Certified Information Systems Auditor

Why Trust Techopedia

What Does Certified Information Systems Auditor Mean?

Certified Information Systems Auditor (CISA) is a certification issued by ISACA that validates an auditor’s ability to assess risk, institute information technology access and management controls, execute security audits and report on compliance.


The exam for this certification covers the following topics in regards to information and communication (ICT) systems:

Acquisition, development, testing and implementation
This part of the exam tests the candidate’s knowledge of feasibility studies, business cases, total cost of ownership (TCO), return on investment (ROI) and software development project management.

Operations, maintenance & service management
This part of the exam tests the candidate’s knowledge of service management best practices, enterprise architecture, systems resiliency, information lifecycle management (ILM), IT controls and performance monitoring.

IT Governance
This part of the exam tests the candidate’s knowledge of enterprise risk management (ERM), specific IT governance frameworks, quality assurance (QA), performance scorecards and other topics related to business continuity and disaster recovery (BCDR).

Asset protection
This part of the exam tests the candidate’s knowledge of privacy laws and regulations, risk management, digital forensics, data handling and best practices for physical and environmental security controls including digital signatures and encryption.

This part of the exam tests the candidate’s knowledge of auditing tools and best practices, as well as the candidate’s knowledge of laws and regulations that pertain to an organization’s business processes.

Techopedia Explains Certified Information Systems Auditor

CISA is an advanced certification from ISACA that is intended for information technology professionals who are interested in advancing their career as an internal or consulting IT auditor. This certification fulfills the United States Department of Defense’s Information Assurance Technical Level III and Cyber Security Service Provider (CSSP) Auditor requirements.

Like ISACA’s exams for CISSP and CISM, CISA exams are four hours long and consists of 150 multiple-choice questions. A score of 450 or higher (scored on a scale of 200 to 800) is required to pass the exam. Successful candidates must agree to adhere to ISACA’s Information Systems Auditing Standards, Continuing Professional Education (CPE) Policy and Code of Professional Ethics.


Related Terms

Margaret Rouse

Margaret jest nagradzaną technical writerką, nauczycielką i wykładowczynią. Jest znana z tego, że potrafi w prostych słowach pzybliżyć złożone pojęcia techniczne słuchaczom ze świata biznesu. Od dwudziestu lat jej definicje pojęć z dziedziny IT są publikowane przez Que w encyklopedii terminów technologicznych, a także cytowane w artykułach ukazujących się w New York Times, w magazynie Time, USA Today, ZDNet, a także w magazynach PC i Discovery. Margaret dołączyła do zespołu Techopedii w roku 2011. Margaret lubi pomagać znaleźć wspólny język specjalistom ze świata biznesu i IT. W swojej pracy, jak sama mówi, buduje mosty między tymi dwiema domenami, w ten…