CISA
What is on the ISACA CISA exam?
The ISACA CISA exam is 150 multiple-choice questions in 4 hours. It is scored on a scale from 200 to 800, and 450 passes. The questions follow the five domains of the CISA Examination Content Outline effective August 2024, and the two heaviest, IS operations and business resilience and protection of information assets, are 26% each.
Every fact below comes from ISACA's own documents: the Certification Exam Candidate Guide, version 1.26, the CISA page and its exam content outline, and ISACA's CPE policy, all read on 2 October 2026.
How is the CISA exam structured?
ISACA gives 4 hours, 240 minutes, for 150 multiple-choice questions, about 1 minute 36 seconds each. You sit at a PSI test center or online with a remote proctor, in English, Spanish, Simplified Chinese, French, German, Korean or Japanese.
Every question has a stem and four options, and you choose the one best answer. Some questions describe a situation and ask two or more questions about it. There is no penalty for a wrong answer, so ISACA's own advice is to leave nothing blank.
ISACA Certification Exam Candidate Guide v1.26
Which CISA domains carry the most weight?
ISACA publishes a percentage for each domain, not a question count. The current outline took effect on 1 August 2024.
| Domain | Weight | Subdomains |
|---|---|---|
| 1. Information System Auditing Process | 18% | Planning; Execution |
| 2. Governance and Management of IT | 18% | IT Governance; IT Management |
| 3. Information Systems Acquisition, Development, and Implementation | 12% | Acquisition and Development; Implementation |
| 4. Information Systems Operations and Business Resilience | 26% | Operations; Business Resilience |
| 5. Protection of Information Assets | 26% | Asset Security and Control; Security Event Management |
Want it on one page? Our free CISA mind map gives the five domains with a mnemonic, and the 10-question CISA quiz checks your recall in five minutes.
Domains 4 and 5 are 52% of the exam between them. Domain 3 is the lightest at 12%. Behind the domains sit 43 tasks, the last of which is to evaluate the opportunities and risks of emerging technologies, regulations and industry practices. When ISACA announced the 2024 outline, it said the five domains were similar to the last one, but the new outline "requires testing of risk, security, and controls related to disruptive technologies and emerging IT audit practices."
How is the CISA scored?
Scores are reported on a common scale from 200 to 800, and you need 450 or higher to pass. A score of 800 means every question right. The exam also carries pretest items that do not count. The domain percentages describe how much of the exam each domain makes up and are not used to calculate your score.
ISACA Certification Exam Candidate Guide v1.26
450 is a scaled score. ISACA publishes no conversion from raw marks to the scale, so any "you need 65%" figure you read elsewhere is a guess.
A preliminary pass or fail shows on screen when you finish, and the official score is emailed within 10 working days. ISACA does not give question-level results.
What does the CISA cost, and when must you sit it?
| Item | ISACA price, 2 Oct 2026 |
|---|---|
| Exam registration | USD 575 members; USD 760 non-members |
| Six-month extension (one allowed) | USD 75 |
| Rescore request, within 30 days, if you do not pass | USD 75 |
| Certification application after passing | USD 50 |
| Annual maintenance | USD 45 members; USD 85 non-members |
The fee depends on your membership status when you register, and it is nonrefundable. From registration you have six months to sit. You can book an appointment from 48 hours after paying, appointments open 90 days ahead, and you can reschedule free of charge up to 48 hours before. Miss the appointment, or arrive more than 15 minutes late, and the fee is forfeited.
What happens on exam day?
Bring one current, original, government-issued ID showing your name, signature and photo, with the name matching your registration; ISACA does not accept copies or digital IDs. At a test center, arrive at least 30 minutes early. Online, check-in opens 30 minutes before, and you show the proctor a full room scan and a mirror check.
Notes, paper, calculators, phones, smart watches, food and drink, water included, are all banned, and the remote exam is closed book. The Candidate Guide allows two breaks of up to 10 minutes with the proctor's permission, and the timer keeps running.
ISACA CISA exam-day checklist
ISACA CISA: exam-day checklist
Rules come from the ISACA Certification Exam Candidate Guide, version 1.26 (2026), and ISACA's Remote Proctoring Guide, version 12.24, read on 2 October 2026. Suggestions are marked as ours. Check ISACA's Exam Candidate Guides page before your exam in case anything has changed.
