls CISA the gold standard for IS and IT audit certification. This is a position it has held for 45 plus years. Understanding what the credential covers, and what CISA certification training should prepare you for, is the best place to start.
Table of Contents
What CISA Validates
CISA validates the ability to audit, control, monitor and assess an organisation’s information technology and business systems. The exam covers five domains. Information System Auditing Process and Governance and Management of IT each carry 18%. Information Systems Acquisition, Development and Implementation carries 12%, while Information Systems Operations and Business Resilience and Protection of Information Assets each carry 26%.
ISACA updated the exam in August 2024. The five domains remained similar to the previous outline, but the updated outline requires testing of risk, security and controls related to disruptive technologies and emerging IT audit practices.
The exam has 150 multiple-choice questions and the given time is four hours. The CISA exam requires a minimum scaled score of 450 to qualify, which is marked on a scale ranging from 200 to 800. Candidates can flag questions and review their answers before time ends. The exam is available in English, French, German, Hebrew, Italian, Japanese, Korean, Spanish, Turkish and Chinese.
The Skills CISA Builds
The auditing process domain covers IS audit standards, risk-based audit planning, sampling methodology, audit evidence collection, data analytics and reporting. Governance and management of IT covers laws and regulations, enterprise risk management, privacy programmes and principles, data governance and IT vendor management.
The acquisition and implementation domain covers project governance, system development methodologies, system readiness and implementation testing, and post-implementation review. Operations and business resilience covers IT change, configuration and patch management, problem and incident management, business impact analysis, business continuity and disaster recovery. Protection of information assets covers identity and access management, network and endpoint security, data encryption, cloud and virtualised environments, security testing, incident response and evidence collection and forensics.
CISA Training Options from InfosecTrain
Covering that much ground needs structured preparation, and this is where InfosecTrain’s CISA Certification Training fits in. It runs for 40 hours of live instructor-led training, delivered by an ISACA Premium Training Partner. It covers all five domains and the latest 28th edition of CISA, including the changes introduced in the updated exam.
Practice is built into the course. Learners work through real-world scenarios and prepare with the CISA Online Test Engine, then revise using flashcards and mind maps. Sessions are led by industry experts who teach the concepts alongside their practical application.
Support continues after the sessions end. Learners get recorded sessions for revision, a Telegram group for exam support, and post-training support that runs right up to the exam. Classes run in weekday and weekend batches, with one-on-one training on request and corporate training available for teams.
Why IT Audit Skills Matter Now
ISACA’s 2026 Tech Trends and Priorities Pulse Poll surveyed 2,963 digital trust professionals. Only 13% said their organisation is very prepared to manage the risks of generative AI solutions, and 30% said they are not very or not at all prepared. The same poll found that 59% of respondents expect AI-driven cyber threats and deepfakes to be their biggest concern in 2026.
ISACA’s updated CISA outline addresses this area directly by testing risk, security and controls related to disruptive technologies.
Career Opportunities with CISA
CISA can open opportunities for higher roles, better jobs and increased pay. The training is aimed at auditors and professionals working in an audit environment, those planning a career in information systems auditing, IT managers, security managers, system analysts and consultants.
CISA also supports progression within ISACA. An active CISA meets the audit credential requirement for ISACA’s Advanced in AI Audit certification, which focuses on auditing AI systems. A CISA in good standing also counts for a two-year waiver toward the general experience requirement for CISM.
Eligibility Requirements
To become certified, candidates need five years of professional information systems auditing, control, assurance or security work experience. Up to three of those years can be substituted. One year of information systems experience or non-IS auditing experience can replace one year. Completed university study of 60 to 120 semester credit hours, the equivalent of a two-year or four-year degree, can replace one or two years, and a master’s degree in information security or information technology can replace one year.
Candidates can take the exam before meeting the experience requirement. They then have five years from passing to apply for certification, and the experience must be gained within the ten years before applying or within five years after passing.
Maintaining the Certification
CISA holders must earn at least 20 Continuing Professional Education hours every year and 120 hours over each three-year period. Qualifying activities include training sessions, conferences and professional meetings. Holders must also pay an annual maintenance fee and follow ISACA’s Code of Professional Ethics.
Summary
CISA is ISACA’s certification for information systems auditors, covering five domains from the audit process to the protection of information assets. Its updated outline includes risk, security and controls related to disruptive technologies. Candidates need five years of relevant experience, with up to three years available through substitutions, and holders maintain the credential through annual CPE hours.
All new details in the expanded section come from the course page: the weekday and weekend batches, the one-on-one option and corporate training. Nothing unsourced was added.
INTERESTING POSTS
- How To Study For CISA Exam
- A Guide to Cybersecurity Insurance: What It Covers and Why You Need It
- From Solidity to Move: What Security Engineers Should Know Before Switching
- Full Review Of Wondershare Recoverit File Recovery Tool
- How Companies Can Use AI Cybersecurity Tools to Audit Their Defenses
- The Pros And Cons Of Outsourcing Your Cybersecurity Audit
About the Author:
Amaya Paucek is a professional with an MBA and practical experience in SEO and digital marketing. She is based in Philippines and specializes in helping businesses achieve their goals using her digital marketing skills. She is a keen observer of the ever-evolving digital landscape and looks forward to making a mark in the digital space.
