CISA format, scoring and experience rules

The CISA exam has 150 multiple-choice questions in four hours and is scored on a 200 to 800 scale, with 450 needed to pass. You can sit the exam before you have the work experience, but ISACA will not award the certification until you document it.

Last checked October 2026. Based on 2026 guides summarizing ISACA’s published requirements. Confirm the current experience rules and any waivers on isaca.org.

The five domains

• Information Systems Auditing Process
• Governance and Management of IT
• Information Systems Acquisition, Development and Implementation
• Information Systems Operations and Business Resilience
• Protection of Information Assets

The domains are weighted unequally, and one guide notes that two of them together make up 52% of the exam, so spend study time accordingly rather than equally. A guide says the 450 score is scaled rather than a percentage, so you cannot know what fraction of questions guarantees a pass.

Experience requirement

• Five years of professional information systems audit, control, assurance or security experience.
• Waivers. A guide says up to three years can be waived through academic qualifications and other credentials.
• Timing. You can pass first and then document your experience, which a guide says you have five years from the date you pass to submit.
• Maintenance. A guide reports 120 CPE hours over three years, with at least 20 each year.

Common questions