What Does CISA Prove?
CISA (Certified Information Systems Auditor) is ISACA's audit credential, and it has been the default signal for IT audit since the late 1970s. It proves two things. You passed an exam on how information systems get audited, governed, built, operated, and protected. And ISACA verified that you have done the work, because the title comes only after five years of qualifying experience.
The five domains and their weights, per the ISACA exam content outline: information systems auditing process (18%), governance and management of IT (18%), information systems acquisition, development, and implementation (12%), information systems operations and business resilience (26%), and protection of information assets (26%). The credential is framework-agnostic and technology-agnostic, which is why it travels well, and also why it says little about whether you can audit a Terraform module or a deployment pipeline.
What Is the CISA Experience Requirement, and Can You Waive It?
The experience requirement is the real gate, not the exam. ISACA requires five years of professional information systems auditing, control, or security work, gained within the ten years before your application date. You can sit the exam at any point and you then have five years from your pass date to apply. Pass today with two qualifying years and you can still certify in 2029.
Waivers soften the gate but do not remove it. ISACA's 2026 exam candidate guide allows experience substitutions for a maximum of three years, and an ISACA post spells out the common ones: a year of general information systems or non-IS audit work counts for one year, and degrees from an associate's through a related master's can cover up to three. The full substitution table lives in the CISA application itself, so check it against your own transcript before you count on a waiver. In practice, the floor is two years of qualifying work, and most candidates need more.
One change since the last time most "is CISA worth it" articles were written: on July 10, 2025, ISACA introduced the CISA Associate. If you pass the exam without the experience and hold an ISACA membership at any level, you can apply for the designation for $25. It has no CPE requirement, needs an active membership to keep, and expires after four years or when you earn full CISA. It gives a career changer something to put on a profile, but the people reading resumes know the difference.
How Much Does CISA Cost in 2026?
USD, from ISACA's published fees and the 2026 exam candidate guide, verified September 2026.
| Line item | Cost | Notes |
|---|---|---|
| Exam registration | $575 or $760 | ISACA member or non-member. One attempt, test center or remote proctor. |
| Retake | $575 or $760 | Full fee again. Four attempts in a rolling twelve months, with a 30-day wait before the second and 90 days before the third and fourth. |
| Eligibility extension | $75 | Your window to sit the exam is six months. One six-month extension is allowed. |
| Application processing | $50 | Paid once, after you pass and submit your experience. |
| Annual maintenance | $45 or $85 | Member or non-member. Due every January 1 the credential is active. |
| ISACA membership | $145 + chapter dues | Optional. The $185 member exam discount roughly cancels the dues in year one. |
| Study materials or course | $0 to $3,500 | Official manual and question database run about $450. Bootcamps add $1,500 to $3,500. |
| First-year total | $900 to $4,000 | About $900 to $1,450 self-studying, $2,500 to $4,000 with a bootcamp. |
The exam fee is the smallest part of the decision. The cost that matters is the five years, and the recurring one is the maintenance you pay and the CPE you log for as long as you hold the title. The full line-item breakdown, including study material prices and ways to pay less, is in CISA certification cost.
What Is the CISA Exam Format in 2026?
Per ISACA's 2026 exam candidate guide, the CISA exam is 150 multiple-choice questions in four hours (240 minutes). Scores are scaled from 200 to 800 and you need 450 to pass. Domain-level results come back for information only; the pass decision rests on total correct answers. You can test at a PSI center or with a remote proctor, and you can schedule as soon as 48 hours after paying.
Registration opens a six-month eligibility window. Miss it and you forfeit the fee, unless you buy the one allowed six-month extension for $75. If you fail, you get four attempts in a rolling twelve months: a 30-day wait before the second attempt, then 90 days before the third and fourth, each at full price. Budget for one attempt, and study as if a retake costs you $760 and three more months.
What Does It Take to Keep CISA?
Maintaining CISA means at least 20 CPE hours every year and 120 over each three-year cycle, plus the annual fee of $45 for members or $85 for non-members, due by January 1. Miss the CPE or the fee and ISACA revokes the designation. The hours are the real cost. Paid CPE runs into the hundreds of dollars a year, while chapter meetings, webinars, and self-reported learning keep it close to the fee alone. GRC Engineering Club members log 4 CPE hours a month for Club learning and self-report them; ISACA decides what counts.
