CISA Study Guide

Why CISA Matters

The Certified Information Systems Auditor (CISA) is the global gold standard for IT audit, control, and assurance professionals. Issued by ISACA since 1978, it remains the most recognized credential in the information systems audit space. Organizations worldwide require CISA-certified professionals to evaluate vulnerabilities, report on compliance, and implement controls across enterprise IT environments.

In 2026, regulatory pressure continues to intensify. Frameworks like SOX, GDPR, DORA, and NIS2 demand qualified auditors who can bridge the gap between technical infrastructure and business governance. CISA holders fill that gap. They sit at the intersection of cybersecurity, risk management, and corporate accountability. If you want to lead audit engagements, advise boards on IT risk, or advance into governance roles, CISA is the credential that opens those doors.

The certification signals more than technical knowledge. It proves you can think like an auditor: systematic, evidence-based, and risk-focused. Employers know this, and they pay accordingly.

Who This Guide Is For

• IT auditors looking to formalize their expertise with an industry-recognized credential
• Cybersecurity professionals transitioning into audit, governance, or compliance roles
• Internal auditors who need to expand their technical assessment capabilities
• Risk and compliance analysts seeking a structured understanding of IT controls
• Career changers with adjacent experience in accounting, finance, or IT management who want to enter the IS audit field

2026 Market Snapshot

Demand for CISA-certified professionals remains strong heading into 2026. Regulatory expansion across financial services, healthcare, and critical infrastructure has created a sustained talent gap. Organizations need auditors who understand cloud environments, AI governance, and third-party risk, not just traditional on-premises controls.

You can view the latest job market data and demand trends on the CISA certification page. The numbers tell a clear story: CISA consistently ranks among the top security certifications by employer demand.

The certification pairs well with other ISACA and (ISC)2 credentials. Many professionals pursue CISA alongside CISM for a governance-focused career track, or combine it with CISSP to cover both audit and security engineering perspectives. The CISA + CISM combination is particularly powerful for professionals targeting CISO or VP of IT Risk roles.

ISACA reports over 170,000 CISA holders globally. Despite this large community, the pass rate hovers around 50%, which keeps the credential’s market value high. Employers trust that CISA holders have demonstrated genuine competency, not just exam memorization.

Salary data reinforces the investment. CISA-certified professionals in the US earn a median base salary exceeding $122,000, with senior audit managers and directors pushing well above $150,000. In regulated industries like banking and insurance, the premium is even higher.

The bottom line: CISA is not a nice-to-have. For IT audit professionals, it is table stakes.

Exam Structure

The CISA exam is a rigorous, scenario-driven assessment. Here is what you need to know about the format.

Domain Weights

The exam covers five domains. Each domain carries a specific weight that determines how many questions you will see.

Domain 5 (Protection of Information Assets) is the heaviest at 27%. Domain 3 (Acquisition, Development, and Implementation) is the lightest at 12%. Allocate your study time accordingly, but do not neglect any domain. The exam can test any topic from any domain.

Key Knowledge Areas by Domain

Domain 1: Information Systems Auditing Process (21%)

• IS audit standards, guidelines, and codes of ethics (ISACA standards)
• Types of audits: compliance, operational, financial, forensic, integrated
• Risk-based audit planning and materiality assessment
• Evidence collection techniques: sampling, CAATs, data analytics
• Audit documentation, reporting, and follow-up procedures
• Control self-assessments and continuous auditing concepts

Domain 2: Governance and Management of IT (17%)

• IT governance frameworks: COBIT 2019, ITIL 4, ISO/IEC 38500
• IT strategy alignment with business objectives
• IT organizational structures, roles, and responsibilities
• IT policies, standards, and procedures lifecycle
• Risk management frameworks and enterprise risk assessment
• IT resource and portfolio management
• Quality assurance and performance monitoring

Domain 3: Information Systems Acquisition, Development, and Implementation (12%)

• SDLC methodologies: waterfall, agile, DevSecOps
• Requirements analysis, feasibility studies, and business case development
• Project management practices and governance
• Application controls: input, processing, output validation
• Testing methodologies: unit, integration, UAT, regression
• Data migration, system conversion, and post-implementation review
• Change management and configuration management controls

Domain 4: Information Systems Operations and Business Resilience (23%)

