Exam Guide
The CISA certification is administered by ISACA and is the gold-standard credential for information systems audit, control, and security professionals. Earning the CISA demonstrates expertise in assessing vulnerabilities, reporting on compliance, and instituting controls within an enterprise.
150
Questions
4 Hours
Time Limit
5
Exam Domains
$575
Exam Fee (Members)
IT audit standards, guidelines, and best practices. Covers audit planning, execution, evidence gathering, reporting, and follow-up. Includes risk-based audit planning and sampling methodologies.
IT governance frameworks, IT strategy, policies, organizational structure, and enterprise architecture. Covers IT resource and performance management, quality assurance, and compliance.
Business case analysis, project governance, SDLC methodologies, system migration, and change management. Covers requirements analysis, testing, and post-implementation review.
IT service management, infrastructure operations, database administration, and IT asset management. Covers business impact analysis, disaster recovery, and business continuity planning.
Information security frameworks, access controls, network security, data classification, and encryption. Covers vulnerability management, incident response, and security awareness training.
Experience: 5 years of professional experience in information systems auditing, control, or security work.
Education Substitutions: A maximum of 3 years may be substituted with a relevant university degree (e.g., a bachelor's counts for 2 years, a master's for 1 additional year).
Alternative Experience: Up to 2 years of general IS or auditing experience, or a related certification such as CISM, CRISC, or CIA, may be substituted for CISA experience.
Continuing Education: CISA holders must earn 20 CPE hours annually and 120 CPE hours over a 3-year certification period to maintain the credential.
The CISA exam consists of 150 multiple-choice questions to be completed in 4 hours. It is computer-based and administered at PSI testing centers worldwide on a year-round basis. The exam uses a scaled scoring system from 200 to 800, and a score of 450 or higher is required to pass. The approximate pass rate is 50%, making thorough preparation essential.
Most successful candidates study for 8 to 12 weeks, focusing heavily on Protection of Information Assets (27%) and IS Operations and Business Resilience (23%), which together make up half the exam. Practice exams that mirror the real test format are critical for building time management skills across 150 questions in 4 hours.
CISApractice provides hundreds of practice questions, timed mini exams, and full-length 150-question simulations covering all five CISA domains with the exact weighting used on the real exam.