Last updated:
CISA preparation guide
What are the CISA certification requirements?
To earn the CISA certification you must pass the CISA exam, then apply within five years of passing. The application needs five or more years of professional information systems auditing, control or security experience gained within the 10 years before you apply, verified by a supervisor or manager, and a one-time US$50 fee. You also agree to ISACA's Code of Professional Ethics, its CPE policy and the IS auditing standards.
Anyone can sit the exam. ISACA says the CISA exam is open to anyone with an interest in information security, and that you can take it before you meet the experience requirement, though you must meet it before you are certified.
ISACA's 2026 Exam Candidate Guide says experience waivers are available for a maximum of three years, and ISACA's CISA application form lists them: up to one year for general audit or general information systems work, and education waivers of one year for an associate degree, two years for a bachelor's, master's or doctorate in any field, three years for a master's in information systems or a related field, or two years for full CIMA certification or ACCA membership. At least two years must be direct CISA experience.
Start CISA baselineThe CISA requirements, step by step
| Requirement | What ISACA asks, and when |
|---|---|
| Pass the exam | A scaled score of 450 or higher on ISACA's 200 to 800 scale, no more than five years before you apply. The experience can come later. |
| Experience | Five or more years of professional IS audit, control, assurance or security work, as described in the CISA job practice areas, gained within the 10 years before you apply. Up to three years can be waived. |
| Application | After your official score is released and within five years of passing, with your experience verified by a supervisor or manager you worked with, and a US$50 processing fee. |
| Ethics and standards | Agree to ISACA's Code of Professional Ethics and the Information Systems Auditing Standards when you apply, and keep to them while you hold CISA. |
| Continuing education | Every year once certified: at least 20 CPE hours each year and 120 CPE hours every three years. |
Worked timeline
A candidate passes the CISA exam in March 2026 with four years of qualifying IT audit experience, all from the last six years.
They have until March 2031 to apply. With a bachelor's degree, the application form's two-year education waiver covers the missing year, so they could apply now. Without a waiver, they apply once they reach five years of qualifying experience within the 10 years before the application date.
Can you take the CISA exam without experience?
Yes. The experience is a certification requirement, not an exam requirement. Passing starts a five-year window to apply, and ISACA's candidate guide restricts people who pass from taking the same exam during that window, so plan to have the experience, with any waivers, before it closes.
How the experience rules work
ISACA asks for at least five years of professional information systems audit, control, assurance or security work, as described in the CISA job practice areas, gained within the 10 years before your application date. A supervisor or manager you worked with verifies it as part of the application; ISACA's form rules out relatives and human resources staff as verifiers.
Up to three years can be waived, and at least two must be direct CISA experience. ISACA's CISA application form (2025 version) allows one year for general audit or general information systems work that does not overlap your CISA experience, and education waivers: one year for an associate degree, two years for a bachelor's, master's or doctorate in any field, three years for a master's in information systems or a related field, and two years for full CIMA certification or ACCA membership. You attach proof, such as a copy of your degree or transcript.
Passing score and retakes
ISACA reports scores on a scale of 200 to 800 and requires 450 or higher to pass. Domain-level results are for information only; the score is based on how many scored questions you answer correctly, whatever their domain, and unscored pretest questions do not count.
You have four attempts within a rolling 12 months. After a first unsuccessful sitting you wait 30 days, then 90 days before each later attempt, and each attempt costs the full registration fee.
Staying certified
Once certified, you report at least 20 CPE hours each year and 120 over each three-year period, pay an annual maintenance fee of US$45 for members or US$85 for non-members, and keep to ISACA's Code of Professional Ethics and the IS auditing standards. ISACA randomly selects holders for an annual CPE audit, and revokes CISA from those who do not comply with it.
Common mistakes with the requirements
Assuming you need five years of experience before you can sit the exam; counting experience from more than 10 years before you apply; missing the five-year deadline to apply; and expecting waivers to cover more than three years, or to replace the two years of direct CISA experience.
Another is assuming every ISACA certification works the same way. In the same candidate guide table, CISM also asks for five years but caps waivers at two years, and CRISC asks for three years with no experience waivers or substitutions.
Frequently asked questions
Can I take the CISA exam without experience?
Yes. ISACA opens the exam to anyone with an interest in information security. You need the experience to be certified, and you have five years from passing to apply.
How many years of experience do I need for CISA?
Five or more years of professional information systems audit, control, assurance or security work, gained within the 10 years before you apply. Up to three years can be waived, but at least two must be direct CISA experience.
Can a degree replace CISA experience?
Partly. ISACA's CISA application form allows two years for a bachelor's, master's or doctorate in any field, and three years for a master's in information systems or a related field, within a three-year cap on all waivers. At least two years must be direct CISA experience.
How long do I have to apply after passing CISA?
Five years from the date you pass. You apply after your official score is released, pay the US$50 application processing fee, and have your experience verified by a supervisor or manager you worked with.
Are the CISA and CISM experience requirements the same?
Both ask for five years, but in different work: IS audit, control, assurance or security for CISA, and information security management for CISM. ISACA's candidate guide allows up to three years of waivers for CISA and up to two for CISM.
Sources and limits
Exam scope and weights: ISACA CISA exam content outline. Certification eligibility: ISACA certification requirements. Other sources: ISACA: Get CISA Certified; CISA application form, 2025 (waivers; from the Get CISA Certified page); Exam Candidate Guide 2026 (waivers, scoring, retakes); Maintain CISA certification (CPE); ISACA Code of Professional Ethics; ISACA CISA. Checked 29 October 2026.
Study methods and examples are independent CertArc teaching guidance. Practice results do not convert to an official score or guarantee a pass. CertArc is not affiliated with or endorsed by ISACA.