• IT service management and operations frameworks
• Database administration and data governance
• Incident management and problem management processes
• Business continuity planning (BCP) and disaster recovery planning (DRP)
• RTO, RPO, and recovery strategy design
• Capacity and performance management
• Cloud operations, virtualization, and infrastructure management
• Job scheduling, SLA monitoring, and end-user computing controls

Domain 5: Protection of Information Assets (27%)

• Information security governance and policy frameworks
• Access control models: DAC, MAC, RBAC, ABAC
• Network security architecture: firewalls, IDS/IPS, segmentation, zero trust
• Encryption, PKI, digital signatures, and key management
• Identity and access management (IAM) solutions
• Physical and environmental security controls
• Data classification, handling, and privacy regulations
• Vulnerability management, penetration testing, and security assessments
• Security awareness training and social engineering defenses

10-Week Study Plan

This plan assumes approximately 12 hours per week (125 hours total). Adjust based on your experience level.

Week 1: Foundations and Domain 1 Start

Focus on IS audit standards, ISACA’s code of ethics, and audit planning fundamentals. Read the CISA Review Manual chapters on Domain 1. Complete 50 practice questions on audit methodology. Build your study schedule and gather all materials.

Week 2: Domain 1 Deep Dive

Cover evidence collection, CAATs, sampling methods, and audit reporting. Study real-world audit report structures. Complete 75 practice questions. Focus on understanding when to apply each type of audit procedure.

Week 3: Domain 2 - IT Governance

Study COBIT 2019 framework principles, IT strategy alignment, and governance structures. Understand the board’s role in IT oversight. Complete 75 practice questions. Map governance concepts to your own organization’s structure for practical understanding.

Week 4: Domain 2 Completion and Domain 3 Start

Finish risk management frameworks and IT resource management. Begin SDLC methodologies and project governance. Complete 75 practice questions. Pay special attention to how audit evaluates governance effectiveness.

Week 5: Domain 3 - Acquisition and Development

Cover application controls, testing methodologies, change management, and post-implementation review. Complete 75 practice questions. This domain is the lightest by weight but contains tricky scenario questions about SDLC phase-specific controls.

Week 6: Domain 4 - Operations and Resilience (Part 1)

Focus on IT service management, database administration, incident management, and infrastructure operations. Complete 75 practice questions. Draw diagrams of incident escalation paths and SLA structures to reinforce concepts.

Week 7: Domain 4 - Operations and Resilience (Part 2)

Cover BCP/DRP in depth: RTO, RPO, recovery strategies, testing types. Study cloud operations and virtualization controls. Complete 100 practice questions. BCP/DRP is heavily tested; know the difference between every type of recovery test.

Week 8: Domain 5 - Protection of Information Assets (Part 1)

Study access control models, network security architecture, encryption fundamentals, and IAM solutions. Complete 100 practice questions. This is the highest-weighted domain. Spend extra time here.

Week 9: Domain 5 - Protection of Information Assets (Part 2)

Cover data classification, privacy regulations, vulnerability management, and physical security. Complete 100 practice questions. Review all five domains at a high level. Identify your weakest areas using practice exam analytics.

Week 10: Final Review and Exam Readiness

Take two full-length practice exams under timed conditions (4 hours, 150 questions). Review every incorrect answer thoroughly. Focus remaining study on weak domains. Complete 150 targeted practice questions on weak areas. Rest the day before the exam.

Practice Exam Strategy

Practice questions are the single most important study tool for CISA. Passive reading is not enough.

Recommended Resources

• ISACA QAE Database: The official question bank. Non-negotiable. Purchase it.
• CISA Review Manual (28th Edition): The primary reference text aligned to the current exam.
• ISACA Practice Exams: Full-length simulated exams with domain scoring breakdowns.

Test-Taking Tactics

• Read the full question before looking at answers. CISA questions are scenario-based. The last sentence often contains the actual question.
• Eliminate two answers immediately. Most CISA questions have two clearly wrong options and two plausible options. Narrow it down, then apply audit logic.
• Think like an IS auditor, not an engineer. The correct answer is almost always about identifying risk, recommending controls, or evaluating compliance, not implementing technical fixes.
• Flag and move on. Do not spend more than 90 seconds on any single question. Flag difficult ones and return after completing the full exam.
• Manage your time. 150 questions in 240 minutes gives you 96 seconds per question. Pace yourself through the first 100 questions to bank time for harder ones at the end.

