CISA
ISACA Certified Information Systems Auditor
Created per CertMap methodology · Updated 12 May 2026 · About the editorial team →
▾ Jump to …4 sections
Overview
What is CISA?
The CISA has been considered the gold standard for IT auditors and audit professionals worldwide for decades. It covers the entire lifecycle of IS audits, from planning through execution to reporting, and is in high demand in regulated industries such as banking, insurance, and the public sector. The certification requires five years of relevant professional experience, clearly positioning it as a senior-level credential. For career changers from IT, it serves as a springboard toward governance and compliance. The CISA is recognized globally by employers and regulators and is nearly ubiquitous in job postings for IT audit roles.
Quick facts
Key details
Cost, prerequisites, exam & renewal
Cost over 5 years
Prerequisites
5 years of experience in IS audit, control, or security. Up to 3 years may be substituted through education/certifications.
Exam format
150 multiple-choice questions, 4 hours, proctored via PSI. Passing score: 450/800.
Renewal & maintenance
Valid for 3 years. 20 CPE hours/year (min. 120 over 3 years) + annual AMF (45 USD Member / 85 USD Non-Member).
Classification
CertMap score and matching roles
Rating
Matching NICE roles
Mapping from NIST NICE Framework SP 800-181, status 2025. NIST source ↗
More certifications
More certifications
From ISACA
AAIAAdvanced in AI AuditAAIRAdvanced in AI RiskAAISMAdvanced in AI Security ManagementCCOACertified Cybersecurity Operations AnalystCDPSECertified Data Privacy Solutions EngineerCGEITISACA Certified in the Governance of Enterprise ITCISMISACA Certified Information Security ManagerCRISCISACA Certified in Risk and Information Systems ControlThis page follows CertMap methodology: editorial content is curated by hand. Score, costs and NICE mapping are aggregated from official provider documents. Score methodology → · TCO methodology →
Transparency: CertMap is operated by Daniel Thomas Heessel, who is also managing director of Threat‑Informed, a company specialising in Threat‑Informed Defense. He additionally offers consulting services on CertMap. CertMap currently receives no commissions from certification providers, no affiliate links, no sponsored placements. Podcast and interview guests are not paid for appearances and receive no affiliate commissions.
From the knowledge base
View all articles →About the CertMap editorial team
CertMap is an independent platform for comparing cybersecurity certifications, built on data-journalism standards that combine editorial curation with mechanical aggregation.
Certification vs. Certificate: What's the Difference?
Personnel certification per ISO/IEC 17024 versus a training certificate. Why the distinction matters.
BSI IT-Grundschutz: Practitioners, Advisors, and the Accreditation Question
What distinguishes Practitioner from Advisor, and where does accreditation sit in the BSI path?
1:1 with the CISO
Need the full picture for your case?
60 minutes of personal strategy instead of weeks of self-research. Vendor-independent, with a written report.