CISA CPE Requirements for 2027: Track Hours, Evidence, and Renewal

What is confirmed to change for CISA CPE in 2027?

ISACA requires CISA holders to earn and report at least 20 continuing professional education (CPE) hours annually and 120 over a three-year period. Its announced change beginning January 1, 2027 keeps that total but requires at least 90 cycle hours aligned with the certification's domains, allowing up to 30 from other professional development.

These rules were checked November 3, 2026 against ISACA's maintenance page and 2027 CPE policy announcement. The announcement establishes a policy effective date; it does not tell you when your individual three-year cycle begins. If you expect to become certified in 2027, prepare your records for the new classification and confirm your cycle in MyISACA once certification is established.

The professional-development allowance can include activities such as leadership, soft skills, volunteering, or mentoring, subject to the policy's qualification and category rules. Thirty hours is a maximum allowance, not a separate quota you must fill. Keep the domain-aligned total visible even if your overall total already reaches 120.

For candidates still preparing for certification, full ISACA CISA prep planned for launch covers the five domains. Use that structure for exam study; evaluate any later CPE claim separately against ISACA's activity and evidence requirements.

Why is twenty CPE per year not enough by itself?

The annual and three-year requirements are separate checks. Meeting the minimum in each year does not necessarily meet the cycle total. These are planning examples, not prescribed study schedules:

For the 2027 classification, 90 domain-aligned hours plus 30 qualifying professional-development hours fits the stated split. Eighty plus 40 does not, even though it also totals 120. Eligibility, documentation, and any activity-specific limits still matter in both cases.

Keep three running totals: the current year's hours, all hours in your assigned cycle, and the domain-aligned hours within that cycle. Check them after you report an activity. Forty hours per year can be a useful planning target, but ISACA's annual minimum remains 20; the higher target is simply a way to distribute 120 over three years.

Which activities and evidence belong in your log?

ISACA lists professional education, qualifying self-study, teaching, publications, and passing related exams among possible CPE categories. Their individual rules determine what you can claim. Ordinary job activity and basic office-productivity training do not generally qualify under the current policy. Exam practice alone does not establish a qualifying CPE activity; check the applicable category and required documentation before making a claim.

For self-study, obtain the provider's certificate showing the CPE hours. ISACA accepts documentation such as completion letters, certificates, attendance rosters, or independent attestations. Its required evidence identifies the attendee, sponsor, activity title or description, date, and hours.

Use one row per activity. The first four rows below describe evidence to capture; the remaining rows are suggested tracking fields to help you reconcile the claim.

Reportable increments are one quarter hour under ISACA's current earning-CPE guidance, checked November 3, 2026. Use qualifying hours supported by the activity's rules and proof, rather than assuming every hour you spent is claimable.

ISACA conducts random CPE audits. Retain supporting records for 12 months after the end of the three-year cycle. Save the evidence when you complete the activity so you can locate it if selected.

How do you distinguish domain learning from professional development?

Classify the activity by what it actually covers. Use the CISA domain guide to orient yourself, then compare the activity description with ISACA's current outline and policy. Keep an agenda or description alongside the completion evidence when it helps explain the connection.

The 2027 announcement also changes or clarifies specific categories:

• Domain-aligned volunteering: a maximum of 20 hours annually and 60 per cycle.
• Nonaligned board or committee volunteering: a maximum of 20 hours annually and 30 per cycle.
• Vendor sales or marketing demonstrations: no longer qualify under the announced rules. Qualifying case-study presentations remain distinct; assess their content and eligibility instead of assuming every vendor event qualifies.

These provisions were checked November 3, 2026. The older earning-CPE page's vendor-marketing allowance should not be carried forward into 2027. Use the dated policy announcement to resolve that difference.

When an activity's classification is unclear, flag it in your log and check with ISACA before relying on those hours. For an existing cycle spanning the change, confirm the treatment of your records rather than inventing a retroactive conversion. ISACA says no system changes occur in the 2026 cycle.

How do you apply or enter hours in MyISACA?

Preloaded ISACA hours do not automatically count toward your certification. ISACA's reporting instructions, checked November 3, 2026, distinguish applying an existing activity from entering a new one:

1. Open Certifications & CPE Management in MyISACA.
2. Select Report and Manage CPE.
3. For preloaded activities, use Apply to assign the hours to the certification.
4. For other activities, use Add New CPE Record, enter the qualifying activity details and hours, and save.
5. Reconcile the displayed CISA totals with your log and evidence.

Before entering an activity manually, check whether it is already available to apply. This is a practical way to avoid creating a duplicate claim. Update your own reporting-status field after checking the certification record, rather than marking an activity complete merely because it appears in a list.

If you hold multiple ISACA certifications, an activity may count across credentials when it qualifies for each. Keep the justification for each credential; the ability to share an activity does not establish its relevance to every certification.

What should a newly certified candidate confirm about their own cycle?

After certification, confirm your individual annual reporting requirements, cycle dates, and renewal payment information in MyISACA. Do not infer the first cycle's start or a fee deadline from the January 1, 2027 policy effective date.

Annual maintenance fees were US$45 for members and US$85 for nonmembers when checked November 3, 2026. Verify the amount shown for your renewal; these current amounts are not a guarantee of 2027 pricing. The CISA requirements and cost guide explains the wider path from exam to credential.

Maintenance also involves professional ethics and auditing standards. Reporting hours and paying a fee do not replace those obligations, and noncompliance can lead to revocation. Check both your education record and your renewal status rather than treating one completed action as proof that everything is settled.

If you have not yet earned CISA and are preparing for the exam, full ISACA CISA prep planned for launch includes 500 flashcards for recall practice. Use recall practice to revisit concepts you are still learning.

Keep your exam preparation schedule separate from the CPE log you will use to support qualifying claims. In the study schedule, record topics that need more work and questions to revisit; in the CPE log, record qualifying activities, supporting evidence, and reporting status. Learning about an exam domain alone does not establish a CPE claim.

Candidates still preparing can use the 20 free CISA practice questions and free CISA study plan. For a longer practice session, full ISACA CISA prep planned for launch includes a 150-question mock exam.

Your next step is to create the log, save the policy announcement with your planning notes, and record your own cycle once confirmed. Then choose qualifying activities that address both the annual minimum and the domain-aligned cycle requirement, and retain the proof as you go.