Have a minimum of five years of professional experience in IT auditing, control, or security

Pass the CISA exam

Adhere to the ISACA Code of Ethics

candidate has a strong background in information systems, IT auditing, or security.

A minimum of 5 years of professional information systems auditing, control, or security work experience (as described in the CISA job practice areas) is required for certification. Substitutions and waivers of such experience, to a maximum of 3 years, may be obtained as follows:

• A maximum of 1 year of information systems experience OR 1 year of non-IS auditing experience can be substituted for 1 year of experience.
• 60 to 120 completed university semester credit hours (the equivalent of a 2-year or 4-year degree) not limited by the 10-year preceding restriction can be substituted for 1 or 2 years, respectively, of experience.
• A master’s degree in information security or information technology from an accredited university can be substituted for 1 year of experience.

The CISA exam covers the following domains:

Domain 1: Information System Auditing Process

Domain 2: Governance and Management of IT

Domain 3: Information Systems Acquisition, Development, and Implementation

Domain 4: Information Systems Operations, Maintenance, and Support

Domain 5: Protection of Information Assets

The exam consists of 150 multiple-choice questions and is administered over a four-hour period. Candidates must achieve a passing score of 450 or higher out of 800.