CISA Certification Exam Domains Explained: Weights, Format and Experience Rules
Reach 50,000+ security professionals
Sponsor a newsletter slot and put your brand in front of CISOs, engineers, and IT decision-makers.
The CISA certification from ISACA covers five domains, and Information Systems Operations and Business Resilience and Protection of Information Assets are 26% each, so together they make up 52% of the 150-question exam. ISACA requires five years of information systems auditing, control or security experience gained within the ten years before you apply. This guide explains each domain, the exam format, the experience rules and how to study. It is about the Certified Information Systems Auditor credential, not CISA the US Cybersecurity and Infrastructure Security Agency. All facts come from ISACA's published pages, and the domain summaries are our own wording.
CISA the Certification Versus CISA the Agency
This guide is about the Certified Information Systems Auditor (CISA) credential from ISACA. It is unrelated to CISA, the US Cybersecurity and Infrastructure Security Agency, whose Known Exploited Vulnerabilities catalog our other guides cover.
The Five CISA Domains and Their Weights
ISACA's exam content outline lists five domains. Domains 4 and 5 together are 52% of the exam.
| Domain | Name | Weight | What it covers |
|---|---|---|---|
| 1 | Information System Auditing Process | 18% | Planning and performing IS audits to a recognized standard, gathering evidence, reporting results and following up on findings |
| 2 | Governance and Management of Information Technology | 18% | IT governance and strategy, policies and standards, risk management, and how IT is organized and managed |
| 3 | Information Systems Acquisition, Development and Implementation | 12% | Project management, the systems development lifecycle, and the controls that apply when systems are acquired, built and put into use |
| 4 | Information Systems Operations and Business Resilience | 26% | IT operations and infrastructure, data management, and the business continuity and disaster recovery that keep operations running |
| 5 | Protection of Information Assets | 26% | Information security frameworks, access control, network and data security, and how security controls are tested |
The summaries are our own wording of the outline, and ISACA's exam content outline is the authoritative source.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Exam Format
ISACA says the CISA exam consists of 150 questions. It is computer-based and delivered either at authorized PSI testing centers or through remote proctoring, and it is offered in several languages, including English, Chinese, Spanish, Japanese, French, German and Korean.
ISACA's exam page does not state the time limit or the scoring scale in the page text, so read ISACA's current candidate guide for those details before you book. Third-party sites quote figures for both, but we have not verified them against ISACA.
Experience Requirements
ISACA requires five years of professional information systems auditing, control or security work experience, in line with the CISA job practice areas, gained within the ten years before you apply for the certification. After you pass the exam, you have five years from the passing date to apply. Check ISACA's current rules for any experience waivers and for the application process.
How to Study for CISA
CISA questions usually ask what an auditor should do first or which finding matters most, so the answer is often about process, evidence and risk, not technical depth.
Think like an auditor, not an administrator
Many questions ask what an auditor should do, which usually means gathering evidence, assessing risk and reporting, not fixing the problem directly.
Weight your time by domain
Spend the most time on Domains 4 and 5 at 26% each, and make sure Domains 1 and 2 at 18% each are solid, since audit process is the lens for everything else.
Learn the vocabulary of controls and risk
Control types, risk responses and business continuity terms appear across several domains, so a solid vocabulary pays off everywhere.
Practice scenario questions
Work through scenarios with several plausible answers and explain why the best one is best and why the others are weaker.
Space your review
A widely cited review of learning techniques rated practice testing and spaced review as high utility, so revisit each domain several times instead of studying it once.
Where CISA Fits Among Security Certifications
CISA targets audit, control and assurance roles, while the CISSP targets security leadership and CompTIA's certifications target technical practitioners. See our guides to the CISSP domains and the CISSP vs CISM vs CEH comparison for how the senior credentials compare.
Studying With DD Academy
DD Academy covers CISA with flashcards, practice questions and an AI tutor that explains every answer, alongside Security+, Network+, CySA+, PenTest+, SecurityX and CISSP. It is free to start on iPhone and the web.
The bottom line
Treat CISA as an auditor's exam: think about evidence, risk and process, weight your study toward Domains 4 and 5 without neglecting audit process, and check ISACA's candidate guide for the current time limit and scoring before you book.
Frequently asked questions
What are the five CISA domains?
Information System Auditing Process (18%), Governance and Management of IT (18%), Information Systems Acquisition, Development and Implementation (12%), Information Systems Operations and Business Resilience (26%), and Protection of Information Assets (26%).
How many questions are on the CISA exam?
ISACA says the CISA exam consists of 150 questions. For the time limit and scoring details, read ISACA's current exam candidate guide, since ISACA's exam page does not state them in the page text.
How much experience do you need for CISA?
ISACA requires five years of professional information systems auditing, control or security experience, gained within the ten years before you apply for the certification. After passing the exam you have five years from the passing date to apply.
Is the CISA certification the same as CISA the agency?
No. The CISA certification is the Certified Information Systems Auditor credential from ISACA. CISA the agency is the US Cybersecurity and Infrastructure Security Agency, which is unrelated to the certification.
Which CISA domains are weighted the most?
Domain 4, Information Systems Operations and Business Resilience, and Domain 5, Protection of Information Assets, are each 26% of the exam, so together they make up 52%.
Where is the CISA exam taken?
ISACA says the exam is computer-based and delivered at authorized PSI testing centers or through remote proctoring. Check ISACA's exam page for current scheduling, languages and rules.
Is CISA a good certification for security professionals?
It depends on your role. CISA targets audit, control and assurance work, so it suits auditors and security professionals who work with compliance and risk. Technical practitioners often choose other credentials, such as those in our CompTIA path guide.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Daily briefings + Google Top Stories in one step.
Enter your email and we'll subscribe you to the daily briefing and add Decryption Digest to your Google Search feed at the same time.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.
