ISACA CISA Certification Guide: CISA Exam Details

The ISACA CISA certification remains the global benchmark for information systems audit professionals. It demands demonstrated proficiency across governance, acquisition, operations, and asset protection domains. Candidates face a rigorous 150-question examination lasting four hours, requiring a scaled score of 450 out of 800 to pass. This guide details every technical requirement, domain weighting, and strategic consideration for the current exam version.

Eligibility Requirements for ISACA CISA Certification

Candidates must possess a minimum of five years of professional information systems auditing, control, or security work experience. ISACA permits specific substitutions: a maximum of three years can be waived through combinations of university education, other certifications, or teaching experience. One year of information systems experience or one year of non-IS auditing experience can substitute for one year of the required five. Two years of full-time university teaching in a related field substitutes for one year. The application for certification is submitted only after passing the examination and requires a separate USD 50 processing fee.

Adherence to the ISACA Code of Professional Ethics is mandatory for all certificate holders. Continuing Professional Education (CPE) credits are required annually to maintain the credential, with a minimum of 20 hours per year and 120 hours over a three-year reporting period. Experience verification is conducted through employer confirmation or, for self-employed individuals, client references. The verification process validates that the claimed experience aligns with the ISACA job practice areas defined in the current syllabus.

Experience Verification and Audit Standards

Verification focuses on the practical application of audit standards, risk assessment methodologies, and control frameworks. Candidates should document specific engagements involving vulnerability evaluation, compliance reporting, and value-added recommendations. The application requires detailed descriptions of roles and responsibilities mapped to the five exam domains. Incomplete or vague descriptions frequently result in requests for clarification, delaying certification issuance.

Domain Architecture of the ISACA CISA Certification Exam

The examination blueprint comprises five domains with distinct weightings. Domain 5 (Protection of Information Assets) and Domain 4 (Information Systems Operations and Business Resilience) each carry 26%, collectively representing over half the exam. Domain 2 (Governance and Management of IT) and Domain 1 (Information Systems Auditing Process) each hold 18%. Domain 3 (Information Systems Acquisition, Development and Implementation) accounts for the remaining 12%. This distribution dictates that study time must prioritize asset protection and operational resilience scenarios.

Domain 5 encompasses information security strategy, identity and access management, cryptography, network and endpoint security, vulnerability management, physical controls, privacy compliance, and incident response. Domain 4 covers IT service management, incident and problem management, backup and recovery, business continuity and disaster recovery, capacity and performance management, database and network operations, and third-party management. Mastery of these two domains is non-negotiable for a passing outcome.

Domain 2 addresses IT governance frameworks, organizational structures, business alignment, policies and standards, resource and investment management, risk management integration, performance monitoring, and project governance. Domain 1 focuses on audit standards and ethics, ISACA guidelines, risk-based planning, engagement management, internal control evaluation, evidence collection with CAATs, and audit reporting. Domain 3 covers business case analysis, project and vendor management, SDLC methodologies, requirements and change management, testing strategies, data migration controls, and post-implementation review.

Governance Auditing Process and Acquisition Lifecycle

While lower weighted, Domains 1, 2, and 3 contain high-yield topics frequently tested through scenario-based questions. Governance questions often examine the relationship between enterprise risk appetite and IT risk tolerance. Auditing process items test the application of risk-based planning to specific engagement scenarios. Acquisition questions focus on control integration during the SDLC phases, particularly change management and data migration integrity. Neglecting these domains creates vulnerability to the breadth of the examination.

Examination Specifications and ISACA CISA Certification Cost

The exam consists of 150 multiple-choice questions administered over a 240-minute window. The scaled scoring range is 200 to 800, with a passing mark fixed at 450. The exam is delivered via computer-based testing at authorized centers or through remote proctoring. Questions are scenario-driven, requiring the application of audit standards and control frameworks to specific organizational contexts rather than rote definition recall. The exam content aligns with the 2024 CISA job practice reflecting current digital risk and governance practices.

The ISACA CISA certification cost is USD 575 for ISACA members and USD 760 for non-members. This fee covers the examination sitting only. A separate USD 50 application processing fee applies after passing the exam to issue the certification. Pricing is consistent globally in USD; candidates in India or other regions pay the equivalent USD amount plus applicable local taxes. Retake fees mirror the initial registration cost. Scheduling is managed through PSI or Prometric testing centers depending on region.

