CISA Domain 1: Information System Auditing Process (18%)

• A-Planning
  • IS Audit Standards, Guidelines, and Codes of Ethics
  • Business Processes
  • Types of Controls
  • Risk-Based Audit Planning
  • Types of Audits and Assessments
• B-Execution
  • Audit Project Management
  • Sampling Methodology
  • Audit Evidence Collection Techniques
  • Data Analytics
  • Reporting and Communication Techniques
  • Quality Assurance and Improvement of the Audit Process

CISA Domain 2: Governance and Management of IT (18%)

• A-IT Governance
  • IT Governance and IT Strategy
  • IT-Related Frameworks
  • IT Standards, Policies, and Procedures
  • Organizational Structure
  • Enterprise Architecture
  • Enterprise Risk Management
  • Maturity Models
  • Laws, Regulations, and Industry Standards Affecting the Organization
• B-IT Management
  • IT Resource Management
  • IT Service Provider Acquisition and Management
  • IT Performance Monitoring and Reporting
  • Quality Assurance and Quality Management of IT

CISA Domain 3: Information Systems Acquisition, Development, and Implementation (12%)

• A-Information Systems Acquisition and Development
  • Project Governance and Management
  • Business Case and Feasibility Analysis
  • System Development Methodologies
  • Control Identification and Design
• B-Information Systems Implementation
  • Testing Methodologies
  • Configuration and Release Management
  • System Migration, Infrastructure Deployment, and Data Conversion
  • Post-implementation Review

CISA Domain 4: Information Systems Operations and Business Resilience(26%)

• A-Information Systems Operations
  • Common Technology Components
  • IT Asset Management
  • Job Scheduling and Production Process Automation
  • System Interfaces
  • End-User Computing
  • Data Governance
  • Systems Performance Management
  • Problem and Incident Management
  • Change, Configuration, Release, and Patch Management
  • IT Service Level Management
  • Database Management
• B-Business Resilience
  • Business Impact Analysis (BIA)
  • System Resiliency
  • Data Backup, Storage, and Restoration
  • Business Continuity Plan (BCP)
  • Disaster Recovery Plans (DRP)

CISA Domain 5: Protection of Information Assets (26%)

• A- Information Asset Security and Controls
  • Information Asset Security Frameworks, Standards, and Guidelines
  • Privacy Principles
  • Physical Access and Environmental Controls
  • Identity and Access Management
  • Network and End-Point Security
  • Data Classification
  • Data Encryption and Encryption-Related Techniques
  • Public Key Infrastructure (PKI)
  • Web-Based Communication Techniques
  • Virtualized Environments
  • Mobile, Wireless, and Internet-of-Things (IoT) Devices
• B- Security Event Management
  • Security Awareness Training and Programs
  • Information System Attack Methods and Techniques
  • Security Testing Tools and Techniques
  • Security Monitoring Tools and Techniques
  • Incident Response Management
  • Evidence Collection and Forensics

• Individuals who are willing to learn about information system auditing
• Professionals who are auditors or working in an audit environment
• Professionals who are willing to make a career in information systems auditing
• IT Managers
• Security Managers
• System Analysts
• Consultants

A minimum of 5 years of professional information systems auditing, control, or security work experience (as described in the CISA job practice areas) is required for certification. Substitutions and waivers of such experience, to a maximum of 3 years, may be obtained as follows:

• A maximum of 1 year of information systems experience or 1 year of non-information security auditing experience can be substituted for 1 year of experience.
• 60 to 120 completed university semester credit hours (the equivalent of a 2-year or 4-year degree) not limited by the 10-year preceding restriction can be substituted for 1 or 2 years, respectively, of experience.
• A master’s degree in information security or information technology from an accredited university can be substituted for 1 year of experience.

• Understand the Process of Auditing Information Systems
• Learn about Governance and Management of IT
• Information Systems Acquisition, Development and Implementation
• Information Systems Operations, Maintenance and Service Management
• Protection of Information Assets