Last updated:
CISA preparation guide
How should you study CISA Domain 5, protection of information assets?
Domain 5, Protection of Information Assets, is 26% of the CISA exam. 5A covers the controls that protect information: policy, physical security, identity and access, networks and endpoints, data loss prevention, encryption and PKI, cloud, mobile and IoT. 5B covers security events: awareness, attack methods, security testing, monitoring, incident response and forensics. The auditor’s job is to judge whether these controls fit the risk and work. That means comparing access with approved roles, or checking who holds the encryption keys, rather than adding controls.
Domain 5 reads like a security exam, which is why security professionals sometimes answer it as engineers. The questions reward the auditor’s view: is the control appropriate to the risk, is it operating, and is there evidence?
This is independent CertArc teaching material. Use ISACA’s outline for what is tested.
Start CISA baselineKey Domain 5 objectives: what the auditor checks
| Objective (outline) | What the auditor checks | Strongest evidence | Tempting wrong move |
|---|---|---|---|
| Identity and Access Management (5A) | Access matches approved roles, leavers lose access promptly, and privileged access is limited and watched | Current access compared with HR leaver data and approved role definitions | Asking administrators whether access is reviewed |
| Data Encryption and Public Key Infrastructure (PKI) (5A) | The keys are protected and managed, not just the algorithm | Who can access keys, how they are rotated, and certificate expiry tracking | Checking that “strong encryption” is enabled |
| Cloud and Virtualized Environments (5A) | The organisation knows which controls are its own and which the provider runs | A shared-responsibility mapping, plus the provider’s independent assurance report | Assuming the provider covers everything |
| Data Loss Prevention (DLP) (5A) | Rules cover the data that matters, and alerts are worked | The data classification behind the rules, and the alert-handling records | Counting blocked events |
| Security Awareness Training and Programs (5B) | Training changes behaviour | Results over time, such as phishing-simulation trends | Attendance records |
| Security Testing Tools and Techniques (5B) | Tests are authorised, scoped to the risk, and their findings are fixed | The test scope approval and the remediation tracker | The number of tests run |
| Security Incident Response Management (5B) | There is a tested process with clear roles, and lessons are fed back | Incident records and the post-incident review | The written procedure alone |
| Evidence Collection and Forensics (5B) | Evidence is preserved before it is analysed, with a chain of custody | Custody records, and images taken before investigation | Analysing the live system first |
Original teaching example
During an access review, an IS auditor finds 40 active accounts belonging to staff who left more than 90 days ago. The question asks what the auditor should do FIRST.
The auditor needs to know whether the accounts were used after the staff left, because that decides how serious the finding is. Check the accounts’ activity logs before reporting. Disabling the accounts is the right fix, but it belongs to management. The report should then describe both the exposure and the weakness in the leaver process that let it happen.
5A: judge the control against the risk
For each control the scenario mentions, ask three questions: does it fit the data it protects, does it work in practice, and who owns it? Encryption is a good test case. The algorithm is rarely the problem, so a question about encrypted data that is still exposed usually points to key management: who holds the keys and whether they are stored with the data.
In the cloud, the most common gap is ownership. The customer still owns identity, configuration and data decisions, whatever the provider’s report covers.
5B: events, testing and response
Questions about security events ask whether the organisation finds problems and responds in a controlled way. Monitoring is only useful if someone reviews the alerts. Testing is only useful if the findings are fixed. Response is only useful if evidence is preserved.
In a forensics scenario, preserving the evidence comes before analysing it or restoring the system. The auditor evaluates the response process. The auditor does not lead the response.
How to study Domain 5
For each objective, write down the evidence that would prove the control works and the evidence that only claims it does. When you review a missed question, check whether you chose a stronger control when the question asked for an evaluation. That habit separates the auditor’s answer from the engineer’s.
Frequently asked questions
How much of the CISA exam is Domain 5?
26%, tied with Domain 4 as the largest domain.
Do I need deep technical security knowledge for Domain 5?
You need to understand what each control does and how it fails. The questions mostly ask how an auditor would judge whether it is appropriate and working.
What does the auditor do when management doesn’t fix a finding?
Confirm whether management formally accepted the risk at the right level. If the auditor believes the accepted risk is beyond what the organisation would tolerate, raise it with senior management or the audit committee.
Sources and limits
Exam scope and weights: ISACA CISA exam content outline. Certification eligibility: ISACA certification requirements. Checked 27 October 2026.
Study methods and examples are independent CertArc teaching guidance. Practice results do not convert to an official score or guarantee a pass. CertArc is not affiliated with or endorsed by ISACA.