When you register
- You have six months from registration to sit the exam; one six-month extension costs USD 75 (ISACA rule)
- Registration fees are nonrefundable and nontransferable (ISACA rule)
- You can schedule from 48 hours after paying; appointments open 90 days ahead (ISACA)
- Need accommodations? Request them at least four weeks before your preferred date (ISACA rule)
Before the day
- Reschedule free of charge up to 48 hours before; inside 48 hours you sit or forfeit the fee (ISACA rule)
- One current, original, government-issued ID with your name, signature and photo; the name must match your registration (ISACA rule)
- Remote: use your own computer if you can; a technical failure on an employer laptop means a retake at your own expense (ISACA)
Test center
- Arrive at least 30 minutes early; more than 15 minutes late forfeits the fee (ISACA rule)
- No notes, paper, calculators, phones, smart watches, or food and drink, including water (ISACA rule)
Remote proctoring
- Check-in opens 30 minutes before the appointment (ISACA)
- 360-degree room scan and a mirror check (ISACA rule)
- Closed book; chat with the proctor in English only (ISACA rule)
In the exam
| What | Figure |
|---|---|
| Questions | 150 multiple choice, four options, one best answer |
| Time | 4 hours (240 minutes) |
| Average per question | 1 minute 36 seconds |
| Breaks | Up to two of 10 minutes with the proctor's permission; the timer keeps running |
| Wrong answers | No penalty, so answer every question |
| Scale | 200 to 800; 450 passes, and 450 is not a percentage |
After
- Preliminary pass or fail shows on screen; the official score arrives within 10 working days (ISACA)
- Not passed: a rescore costs USD 75 and must be requested within 30 days of results (ISACA rule)
- Retakes: four attempts in a rolling 12 months; wait 30 days, then 90, then 90; full fee each time (ISACA rule)
- Passed: apply within five years, with the USD 50 application fee and your experience (ISACA rule)
What experience do you need to become certified?
Passing is step one. To hold the CISA you also pay the USD 50 application fee, show five or more years of experience in IS or IT audit, control, assurance or security, and agree to ISACA's Code of Professional Ethics, its CPE policy and its information systems auditing standards. Waivers can cover up to three of the five years. You may sit the exam before you have the experience; you then have five years from passing to apply, and the experience must fall within the 10 years before you apply.
Which outside standards are worth knowing?
ISACA's own auditing standards sit in its IT Audit Framework, ITAF, which ISACA released in a 5th edition in February 2026, after the current outline. Many candidates also work with COBIT for IT governance, NIST SP 800-53 for security and privacy controls, and the IIA's Global Internal Audit Standards. Use them to understand the ideas the outline names; the exam tests the outline.
What if you do not pass?
You have four attempts in a rolling 12 months. Wait 30 days after the first attempt, then 90 days before the third and 90 before the fourth, and pay the full fee each time. If you think the result is wrong, a rescore costs USD 75 and must be requested within 30 days.
How should you prepare?
Plan from the weights. Our CISA study plan splits 50, 100 or 150 hours across the five domains. The CISA exam guide gives each domain its share of the pages, with the percentage printed at the head of the domain. For practice, the 200 CISA practice questions are split by the same weights, with full rationales.
What should you do this week?
Read the outline in the Candidate Guide, print the checklist, and register only when you can sit within six months. Credential Press is independent of ISACA, and nothing here comes from inside the exam.
Frequently asked questions
How many questions are on the CISA exam?
150 multiple-choice questions in 4 hours. Each has four options and one best answer, and some follow a short scenario. Some questions are unscored pretest items, and ISACA does not publish how many.
What is the CISA passing score?
450 on a scale of 200 to 800. It is a scaled score, and ISACA publishes no conversion from raw marks to the scale, so there is no percentage pass mark.
Which CISA domains carry the most weight?
Information Systems Operations and Business Resilience, and Protection of Information Assets, at 26% each. Together they are 52% of the exam under the outline effective August 2024.
How much does the CISA exam cost?
USD 575 for ISACA members and USD 760 for non-members. After passing, applying for certification costs USD 50, and the annual maintenance fee is USD 45 for members and USD 85 for non-members.
Can I take the CISA without five years of experience?
Yes. ISACA lets you sit the exam first. You then have five years from passing to apply, and the experience must fall within the 10 years before your application. Waivers can cover up to three of the five years.
How many times can I retake the CISA?
Four attempts in a rolling 12 months. You wait 30 days before the second attempt and 90 days before each of the third and fourth, and each attempt costs the full fee.
CISA: test yourself in five minutes
Which books prepare you for the CISA?
Certified Information Systems Auditor. 12 chapters, 355 pages.
Practice questions with full rationales, sized to the published domain weights. 214 pages.
Sources
Every figure above was read from the document itself on 2 October 2026.
- ISACA, Certification Exam Candidate Guide, version 1.26, 2026
- ISACA, CISA Exam Content Outline, effective August 2024
- ISACA, CISA certification page
- ISACA, Maintain CISA Certification
- ISACA, press release on the 2024 CISA outline, 1 May 2024
Credential Press is not affiliated with, endorsed by or authorized by ISACA. Exam names and trademarks belong to their owners.