CISA requirements: how to get CISA certified
The CISA exam has no prerequisites — ISACA states it is open to anyone with an interest in information security. The certification does: you need a passed exam from the last five years and five or more years of professional information systems auditing, control or security experience, verified by someone you worked with.
See the CISA practice questions →
How to get CISA certified in three steps
ISACA describes the route in three steps:
- Pass the CISA exam. You can take it before you have the required experience.
- Pay the one-time US$50 application processing fee in your MyISACA account, once your official exam scores have been released.
- Submit the certification application online, with your work experience verified by a supervisor or manager. You must apply within five years of passing the exam.
Source: ISACA — Earn a CISA certification. Checked 9 October 2026.
CISA exam requirements: there are none
There are no eligibility conditions for sitting the exam. You can register at any time, and the five-year experience rule is checked only when you apply for certification. That is why “CISA exam requirements” and “CISA certificate requirements” have different answers: the first is nothing, the second is the full list on this page.
Taking the exam early has a time limit attached. ISACA gives you five years from the passing date to apply, so if you are still building experience, plan the exam for a point where you will reach five years within that window.
Source: ISACA — Earn a CISA certification. Checked 9 October 2026.
CISA experience requirements in detail
The CISA work experience requirements come down to three conditions:
- Amount: a minimum of five years of professional work experience.
- Type: information systems auditing, control or security.
- Timing: gained within the 10-year period preceding the date of your application.
Source: ISACA — Earn a CISA certification. Checked 9 October 2026.
Who verifies your experience?
ISACA asks for your experience to be verified by your supervisor or manager. Plan for this early if you have changed employers: each role you claim needs someone who can confirm it, and roles older than ten years at the time of your application do not count.
Source: ISACA — Earn a CISA certification. Checked 9 October 2026.
Can education replace CISA requirements experience?
ISACA’s current Earn a CISA certification page lists the five-year rule without mentioning substitutions. Earlier CISA application forms did include experience waivers — the form for candidates who passed between 2016 and May 2019, for example, allowed up to three years of waivers for certain degrees and qualifications.
Because the current page does not repeat those rules, do not plan around a waiver until you have checked the application that applies to your exam date in your MyISACA account.
Source: ISACA — CISA certification application for candidates who passed 2016 to May 2019 (V3-0718). Checked 9 October 2026.
Requirements for CISA after certification
By applying, CISA holders agree to ISACA’s Code of Professional Ethics, to adhere to the Information Systems Auditing Standards adopted by ISACA, and to its continuing professional education policy.
The CPE policy means at least 20 CPE hours each year and 120 over every three-year reporting period, plus an annual maintenance fee of $45 for ISACA members or $85 for non-members. ISACA states that failing to meet these requirements results in revocation.
Source: ISACA — Maintain CISA certification. Checked 24 September 2026.
How to become CISA certified faster
The experience requirement sets the pace, not the exam. If you already have five years, the bottleneck is passing: register (the fee is US$575 for ISACA members, US$760 for non-members), and you then have six months to sit the exam.
Certsqill helps with that part: expert-developed CISA practice questions with an explanation for every answer option, and a readiness score for each of the five domains, so you book when every domain holds up. It comes with a 7-day money-back guarantee.
Source: ISACA — CISA certification. Checked 9 October 2026.
CISA requirements: questions people ask
How to get a CISA certification without five years of experience?
You can pass the exam first and apply later: ISACA allows the exam before the experience requirement is met and gives you five years from passing to apply. You cannot be certified until the experience requirement is met. Source: ISACA, checked 9 October 2026.
How to get CISA certification after passing the exam?
Wait for your official score, pay the one-time US$50 application fee, and submit the online application with experience verified by a supervisor or manager. Source: ISACA, checked 9 October 2026.
How do I obtain CISA certification if my experience is older than ten years?
Experience must be gained within the 10-year period preceding your application date, so older roles do not count. Source: ISACA, Earn a CISA certification, checked 9 October 2026.
What are the CISA cert requirements in one sentence?
A CISA exam passed within the last five years, five or more years of IS auditing, control or security experience from the past ten years, verified by a supervisor or manager, and a one-time US$50 application fee. Source: ISACA, checked 9 October 2026.
