CISA Requirements: Experience, Waivers, Cost, and the Steps to Certification

The CISA requirements at a glance

CISA requirements come in two stages, and the order matters. You pass ISACA's exam first, which is open to anyone. Then, within five years of passing, you apply for certification with at least five years of qualifying experience, verified by someone you worked with, and a one-time US$50 application fee. Up to three of the five years can come from waivers, but at least two must be real CISA work.

Can you take the CISA exam before you have the experience?

Yes. ISACA says the CISA exam is open to anyone with an interest in information security, and you can sit it before you meet the experience requirement. You must meet that requirement before you are certified, and you have five years from the passing date to apply.

Two details make that window more forgiving than it sounds. The experience is measured over the 10 years before your application date, not from the exam date, so work you did before passing can count. And ISACA's candidate guide says someone who passes cannot take the same exam again during the five-year application period, so that one pass is what you build on. One workable order is to pass while the material is fresh, then apply once the years add up. For study in the same structure you will later describe on the application, full CISA prep planned for launch organizes practice by the five domains.

What counts toward the five years of CISA experience

ISACA's CISA application form for candidates who passed in June 2019 or later (version V5-0723) asks for five years of information systems auditing, control, assurance, or security work within the past 10 years of the application date. The work must fall in at least one of the five CISA job practice domains, which the guide to what's on the CISA exam explains one by one.

The form splits the claim into sections:

• Section A, CISA work experience (required): your jobs, dates, time spent on CISA tasks, and the domains each job touched. At least two years are required here.
• Section B, general work experience waiver (optional): at least one year of general information systems or general audit work, counted as one year at most. It cannot overlap with dates already claimed in Section A.
• Section C, education waiver (optional): a degree or an accounting credential, counted for one to three years (see the next section).

Someone who worked with you must then verify the experience on ISACA's verification form. ISACA accepts a supervisor, manager, colleague, or client, but not immediate or extended family, and not someone in the human resources department. The verifier attests to each job and to any waivers you claim.

CISA experience waivers: what can replace up to three years

Waivers from Sections B and C can replace up to three years in total. The waiver options on that form are:

Attach a copy of your degree, a transcript, or a letter from your college, or your CIMA or ACCA certificate. If an older summary lists other substitutions, check them against the application ISACA gives you when you apply.

Three caps decide most cases: at least two years in Section A, no more than one year from Section B, and no more than three years from Sections B and C together. These fictional candidates show how the caps work:

Sam needs one more year of CISA work, or a degree worth more than the associate. Alex needs six more months of CISA work: two years in Section A plus the three-year master's waiver reaches five.

How much the CISA costs, from exam to annual fee

ISACA's fees, as checked on November 1, 2026, are below. Exam fees depend on your membership status at the time you register.

ISACA adds that once you hold more than two ISACA certifications, the annual fee for the third and later ones drops to US$25 for members and US$50 for nonmembers. The CISA pages do not list membership dues, so compare them on ISACA's membership page before deciding whether the US$185 difference in the exam fee makes joining worthwhile.

Because each attempt costs a full registration fee, a rehearsal before the real appointment has a clear value. A timed 150-question mock exam is planned for full CISA prep, at the exam's four-hour length.

The steps from CISA exam registration to certification

1. Register and pay in your ISACA account. Use your name exactly as it appears on the government-issued ID you will bring. Registration starts a six-month eligibility period.
2. Schedule with PSI. You can book as early as 48 hours after payment, but appointments open only 90 days in advance. You can reschedule without penalty up to 48 hours before the appointment. Missing it, or arriving more than 15 minutes late, forfeits the eligibility and the fee.
3. Take the exam at a PSI test center or by remote proctoring. A preliminary pass or fail appears on screen, and the official score arrives by email within 10 working days.
4. Pay the US$50 application fee once your official score is released.
5. Submit the application with the verification form. The form says processing takes about two to three weeks, and approval is sent by email.
6. Keep the credential by following the Code of Professional Ethics, the CPE policy, and the Information Systems Auditing Standards, and by paying the annual fee.

Keeping the CISA after you earn it, including the 2027 CPE change

A CISA must report at least 20 continuing professional education (CPE) hours each year and 120 over each three-year period, and pay the annual maintenance fee by January 1. Randomly selected holders must document their CPE in an audit.

ISACA is changing how those hours may be earned from January 1, 2027. The total stays at 120 over three years, but at least 90 must align with the certification's exam content outline or domains, and up to 30 may come from other professional development such as leadership, soft skills, volunteering, or mentoring. ISACA says it is giving a year of notice and that no system changes happen in the 2026 cycle. Anyone certified in 2027 earns CPE under the revised policy from the start.

If you don't pass the CISA exam the first time

ISACA allows four attempts within a rolling 12-month period, counted from the first attempt. After a first failed attempt, you wait 30 days before the second, then 90 days after the second before a third, and 90 days after the third before a fourth. Each attempt needs a full registration fee.

The domain results on your score report are informational, but they still show where to put the next block of hours. The free CISA retake planner turns those weak domains and the waiting period into a dated plan, and see how full CISA prep planned for launch spreads 1,350 questions across the five domains if you want practice weighted the same way.

CISA requirement questions candidates ask

Does experience from before the CISA exam count?

Yes, as long as it falls in the 10 years before your application date. The form measures the window from the day you apply, so a candidate with three years of IT audit work before the exam and two more after it can claim all five.

Who can verify CISA work experience?

A supervisor, manager, colleague, or client who worked with you. ISACA excludes immediate and extended family and anyone in the human resources department. If your jobs had different verifiers, ISACA's form lets you submit extra verification pages.

How long do you have to apply after passing?

Five years from the passing date. Plan the experience so that it reaches five counted years inside that window, using the caps in the waiver table above.

Your next step toward the CISA

Check the waiver table against your own record first. If you are short of five counted years, the exam can still come first. Then test where you stand with the 20 free CISA practice questions, which are weighted by the five domains and explain every option.