CISA Domains and Weights Explained: All 5 Domains (2026)
The CISA exam covers five domains, and ISACA gives each a fixed percentage: Information Systems Auditing Process 18%, Governance & Management of IT 18%, Information Systems Acquisition, Development & Implementation 12%, Information Systems Operations and Business Resilience 26%, and Protection of Information Assets 26%. The weights add up to 100%.
This guide lists every domain with ISACA's own section headings, then the exam format, the experience rule and the renewal rule. Everything here was checked on isaca.org on 1 November 2026.
CISA domains and weights at a glance
| Domain | Weight | Sections |
|---|---|---|
| 1. Information Systems Auditing Process | 18% | 2 |
| 2. Governance & Management of IT | 18% | 2 |
| 3. Information Systems Acquisition, Development & Implementation | 12% | 2 |
| 4. Information Systems Operations and Business Resilience | 26% | 2 |
| 5. Protection of Information Assets | 26% | 2 |
ISACA's outline page says the exam "consists of 150 questions covering 5 job practice domains". Its candidate guide adds that the domain percentages "indicate the portion of the exam that reflects that domain content". Each domain is split into two sections, A and B, and each section lists topics.
Which CISA outline is current?
The outline on ISACA's CISA page is the current one. The last CISA update we found on ISACA's site was announced in a press release dated 1 May 2024: the updated exam became available on 1 August 2024. When we checked on 1 November 2026, the CISA outline page showed no notice of a newer outline. The CISM page does carry such a notice, for 3 November 2026. If you are weighing both, see our guide to the CISM exam change. To practise for it, try our CISM practice questions.
What each CISA domain covers
The headings and topics below are ISACA's. We show selected topics only, not the full lists, so check the outline for the complete set and for the task statements.
Domain 1: Information Systems Auditing Process (18%)
Audit planning and execution, from standards and risk-based planning to evidence, sampling and reporting.
A. Planning. Selected topics (not the full list): IS Audit Standards, Guidelines, and Codes of Ethics; Types of Audits, Assessments, and Reviews.
B. Execution. Selected topics (not the full list): Audit Project Management; Audit Testing and Sampling Methodology; Audit Evidence Collection Techniques.
Domain 2: Governance & Management of IT (18%)
How IT is governed and managed, including policy, risk, privacy and vendors.
A. IT Governance. Selected topics: Laws, Regulations, and Industry Standards; Enterprise Architecture and Considerations; Enterprise Risk Management; Privacy Program and Principles; Data Governance and Classification.
B. IT Management. Selected topics (not the full list): IT Resource Management; IT Vendor Management.
Domain 3: Information Systems Acquisition, Development & Implementation (12%)
How systems are acquired, built, tested and put into production.
A. Information Systems Acquisition and Development. Selected topics (not the full list): Project Governance and Management; Business Case and Feasibility Analysis.
B. Information Systems Implementation. Selected topics (not the full list): System Readiness and Implementation Testing; Implementation Configuration and Release Management.
Domain 4: Information Systems Operations and Business Resilience (26%)
Running IT services day to day, and keeping the business going when something fails.
A. Information Systems Operations. Selected topics: IT Asset Management; Problem and Incident Management; IT Change, Configuration, and Patch Management; Operational Log Management; Database Management.
B. Business Resilience. Selected topics (not the full list): Business Impact Analysis; System and Operational Resilience; Data Backup, Storage, and Restoration.
Domain 5: Protection of Information Assets (26%)
Security controls and security event handling.
A. Information Asset Security and Control. Selected topics: Physical and Environmental Controls; Identity and Access Management; Data Loss Prevention; Public Key Infrastructure; Cloud and Virtualized Environments.
B. Security Event Management. Selected topics (not the full list): Security Awareness Training and Programs; Information System Attack Methods and Techniques; Security Testing Tools and Techniques.
Our view: how to use the weights
This section is opinion, not ISACA guidance. Domains 4 and 5 are 26% each, so together they make up 52% of the exam, more than the other three domains combined. If study time is short, it is reasonable to start there. Domain 3 is 12%, but ISACA does not suggest skipping anything, and its topics (testing, release, migration) overlap with the audit work in Domain 1. Spending time roughly in proportion to the weights seems sensible. For a comparison with the other ISACA exams, see ISACA certifications compared.
CISA exam format and rules
| Detail | What ISACA says |
|---|---|
| Questions | 150 multiple-choice |
| Time | 4 hours (240 minutes) |
| Scoring | Scaled score from 200 to 800; 450 or higher passes |
| Exam fee | US$575 for ISACA members, US$760 for non-members |
| Experience for certification | Five or more years in IS/IT audit, control, assurance or security; waivers for a maximum of three years |
| Keeping the certification | Today: at least 20 CPE hours a year and 120 over a three-year period. From 1 January 2027 the 120 stays, but at least 90 must be aligned to the exam content outline |
ISACA's candidate guide says exams contain scored items and pretest items, and pretest items are not used to calculate scores. Domain-level results are given for information only, and the exam score is based on the total number of items answered correctly. The retake policy allows four attempts in a rolling 12 months, with a 30-day wait before the second attempt and 90 days before the third and fourth, and the full fee is paid each time. For how scores compare across vendors, see our passing scores article.
You do not need the experience to sit the exam. ISACA says the CISA exam is open to anyone who has an interest in information security, and that you must meet the experience requirement before you are certified. You have five years from passing to apply, and ISACA charges a US$50 application processing fee.
FAQ
How many domains are on the CISA exam?
Five. ISACA lists them as Information Systems Auditing Process, Governance & Management of IT, Information Systems Acquisition, Development & Implementation, Information Systems Operations and Business Resilience, and Protection of Information Assets.
What is the CISA passing score?
450 or higher on ISACA's scaled score of 200 to 800.
How many questions are on the CISA exam, and how long is it?
150 multiple-choice questions in 4 hours (240 minutes).
Which CISA domains have the highest weight?
Domain 4, Information Systems Operations and Business Resilience, and Domain 5, Protection of Information Assets, at 26% each.
Do you need work experience to take the CISA exam?
No. ISACA says you can take the exam first, but you need the experience before you can be certified.
Is the CISA exam changing?
We found no announced change on ISACA's CISA pages on 11 October 2026. The most recent update we found took effect on 1 August 2024.
Sources: we checked ISACA's CISA exam content outline page, the CISA "Get CISA certified" page, the 2026 ISACA Certification Exams Candidate Guide (version 1.26) and ISACA's 1 May 2024 press release on the CISA update, all on isaca.org, on 1 November 2026. Domain names, weights and the section and topic headings are copied from the outline page; the one-line summaries are our paraphrase, and we show selected topics only. ISACA's pages word some domain names slightly differently in different places (for example "System" or "Systems"); we use the outline page headings. ISACA does not publish a pass rate or the number of pretest questions on the exam.
Ready to practise across all five domains? Try the free ISACA CISA practice test, then see the full ISACA CISA practice question pack. More exam details are in our IT certification exam facts table.
What people say about this pack
Use this content for your practice after you prepare for the exam. The CISM questions here are closest to the scenario questions you can expect to see on the test. Know that the content for CISM is slightly changing come November 2026.