Is CISA Worth It for You? A Verdict by Situation
The honest answer depends on where you sit. Pick your row.
| Your situation | Verdict | Why | Best move |
|---|---|---|---|
| IT auditor at a Big 4, regional CPA firm, or internal audit shop | Yes | Your firm expects it, promotion ladders assume it, and you are accruing the five years on the job. The exam content is your daily work. | Sit the exam in your second or third year, apply the moment your experience clears. |
| GRC analyst moving into audit | Yes, with a timing caveat | Compliance and control-testing work usually counts toward the five years. CISA is the signal that gets a GRC resume past an audit hiring manager. | Count your qualifying years first. If you are short, pass the exam, hold CISA Associate, and keep working. |
| Security engineer | Usually no | CISA proves you understand how auditors think, which helps when you are audited. It does not raise your standing as an engineer, and the renewal is a recurring chore. | Only if you are moving toward audit or assurance. Otherwise spend the year on a hands-on credential. |
| Career changer with no audit experience | Not yet | You can pass the exam, but you cannot use the title for years. A score on a shelf does not open doors, and the CISA Associate helps only once you are inside ISACA circles. | Earn a credential you can hold this year, get an audit or GRC seat, then start the CISA clock. |
| Auditor who needs to audit cloud and code | Yes, and it is not enough | CISA gets you hired and sets the method. It does not teach you to read a Terraform plan, trace a pipeline control, or judge system-generated evidence. | Keep CISA for recognition. Add CGE-AUD for the technical literacy the engagements now demand. |
The pattern across those rows: CISA pays off in proportion to how close your job is to testing controls for a living, and how soon you can clear the experience bar. Hands-on proof beats memorized domains for every role except the ones where the resume filter runs first.
Who Does CISA Pay Off For, and Who Should Skip It?
Get it if
- You do IT audit, SOC 1 or SOC 2 attestation, or internal audit at a regulated company.
- The postings you want list CISA as required or preferred.
- You have, or will have within two years, the five qualifying years.
- Your employer reimburses the exam and the annual fee.
Skip it, for now, if
- You have no audit, control, or security experience and want a credential you can hold this year.
- Your job is building and automating controls, not testing them.
- Your work is IT risk (look at CRISC) or federal authorization (look at CGRC).
- You are a security engineer with no plan to move into assurance.
Does CISA Raise Your Salary?
We are not quoting a CISA salary figure. The numbers on page one of Google come from undated self-reported survey sites, and none of them isolates the credential from the five years of experience it requires. What is observable: CISA appears as required or preferred in IT audit, IT risk, and compliance postings at audit firms, banks, insurers, and federal contractors. Filter current postings in your market for CISA, compare the ranges with similar roles that do not ask for it, and you will have a better number than any national average.
What Are the Alternatives to CISA?
Each of these fits a job CISA fits less well. None replaces CISA for the roles that screen for it. Fees are USD, verified September 2026.
| Credential | Exam fee | Experience | Renewal | Best for |
|---|---|---|---|---|
| CISAISACA | $575 member, $760 non-member | 5 years IS audit, control, or security, up to 3 waivable | $45 or $85 a year, 120 CPE every 3 years | IT audit roles that screen for it by name |
| CRISCISACA | $575 member, $760 non-member | 3 years IT risk across 2 of 4 domains | $45 or $85 a year, 120 CPE every 3 years | IT risk management |
| CGRCISC2 | $599 | 2 years in 1 or more of 7 domains | $135 a year AMF, 60 CPE every 3 years | Federal RMF and system authorization |
| CGE-AUDGRC Engineering Club | Included in $70/yr membership, or $350 | None | No renewal fee | Auditing cloud, IaC, and CI/CD controls |
Six options, including the IIA CIA and ISO 27001 Lead Auditor, are compared in CISA alternatives. For the federal fork, read CISA vs CGRC. For the cloud-audit fork, read CGE-AUD vs CISA.
