On this page
YOUR CISA STUDY COMPANION
CISA Study Center & Exam Guide
Prepare for the Certified Information Systems Auditor exam with a current five-domain blueprint, audit-focused study routes, official exam facts, and a practical four-week plan.
MEET THE EXAM
What the CISA exam measures
ISACA’s Certified Information Systems Auditor exam evaluates practical judgment across information-systems auditing, IT governance, technology change, operations, resilience, and information-asset protection.
The current CISA outline is effective August 2024. Check ISACA’s live exam page and candidate guide before registering; exam fees, scheduling, and procedures can change.
CURRENT ISACA EXAM INFORMATION
How the CISA exam is structured
Computer-based exam
The exam has 150 multiple-choice questions and a four-hour time limit. ISACA offers authorized PSI testing-center appointments and remote proctoring; confirm current availability and technical requirements before choosing.
Scaled score and pretest items
ISACA reports a scaled score from 200 to 800. A score of 450 or higher passes. Pretest items are included in ISACA exams and do not count toward the score; answer every item as if it is scored.
Domain feedback
Domain-level results help identify study gaps, but they are informational. The overall scaled score determines whether you pass; domain percentages are not separate pass thresholds.
Registration establishes a six-month eligibility window to sit for the exam. Verify current scheduling, rescheduling, remote-proctoring, and retake policies in the candidate guide.
EXAM FIRST · CERTIFICATION REQUIREMENTS FOLLOW
Understand the CISA exam and certification path
You may take the exam before qualifying for certification
ISACA says the CISA exam is open to anyone interested in information security. You can sit for and pass the exam before you have the experience needed for the full credential.
Full certification requires relevant experience
To apply for CISA certification, ISACA currently requires at least five years of professional information-systems auditing, control, or security work experience, subject to its published rules. The experience must fall within the applicable window.
Plan the application timeline
After passing, candidates have five years to apply for certification. Review ISACA’s current application requirements, experience-verification process, ethics obligations, and continuing professional education rules.
Exam eligibility and CISA certification eligibility are different. Use ISACA’s current requirements to assess substitutions, experience windows, application timing, and maintenance.
YOUR CONTENT MAP · ISACA OUTLINE
Plan review across the five CISA domains
Balance preparation by the official domain ranges, then practice choosing the best action for an auditor in context. CISA questions often ask for the most appropriate next step, strongest evidence, or best recommendation—not a memorized definition alone.
| Domain | Exam weight | Study focus |
|---|---|---|
| Information System Auditing Process | 18% | Risk-based planning, audit standards, testing and sampling, evidence collection, analytics, reporting, and quality improvement. |
| Governance and Management of IT | 18% | IT strategy and governance, enterprise risk, privacy and data governance, policies, resource and vendor management, and performance. |
| Information Systems Acquisition, Development and Implementation | 12% | Project governance, feasibility, development methods, control design, readiness and implementation testing, conversion, release, and post-implementation review. |
| Information Systems Operations and Business Resilience | 26% | IT operations and assets, interfaces, change and incident management, service levels, capacity, business impact analysis, continuity, backup, and disaster recovery. |
| Protection of Information Assets | 26% | Security frameworks, access control, networks and endpoints, encryption, cloud, data loss prevention, monitoring, incident response, and forensics. |
Weights come from ISACA’s CISA Examination Content Outline effective August 2024. They describe exam coverage; they are not guaranteed question counts or separate passing scores.
PICK A DIRECTION
Choose a study route that fits your gaps
Begin with a diagnostic and label every miss as a knowledge gap, a weak audit decision, or a misread scenario. Track domain, evidence needed, and why the best answer protects organizational objectives.
Map the blueprint
Rate yourself against all five domains and schedule time by official weight.
Practice audit judgment
For each scenario, identify the objective, risk, control, and evidence before choosing an action.
Connect systems to business
Trace how technology changes affect governance, operations, resilience, and business outcomes.