Score Verification and Reporting

Score reports provide a pass/fail result and a performance breakdown by domain represented as a quartile ranking (top, middle, bottom). ISACA does not publish raw scores or percentage correct per domain. Employers or third parties can request verification of an individual's certification status through the official ISACA verification portal. This service confirms the credential holder's name, certification number, and active status without disclosing exam scores.

These figures are summarized from the official exam guide published by ISACA (checked 2026-09-28). Confirm the current version, cost, and format there before you register.

Preparation Strategy for ISACA CISA Certification

A three-phase approach optimizes readiness: diagnostic assessment, targeted study using official materials, and timed practice examinations. Candidates should begin with a domain-level gap analysis to allocate study hours proportionally to the 26/26/18/18/12 weighting. The ISACA Review Manual, Questions, Answers & Explanations (QAE) database, and official practice exams constitute the authoritative content base. Supplemental training courses should be evaluated for alignment with the current job practice rather than marketing claims.

Free resources provided by ISACA include the exam candidate guide, glossary of terms, and select white papers on emerging technologies. These are necessary but insufficient for comprehensive coverage. Commercial training varies significantly in quality; effective programs emphasize scenario deconstruction over content lecturing. Candidates should complete at least three full-length practice exams under strict 240-minute conditions to calibrate pacing and endurance.

Certilum addresses this gap through its 3-Form validation and infinite question regeneration with changing variables, forcing candidates to apply concepts rather than recall answers. This approach mitigates the illusion of competence created by repetitive exposure to static question banks.

Cognitive Load Management for ISACA CISA Certification

The cognitive load is high due to the volume and breadth of content spanning governance frameworks, technical controls, operational procedures, and audit methodologies. The exam focuses on application and interpretation rather than memorizing technical specifications. Candidates must synthesize information across domains — for example, evaluating how a business continuity decision in Domain 4 impacts asset protection controls in Domain 5 and audit evidence requirements in Domain 1.

Managing mental stamina across 240 minutes is a distinct competency. Fatigue degrades situational judgment, particularly in the final quartile of the exam. Pacing strategies should target approximately 1.6 minutes per question, reserving 20 minutes for review of flagged items. Nutrition, hydration, and micro-breaks (eyes closed, deep breathing) during the exam are tactical necessities, not optional comforts.

The Certilum Readiness Engine applies a four-pillar algorithm measuring response latency and mental stamina across 240-minute simulations, tracking knowledge mastery, cognitive retention, response precision, and endurance. This diagnostic identifies performance decay curves invisible to standard practice tests.

Community Insights and Practical Application

Professional forums provide unfiltered feedback on exam reality. As frequently shared in professional discussions on Reddit, rote memorization fails on situational questions; candidates must understand the rationale behind control selection and audit procedure choice. The consensus emphasizes that the Review Manual and QAE database are primary sources, while third-party materials serve only as supplements for exposure to varied scenario phrasing.

The credential signals competence to employers in internal audit, external audit, compliance, and security management roles. It is frequently a prerequisite for senior IS auditor positions and regulatory compliance mandates. The practical value lies in the structured framework it provides for approaching unstructured business problems — a skill directly transferable to daily operational challenges.

Reddit Consensus on Resource Allocation

Discussions on Reddit consistently highlight the Review Manual and QAE database as primary sources, supplementing with third-party mock exams only for timing practice. Candidates report that over-reliance on video courses correlates with difficulty in applying concepts to novel scenarios presented in the live exam. The community stresses active recall through question deconstruction over passive content consumption.

Mastery of the CISA domains requires more than content familiarity; it demands the ability to apply audit standards under time pressure across diverse technological environments.

Key Takeaways

The ISACA CISA certification exam comprises 150 multiple-choice questions over 240 minutes with a passing score of 450 out of 800. The fee is USD 575 for members and USD 760 for non-members plus a USD 50 application fee. Domain 5 and Domain 4 constitute 52% of the exam weight, covering asset protection and operational resilience. Five years of relevant experience are required for certification issuance.

Failing to measure domain-level readiness before exam day risks the USD 760 non-member fee and the 240-minute testing investment. Certilum provides a Readiness Score to validate domain-level preparation before committing to the USD 760 non-member exam fee and the 240-minute testing session. Explore the CISA readiness diagnostic.