Certified Information Systems Auditor (CISA)
Offered by ISACA
Certified Information Systems Auditor (CISA) from ISACA is the credential for people who audit, control, and assure information systems. It validates the ability to assess how an organization governs IT, acquires and operates systems, and protects information assets.
EXAM AT A GLANCE
Format
150 multiple-choice questions
Testing time
240
minutes
Sections
5
Delivery
PSI test center or online remote proctored
Passing score
450
Cost
$575 / $760
Your Certified Information Systems Auditor (CISA) Community
Connect with other people preparing for the Certified Information Systems Auditor (CISA).
Not ready to host?
We’ll email you when someone else starts a Certified Information Systems Auditor (CISA) group.
We’ll email you when a study group is created for Certified Information Systems Auditor (CISA).
What the exam covers
Information Systems Auditing Process
18%
Governance and Management of IT
18%
Information Systems Acquisition, Development and Implementation
12%
Information Systems Operations and Business Resilience
26%
Protection of Information Assets
26%
About the Certified Information Systems Auditor (CISA) certification
The current exam follows ISACA's five-domain job practice. Passing it is one step. Certification also requires the experience application, ISACA's Code of Professional Ethics, the Information Systems Auditing Standards, and continuing education.
Who it’s for
- Information systems and IT auditors
- Assurance and control professionals
- Security practitioners who assess systems rather than run a security program
- Testing time
- 240 minutes (4 hours)
- Passing score
- 450 on a scale of 200–800 (scaled)
- Cost
- $575 (ISACA member) / $760 (non-member), USD, plus a $50 application fee to certify
- Validity
- 3 years; maintain with 120 CPE hours (20/year)
- Prerequisites
- 5 years of professional information systems auditing, control, or security work experience
- That experience must be gained within the 10 years before you apply
- You can take the exam first and apply within 5 years of passing
Official exam page· Details verified October 2026
Exam details can change. Always confirm current requirements, fees, and exam policies with the certification provider before registering.
How to prepare
01
Study ISACA's five job-practice domains, prioritizing Operations and Business Resilience (26%) and Protection of Information Assets (26%).
02
Learn to answer from an auditor's perspective: risk, control, and evidence.
03
Use the ISACA review manual and question database.
04
Practice scenario questions on the audit process, IT governance, and protection of information assets.
05
Document your qualifying experience for the certification application after passing.
FAQ
Can I take the CISA exam before I have 5 years of experience?
Yes. You can sit the exam first. You then have five years from the passing date to apply, once you meet the experience requirement.
How is CISA different from CISM?
CISA is about auditing, controlling, and assuring information systems. CISM is about managing and governing an information security program.
What score do I need to pass?
450 or higher on ISACA's 200–800 scale. That scaled score is the minimum standard of knowledge, not a raw percentage of questions correct.
Turn your exam date into a Certified Information Systems Auditor (CISA) study plan
Tell us when you're taking the Certified Information Systems Auditor (CISA) and when you're available to study. We'll build a personalized schedule you can add to your calendar.
Build My Certified Information Systems Auditor (CISA) Study Plan