Review the recommendation
Explain why the best answer is timely, evidence-based, independent, and proportionate to risk.
Spend the most review time on Domains 4 and 5, which together represent 52% of the outline, while keeping audit process and governance in regular rotation.
A ROUTINE YOU CAN ADAPT
A four-week CISA study plan
Use a pace you can sustain. Reserve time to revisit missed and guessed questions, and keep a short log of the reasoning behind each answer.
Read the current outline, take a diagnostic, and review risk-based planning, audit evidence, testing, sampling, analytics, and reporting.
Study IT governance, enterprise risk, privacy and data governance, project controls, acquisition, development, implementation, and release.
Review operations, change and incident management, resilience, continuity, access, network and endpoint controls, and security monitoring.
Complete timed mixed sets, compare gaps with domain weights, revisit weak decisions, and confirm exam-day requirements in the candidate guide.
Use authorized preparation materials. Do not copy, share, or seek secure ISACA exam questions.
OFFICIAL EXAM INFORMATION · INDEPENDENT STUDY TOOLS
CISA practice and study resources
Use ISACA for current specifications, registration, eligibility, and preparation options. Independent study tools can help identify gaps; compare their coverage with the current outline.
ISACA CISA exam information
Review exam details, registration steps, delivery options, preparation guidance, and certification path.
Official CISA content outline
Read the five domains, weights, tasks, and secondary classifications for the current exam.
ISACA candidate guide
Confirm current exam scheduling, score reporting, retakes, test-day rules, and candidate procedures.
ISACA free practice quiz
Try a short official sample quiz and review the explanations for your choices.
Mometrix CISA study guide
Explore Mometrix’s CISA Exam Secrets guide and compare its coverage with ISACA’s current outline.
ISACA exam preparation
Explore current official review courses, study resources, and question database options.
CISA® and ISACA® are marks of ISACA. This independent study center is not affiliated with or endorsed by ISACA or PSI.
QUICK ANSWERS
CISA exam questions, answered
How many questions are on the CISA exam?
ISACA lists 150 multiple-choice questions for the current CISA exam.
How long is the CISA exam?
The current exam time limit is four hours (240 minutes).
What score do I need to pass CISA?
ISACA reports scaled scores from 200 to 800. A score of 450 or higher is passing.
What are the CISA exam domains?
The five domains are Information System Auditing Process; Governance and Management of IT; Information Systems Acquisition, Development and Implementation; Information Systems Operations and Business Resilience; and Protection of Information Assets.
Can I take the exam before I have the required work experience?
Yes. ISACA permits candidates to take the exam before meeting the experience requirement for full CISA certification. The experience requirement still applies when you apply for certification.
Is a passing exam score the same as becoming CISA certified?
No. Passing the exam is one requirement. Full certification also requires qualifying work experience and the other current ISACA application and maintenance requirements.
Can I take the CISA exam remotely?
ISACA’s candidate guide describes authorized PSI testing centers and remote proctoring. Check the live scheduling and remote-proctoring guidance before registering.
Is this an official ISACA website?
No. This is an independent educational study center. ISACA is the source for official exam information, eligibility, and certification rules.
CHECK THE SOURCE
Official sources and update notes
Exam facts use ISACA’s current CISA exam page, the outline effective August 2024, and the 2026 candidate guide. Confirm live requirements and scheduling instructions before registering.
- ISACA CISA exam and credential page — exam details, registration, and certification path.
- ISACA CISA Examination Content Outline — five domains and weights; effective August 2024.
- ISACA Certification Exams Candidate Guide — exam administration, scoring, retake policy, and Appendix A CISA outline.
- ISACA CISA practice quiz — short official sample quiz.
- Mometrix CISA Exam Secrets study guide — independent provider study resource.
Reviewed October 15, 2026. This independent exam-preparation resource is educational material and does not guarantee certification or exam results.