Where the GRC Engineering Club Fits
CISA and CGE-AUD are different, not competing. CISA wins on recognition: HR filters, audit partners, and regulators know it on sight, and we tell members to get it when their job asks for it. CGE-AUD covers the part of modern audit work CISA leaves out, evaluating controls defined in code, pipelines, and cloud configuration, with a 50-question exam, no experience requirement, and no renewal fee. It is included in the $70 a year Training Academy membership alongside CGE-P and CGE-AZ. An honest caveat: it is new, launched July 2026, and it does not carry CISA's decades of name recognition. Members who hold both use CISA to get the engagement and CGE-AUD to do it well.
What $70 a year gets you, CISA candidate or not
Club membership is $70 per year, or $9.99 a month. Every certification in the Training Academy is included. Bought one at a time, the three current certifications are $350 each, so $1,050 of credentials come with a membership that costs less than most single exam vouchers.
Students and transitioning veterans pay $35 for their first year with a verified school email or .mil email.
- CGE-P, CGE-AUD, CGE-AZ: training, labs, exam, and certificate, no exam fee
- Hands-on AWS and Azure compliance labs you build in your own account
- Weekly private podcast and live Q&A with working GRC engineers
- Mock interviews, playbooks, and live builder sessions
- Local chapters and a Slack of 1,600+ GRC professionals
- 4 CPE hours a month (48 a year) logged to your transcript, earned through articles, live Q&As, recordings, labs, and courses, to self-report to ISC2, ISACA, IAPP, or GIAC
Frequently Asked Questions
Is CISA worth it?
CISA is worth it if you work in IT audit, external audit, or SOC attestation, or if the jobs you want list it by name. It is the credential HR screens and audit partners recognize first. It is a weaker buy if you have no audit experience yet, if your job is building or engineering controls, or if your audits are mostly cloud infrastructure, pipelines, and code, which the CISA exam covers only at a high level.
Is CISA worth it for GRC?
For GRC roles that touch audit, yes: CISA is the audit credential compliance managers and internal audit teams recognize, and it helps a GRC analyst move into an audit seat. For GRC engineering roles that build and automate controls, CISA proves audit knowledge but not build skill, so a hands-on credential such as CGE-P or CGE-AUD does more for the same year of effort, and CISA can follow once you have the experience.
How much does CISA cost in 2026?
The CISA exam costs $575 for ISACA members and $760 for non-members in 2026. After you pass, ISACA charges a one-time $50 application fee, then $45 a year for members or $85 for non-members to maintain the credential. A realistic first-year total is about $900 to $1,450 self-studying and up to $4,000 with a bootcamp.
What experience do you need for CISA?
ISACA requires five years of professional information systems auditing, control, or security work experience, gained within the ten years before you apply. Up to three years can be substituted through education and general IS or non-IS audit experience, so the floor is two years of qualifying work. You can pass the exam first and have five years to apply once you have the experience.
Can you take the CISA exam without experience?
Yes. ISACA lets anyone register and sit the exam. Passing gives you a score, not the credential, until your experience is verified. Since July 2025, ISACA members who pass without the experience can apply for the CISA Associate designation for a $25 fee. It carries no CPE requirement, requires an active ISACA membership, and expires after four years or when you earn full CISA.
What is the CISA exam format in 2026?
The CISA exam is 150 multiple-choice questions in four hours (240 minutes), scored on a scale of 200 to 800 with 450 to pass. It covers five domains: IS auditing process (18%), governance and management of IT (18%), IS acquisition, development, and implementation (12%), IS operations and business resilience (26%), and protection of information assets (26%). You get a six-month eligibility window after registering and four attempts in a rolling twelve months.
What are the best alternatives to CISA?
CRISC if your job is IT risk rather than audit, CGRC if you authorize federal systems under NIST RMF, the IIA CIA for internal audit, and CGE-AUD if you need to audit cloud, infrastructure as code, and CI/CD controls. CGE-AUD has no experience requirement and is included in a $70 a year GRC Engineering Club membership. None of them replaces CISA for roles that screen for it by name.