CISM Certification Guide 2026: New Exam Outline, Cost and How to Pass
CISM changed on November 3, 2026. See the new domain weights, exam format, fees, experience rules and a 12-week plan to pass the...
Read article
CISA Certification Guide 2026: Exam, Cost, Domains and How to Pass
By Nitin Dhiman · Published on November 13, 2026
Auditors with a CISA earn a seat in the room where IT risk gets decided, and audit firms, banks and federal contractors across the US keep asking for it. But the exam is four hours long, the experience rules have fine print, and the fees add up. This CISA certification guide gives you the 2026 facts in one place: what the exam covers, what it costs, who qualifies, and a 10-week plan to pass on the first try.
Quick answer
- CISA (Certified Information Systems Auditor) is ISACA's certification for IT audit, control and assurance.
- Exam: 150 multiple-choice questions in 4 hours. Pass mark: 450 on a 200 to 800 scale.
- Exam fee: US$575 for ISACA members, US$760 for non-members, plus a US$50 application fee after you pass.
- To certify you need 5 years of IS audit, control, assurance or security experience. Up to 3 years can be waived.
- You can take the exam first and apply for certification within 5 years of passing.
What is the CISA certification?
CISA, short for Certified Information Systems Auditor, is the best-known certification for people who audit, control and assure an organization's information systems. It is issued by ISACA, has been around since 1978, and is approved for several advanced roles under the US Department of Defense DoD 8140 framework.
CISA fits IT auditors, internal auditors, compliance and risk analysts, SOX and SOC 2 specialists, IT governance staff, and security professionals who want to move into assurance work.
CISA exam format at a glance
| Detail | CISA exam (2026) |
|---|---|
| Questions | 150 multiple choice |
| Time | 4 hours (240 minutes) |
| Passing score | 450 on a scaled 200 to 800 |
| Delivery | PSI test center or online remote proctoring |
| Exam fee | US$575 ISACA member, US$760 non-member |
| Application fee | US$50, once, after you pass |
| Content outline | Job practice effective August 1, 2024, still current in 2026 |
The 5 CISA domains and their weights
The CISA exam follows five domains. More than half of the questions come from domains 4 and 5, so they deserve most of your study time.
| Domain | Weight | Questions |
|---|---|---|
| 1. Information System Auditing Process | 18% | ~27 |
| 2. Governance and Management of IT | 18% | ~27 |
| 3. Information Systems Acquisition, Development and Implementation | 12% | ~18 |
| 4. Information Systems Operations and Business Resilience | 26% | ~39 |
| 5. Protection of Information Assets | 26% | ~39 |
Question counts are approximate. The exam tests judgment, not memory: many questions ask what an auditor should do FIRST or what is the BEST control, and several answers can be true. Thinking like an auditor, independent and evidence-based, is the skill to practise.
CISA requirements: who qualifies?
Anyone can sit the exam. To become certified after you pass, you need five years of work experience in IS audit, control, assurance or security, gained in the 10 years before you apply or within 5 years after passing.
Up to three years can be substituted, but at least two years must be direct experience. Common waivers:
- 1 year for an associate degree, or for one year of general audit or information systems work
- 2 years for a bachelor's, master's or doctorate in any field
- 3 years for a master's in information systems or a related field
- 2 years for full CIMA certification or ACCA membership
You also agree to ISACA's Code of Professional Ethics and its continuing education policy.
How much does CISA cost?
| Cost | ISACA member | Non-member |
|---|---|---|
| Exam registration | US$575 | US$760 |
| Application fee (after passing) | US$50 | US$50 |
| Annual maintenance fee | US$45 | US$85 |
Membership saves US$185 on the exam and lowers the yearly maintenance fee, so many US candidates join ISACA before registering. Check the membership price for your country first. Retakes cost the full exam fee again, which is the best reason to book only when your practice scores are steady.
How to pass CISA: a 10-week study plan
Most candidates study 100 to 150 hours. At 10 to 12 hours a week, this plan gets you there in 10 weeks:
| Weeks | Focus |
|---|---|
| 1 | Read the job practice, take a baseline practice test, and list weak domains |
| 2 to 3 | Domain 1 (auditing process) and Domain 2 (governance), the auditor mindset |
| 4 | Domain 3 (acquisition, development and implementation) |
| 5 to 6 | Domain 4 (operations and business resilience): BCP, DR, incident and change management |
| 7 to 8 | Domain 5 (protection of information assets): access, encryption, network and cloud security |
| 9 | Two full 150-question practice exams under a 4-hour timer; review every wrong answer |
| 10 | Revise weak domains, then book the exam when you score 75% or more twice |
Start with a free CISA practice test
See where you stand in 4 hours: 150 questions, every answer explained, and your score by domain.
CISA vs CISM vs CISSP
| CISA | CISM | CISSP | |
|---|---|---|---|
| Focus | IT audit and assurance | Security management | Security architecture and operations |
| Issuer | ISACA | ISACA | ISC2 |
| Exam | 150 questions, 4 hours | 150 questions, 4 hours | 100 to 150 questions (adaptive), 3 hours |
| Experience | 5 years IS audit, control or security | 5 years security management | 5 years in 2 of 8 security domains |
| Best for | Auditors, GRC and compliance | Security managers, future CISOs | Security engineers and architects |
If you audit controls, choose CISA. If you run a security program, see our CISM certification guide. Many GRC professionals hold both, CISA first.
Keeping your CISA: CPE rules from 2027
CISA holders earn 120 continuing professional education (CPE) hours every three years, with at least 20 each year, and pay the annual maintenance fee. From January 1, 2027, the 120-hour total stays, but at least 90 of those hours must relate to CISA topics, and up to 30 can be broader professional CPE such as leadership. Vendor sales demos no longer count.
Frequently asked questions
Is CISA hard to pass?
It is a demanding exam because questions test auditor judgment, not memorised facts. Candidates who practise full-length timed exams and review every wrong answer pass far more often than those who only read the review manual.
Can I take the CISA exam without experience?
Yes. Anyone can sit the exam. You need five years of relevant experience (up to three can be waived) to apply for certification, and you have five years after passing to apply.
How much does the CISA exam cost in 2026?
US$575 for ISACA members and US$760 for non-members, plus a one-time US$50 application fee after you pass and an annual maintenance fee.
How many questions are on the CISA exam?
150 multiple-choice questions in 4 hours. You need a scaled score of 450 out of 800 to pass.
How long does it take to prepare for CISA?
Most candidates need 100 to 150 hours, which is about 10 to 12 weeks at 10 to 12 hours a week. Experienced auditors often need less.
Is CISA worth it in the US?
Yes for audit, compliance and GRC careers. Many US employers, audit firms and federal contractors list CISA in job postings, and it is approved for advanced roles under DoD 8140.
What is the difference between CISA and CISM?
CISA is about auditing and assuring IT controls. CISM is about managing an information security program. Auditors usually start with CISA; security managers with CISM.
Exam facts checked November 2026. ISACA updates fees and rules, so confirm on isaca.org before you register.