Career Impact

Immediate Benefits

• Instant credibility with audit committees, regulators, and hiring managers
• Qualification for senior audit roles that list CISA as a hard requirement
• Access to ISACA’s global professional network and continuing education resources
• Eligibility for government and defense audit positions (DoD 8570 recognized)

Salary Expectations

CISA-certified professionals in the United States earn a median base salary of $122,000 or more. Senior IS audit managers typically earn $140,000-$170,000. Directors of IT audit and GRC leaders regularly exceed $180,000, particularly in financial services, healthcare, and technology sectors.

Career Pathway

The natural progression for CISA holders follows a governance and risk trajectory:

CISA (IT Audit) -> CISM (Security Management) -> CRISC (Risk and Controls)

This three-certification combination from ISACA covers audit, management, and risk. It positions you for executive roles including CISO, VP of IT Risk, Chief Audit Executive, and board advisory positions. Adding CISSP broadens your profile into security architecture and engineering.

Common Mistakes to Avoid

• Underestimating Domain 5. At 27% of the exam, Protection of Information Assets is the single largest domain. Many candidates over-index on audit process (Domain 1) because it feels most familiar. Rebalance your time toward Domain 5.
• Studying for knowledge instead of application. The CISA exam tests judgment, not memorization. You need to know what an auditor would recommend in a given scenario. Practice scenario-based questions relentlessly.
• Ignoring the ISACA mindset. ISACA has a specific perspective on risk, controls, and audit procedures. The “correct” answer is the one that aligns with ISACA standards, not necessarily what your organization does in practice. Study the official materials.
• Skipping the experience requirement planning. CISA requires 5 years of professional experience in IS audit, control, assurance, or security. Waivers are available: up to 3 years can be substituted with relevant education or certifications. Plan your application timeline before you sit the exam.

Frequently Asked Questions

What are the CISA experience requirements?

CISA requires a minimum of 5 years of professional work experience in information systems auditing, control, assurance, or security. However, ISACA offers waivers for up to 3 years. A 4-year degree substitutes for 2 years. Relevant certifications like CISM or CISSP can substitute for 1 year. Teaching experience in IS audit-related fields can also qualify. You can sit the exam before meeting the experience requirement, but you must fulfill it within 5 years of passing.

How does CISA compare to CISM?

CISA focuses on auditing, evaluating, and assessing IT systems and controls. CISM focuses on managing and governing an organization’s information security program. Think of CISA as the evaluator and CISM as the builder. CISA professionals audit controls; CISM professionals design and manage them. Many professionals earn both. If your career leans toward audit and compliance, start with CISA. If it leans toward security leadership and program management, start with CISM. The combination of both is highly valued for senior governance roles.

How much does the CISA exam cost?

The exam fee is $575 for ISACA members and $760 for non-members. ISACA membership costs approximately $135 per year. If you are serious about the certification, membership pays for itself through the exam discount alone, plus you get access to the ISACA knowledge base, local chapter events, and CPE opportunities. Budget an additional $200-$400 for study materials including the Review Manual and QAE database.

What is the CISA pass rate?

ISACA does not publish official pass rates, but industry estimates place it around 50%. This is consistent with other advanced professional certifications. The scaled scoring model (200-800, passing at 450) means you do not need to answer every question correctly. Focus on consistent competency across all five domains rather than perfection in one area.

How do I maintain my CISA certification?

CISA holders must earn a minimum of 20 continuing professional education (CPE) hours per year, with at least 120 hours over a 3-year reporting cycle. You must also pay an annual maintenance fee ($45 for ISACA members, $85 for non-members). CPE hours can be earned through conferences, training courses, self-study, published articles, mentoring, and ISACA chapter activities. Track your hours diligently; ISACA conducts random audits of CPE compliance.

The Bottom Line

CISA is not a weekend certification. It demands real investment: 125+ hours of focused study, thousands of practice questions, and years of professional experience. But the return is substantial. You gain a credential recognized in every industry, every country, and every boardroom where IT risk is discussed.

The audit profession needs qualified people. Regulatory complexity is accelerating. AI governance, cloud compliance, and third-party risk management are creating new audit domains faster than organizations can fill roles. CISA holders are positioned to lead this expansion.

Start your 10-week plan today. Be consistent. Think like an auditor. Pass the exam. Then go make an impact.

Check the latest CISA demand data and explore related paths with CISM and CISSP.