CISA
How should you split your study time for the CISA?
Split your hours by ISACA's published weights. The CISA outline effective August 2024 gives its five domains 18%, 18%, 12%, 26% and 26% of the exam, so on a 100-hour plan each domain gets exactly that many hours, and more than half your time goes to IS operations and business resilience and to protection of information assets.
The weights come from the ISACA Certification Exam Candidate Guide, version 1.26, and the CISA exam content outline, both read on 2 October 2026. ISACA does not recommend a number of study hours, so the budgets and plans here are ours. For the format, scoring and rules, see what is on the ISACA CISA exam.
How many hours should each CISA domain get?
The same share as its weight. The weights divide 50, 100 and 150 hours exactly, so there is no rounding.
| Domain | Weight | 50 h | 100 h | 150 h |
|---|---|---|---|---|
| 1. Information System Auditing Process | 18% | 9 | 18 | 27 |
| 2. Governance and Management of IT | 18% | 9 | 18 | 27 |
| 3. Information Systems Acquisition, Development, and Implementation | 12% | 6 | 12 | 18 |
| 4. Information Systems Operations and Business Resilience | 26% | 13 | 26 | 39 |
| 5. Protection of Information Assets | 26% | 13 | 26 | 39 |
Want it on one page? Our free CISA mind map gives the five domains with a mnemonic, and the 10-question CISA quiz checks your recall in five minutes.
Choose the column you can keep to over the six months your registration lasts. A plan you follow beats a bigger one you drop. For one text that follows the same weights, the CISA study guide prints each domain's percentage at the head of the domain and sizes its pages to it.
CISA study planner
ISACA CISA: study planner
Domain weights come from the CISA Examination Content Outline, effective August 2024, as printed in the ISACA Certification Exam Candidate Guide, version 1.26, read on 2 October 2026. ISACA does not recommend a number of study hours; the budgets and the split are our suggestion, in proportion to the published weights.
Hours by domain
| Domain | Weight | 50 hours | 100 hours | 150 hours |
|---|---|---|---|---|
| 1. Information System Auditing Process | 18% | 9 | 18 | 27 |
| 2. Governance and Management of IT | 18% | 9 | 18 | 27 |
| 3. Information Systems Acquisition, Development, and Implementation | 12% | 6 | 12 | 18 |
| 4. Information Systems Operations and Business Resilience | 26% | 13 | 26 | 39 |
| 5. Protection of Information Assets | 26% | 13 | 26 | 39 |
| Total | 100% | 50 | 100 | 150 |
No rounding: the weights divide every column exactly.
What 150 questions look like by domain
ISACA publishes percentages, not question counts, and some questions are unscored pretest items. These are our arithmetic on the percentages, as a guide to practice volume.
| Domain | Weight | Share of 150 |
|---|---|---|
| 1 | 18% | 27 |
| 2 | 18% | 27 |
| 3 | 12% | 18 |
| 4 | 26% | 39 |
| 5 | 26% | 39 |
Subdomains
| Domain | Subdomain A | Subdomain B | Read | Studied | Practiced |
|---|---|---|---|---|---|
| 1 | Planning | Execution | [ ] | [ ] | [ ] |
| 2 | IT Governance | IT Management | [ ] | [ ] | [ ] |
| 3 | Information Systems Acquisition and Development | Information Systems Implementation | [ ] | [ ] | [ ] |
| 4 | Information Systems Operations | Business Resilience | [ ] | [ ] | [ ] |
| 5 | Information Asset Security and Control | Security Event Management | [ ] | [ ] | [ ] |
Pace for timed practice
| Set | Questions | Time at the exam's average pace |
|---|---|---|
| One question | 1 | 1 minute 36 seconds |
| Short timed set | 25 | 40 minutes |
| Half the paper | 75 | 2 hours |
| Full paper | 150 | 4 hours |
Before exam day
- Hours booked in the calendar for your column (our suggestion)
- One full timed paper, 150 questions in 4 hours (our suggestion)
- Exam booked inside your six-month eligibility window (ISACA rule)
How should practice questions be spread?
In proportion to the weights, too. Out of 150 questions, the weights work out to 27, 27, 18, 39 and 39. ISACA publishes percentages only, and the exam also carries pretest items that do not count, so treat those numbers as a guide to practice volume and not a prediction of your paper.
In each domain, finish the reading before you start timed questions, and read every rationale, including the ones for questions you got right. The CISA practice questions with rationales are split 36, 36, 24, 52 and 52 across the domains, 200 in all.
What does the CISA pace mean for practice?
150 questions in 240 minutes averages 1 minute 36 seconds each. In round numbers, that is 25 questions every 40 minutes, 75 in 2 hours, and the full paper in 4.
Every question has four options and one best answer, and there is no penalty for guessing. Practice choosing the best of several defensible answers, the auditor's answer, and when a question stalls, answer it and move on. The Candidate Guide allows two breaks of up to 10 minutes, and the clock keeps running during them, so build them into a full timed paper before the day.
Where should you start?
With domain 1, the information system auditing process. It is 18%, and in our reading its two subdomains, planning and execution, are the audit method that the other four domains apply to governance, systems, operations and security. After that, take the two 26% domains while you have the most time, and finish with domain 3, the lightest.
For the controls vocabulary those domains assume, NIST SP 800-53 and ISACA's COBIT are useful references. The exam tests the outline, so give each the time it saves you and no more.
What should you do first?
Download the planner, pick your column and book the hours. Then read the outline's 43 tasks once, so you know what each domain asks you to do. No study plan promises a pass, ours included. Credential Press is independent of ISACA, and nothing here comes from inside the exam.
Frequently asked questions
How should CISA study hours be split across the domains?
By ISACA's published weights: 18%, 18%, 12%, 26% and 26%. On 100 hours that is 18, 18, 12, 26 and 26 hours, and the same weights divide 50 and 150 hours exactly.
How many hours should I study for the CISA?
ISACA does not recommend a number. Pick a budget you can keep, then split it by the weights; our planner has columns for 50, 100 and 150 hours.
Which CISA domains need the most study?
Information Systems Operations and Business Resilience, and Protection of Information Assets, at 26% each. Together they are just over half the exam.
How fast do I need to answer CISA questions?
150 questions in 240 minutes is 1 minute 36 seconds a question on average, or 25 questions every 40 minutes.
How many CISA practice questions should come from each domain?
In proportion to the weights. Out of 150, that is 27, 27, 18, 39 and 39. ISACA publishes percentages only, so those counts are arithmetic, and the real exam also carries unscored pretest items.
CISA: test yourself in five minutes
Which books fit this study plan?
Certified Information Systems Auditor. 12 chapters, 355 pages.
Practice questions with full rationales, sized to the published domain weights. 214 pages.
Sources
Every ISACA figure above was read from the document itself on 2 October 2026. The hours are our arithmetic on those figures, and the plans are our suggestions.
- ISACA, Certification Exam Candidate Guide, version 1.26, 2026
- ISACA, CISA Exam Content Outline, effective August 2024
- NIST, SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations
Credential Press is not affiliated with, endorsed by or authorized by ISACA. Exam names and trademarks belong to their owners.