CISA Exam Guide: Format, Requirements & Study Plan

Training delivered by Virtual Infrastructure Services LLC — an accredited ISACA Training Organization.

Everything you need to plan for the Certified Information Systems Auditor exam — how it's structured, who it's for, and how to prepare.

Exam format

The CISA exam has 150 questions and must be completed in 4 hours. It is available online via remote proctoring and at in-person testing centers where available. Questions are drawn from the five CISA domains — see the 5 CISA domains explained.

Experience requirement

CISA is designed for mid-level professionals and expects five or more years of information systems auditing, control or security work. Certain substitutions and waivers may apply — confirm the current requirements on ISACA's site before you apply.

CPEs and maintenance

To maintain CISA you must earn and report at least 120 CPE hours every three-year cycle, with a minimum of 20 hours annually. Instructor-led training earns up to one CPE per hour; our virtual instructor-led course earns 14 CPEs.

A practitioner-led study plan

Start foundational prep immediately to build a base across the five domains, then join the next monthly live-virtual cohort (next start August 31, 2026) for instructor-led review, practice questions and real-world context from active IS audit practitioners. Reinforce with a question bank and a final review before your exam date.

Frequently asked questions

How long is the CISA exam?

The CISA exam is 150 questions and must be completed within 4 hours, delivered online via remote proctoring or at a testing center.

How many years of experience do I need for CISA?

Five or more years of IS auditing, control or security experience. Some substitutions and waivers may apply — check ISACA's current requirements.

How many CPEs does the training earn?

Our virtual instructor-led CISA course earns 14 CPEs. To maintain the credential you need 120 CPEs every three years, with at least 20 annually.