CISA requirements: exam first, experience after
Anyone can register for the CISA exam. To become certified you need five years of information systems audit, control, assurance or security experience, with up to three years waivable through education and other credentials, as reported. You can pass first and have five years to apply; meanwhile ISACA members can hold the CISA Associate designation.
CISA Associate rules from ISACA; experience and waiver details as reported from ISACA’s requirements. Confirm on isaca.org. Checked October 11, 2026.
| Requirement | Detail |
|---|---|
| Exam eligibility | Open to anyone; register with ISACA |
| Experience for certification | 5 years of IS audit, control, assurance or security work |
| Waivers | Up to 3 years for education and other credentials (as reported) |
| Time to apply | Within 5 years of passing (as reported) |
| Application fee | $50 |
| Maintenance | 120 CPE hours over 3 years, at least 20 a year, plus annual fee (as reported) |
Still building experience?
ISACA’s CISA Associate ($25) recognizes members who’ve passed the exam but lack the experience. It needs active membership, has no CPE requirement and lasts four years or until you’re fully certified.
Official source & community discussion
ISACA: CISA (official) →
See related questions on Quora →