ISACA CISA Exam: Cost, Domains, Passing Score and Whether It Is Worth It

The ISACA CISA exam costs $575 for ISACA members and $760 for non-members, per ISACA, for one attempt. It is 150 multiple-choice questions in 4 hours across five weighted domains, and you pass at a scaled 450 on a 200-to-800 range. Certifying also takes five years of relevant experience, with waivers of up to three.

This guide covers the whole exam in one place: every fee and the retake rules, the five domains with their 2024 weightings and a study-hour budget, what the 450 passing score really means, the experience requirement and its waivers, and an honest read on whether the CISA is worth it for your role. Two real questions from the PrepClubs CISA bank show what the heavy domains test.

Last updated: September 25, 2026.

Quick takeaways

• Exam fee: $575 for ISACA members, $760 for non-members, per ISACA. Each attempt needs its own paid registration.
• Other costs: a one-time $50 application processing fee after you pass, and an annual maintenance fee of $45 (members) or $85 (non-members).
• Format: 150 multiple-choice questions in 4 hours. Passing is 450 on a scaled 200-to-800 range, which is not 56 percent.
• Domains 4 and 5 are 26 percent each, so Domains 4 and 5 together are 52 percent of the exam. Domain 3 is the lightest at 12 percent.
• To certify you need five years of IS audit, control, assurance or security experience. Waivers can cover up to three years, so at least two hands-on years always apply.
• For IT auditors and GRC professionals the CISA is close to a baseline credential. For hands-on security engineers it is a pivot tool, not proof of build skills.
• PrepClubs is independent prep material and is not affiliated with or endorsed by ISACA.

The CISA exam at a glance

Attribute	ISACA CISA
Questions	150, all multiple-choice
Time	4 hours
Scoring	Scaled, 200 to 800
Passing score	450
Penalty for wrong answers	None
Domains	5 job practice areas, 2024 outline effective August 1, 2024
Delivery	Continuous testing at PSI test centers or remote proctoring
Exam fee	$575 members, $760 non-members

ISACA runs continuous registration, so you can register at any time and schedule an appointment as early as 48 hours after payment, per ISACA. There are no fixed testing windows to wait for.

What the CISA exam costs

Cost item	Member	Non-member
Exam registration (one attempt)	$575	$760
Each retake	$575	$760
Application processing fee (after passing)	$50, one-time	$50, one-time
Annual maintenance fee	$45 per year	$85 per year

ISACA membership carries its own fee, but the $185 gap between member and non-member exam pricing, plus the lower maintenance fee every year, often makes joining first the cheaper route. Run your own numbers before you register.

The retake policy, and why it is the real cost

Each attempt needs a new, fully paid registration. ISACA's retake policy allows four attempts in a rolling 12 months from your first attempt: after a fail you wait 30 days for the second attempt, then 90 days before each of the third and fourth.

So the true cost of the CISA is the fee multiplied by the number of attempts you need, plus at least a month of lost time. Pass the first time and you paid once. Fail once and you have roughly doubled the exam cost. The cheapest way to control CISA cost is not a discount. It is walking in ready.

The five CISA domains and their 2024 weightings

These are the current weightings from ISACA's CISA exam content outline, effective August 1, 2024. Watch for older articles that list Domain 1 at 21 percent: that is the pre-2024 figure.

#	CISA domain (job practice area)	2024 weight
1	Information Systems Auditing Process	18%
2	Governance and Management of IT	18%
3	Information Systems Acquisition, Development and Implementation	12%
4	Information Systems Operations and Business Resilience	26%
5	Protection of Information Assets	26%

This is not a flat five-way split. Two domains dominate, one is deliberately light, and two sit in the middle. Your study plan should have the same shape.

What each domain covers

• Domain 1, Information Systems Auditing Process (18%). Risk-based audit planning, evidence collection, sampling, audit standards and ethics, and reporting. The auditor's core craft.
• Domain 2, Governance and Management of IT (18%). IT strategy, policies, organizational structure, enterprise architecture, resource and portfolio management, and how IT aligns to business goals.
• Domain 3, Information Systems Acquisition, Development and Implementation (12%). Project management, the systems development life cycle, requirements and testing, and controls around building or buying systems.
• Domain 4, Information Systems Operations and Business Resilience (26%). IT operations, service management, incident and problem handling, backup, business continuity and disaster recovery.
• Domain 5, Protection of Information Assets (26%). Logical and physical access controls, network and endpoint security, encryption, data classification and security awareness.

Where to spend your study time

Domain	Exam weight	Suggested share of study hours
Domain 4 (Operations and Resilience)	26%	about 26%
Domain 5 (Protection of Information Assets)	26%	about 26%
Domain 1 (Auditing Process)	18%	about 20%
Domain 2 (Governance and Management)	18%	about 18%
Domain 3 (Acquisition and Development)	12%	about 10%

Two deliberate tweaks. Give Domain 1 slightly more than its 18 percent, because the auditing-process mindset (risk-based planning, report rather than implement) threads through questions in every other domain. And do not cut Domain 3 to nothing: a handful of SDLC and project items can still cost you a pass. For a week-by-week version, see our CISA practice questions and study plan.

Two real CISA questions from the heavy domains

These come verbatim from PrepClubs' CISA bank, one from each 26 percent domain.

Question 1: Domain 4, Operations and Business Resilience

From PrepClubs CISA Practice Test 2, question 87.

An organization reports that its nightly backup jobs complete with a success status every night. An IS auditor wants assurance that the data can actually be recovered. Which of the following provides the BEST such assurance?

• A. Backup console reports showing every nightly job completed successfully.
• B. Results of periodic restore tests validated against the source data.
• C. Confirmation that backup media are rotated to an offsite vault each week.
• D. Reconciliation of backup media inventory to the offsite vault receipt log.

Answer: B. A backup is only as good as the restore. Validated restore tests prove the media are readable, the job captured the right data, and the procedure works with the staff and tools actually available. A success status (A) only confirms the job ran; corrupt media still report success. Offsite rotation (C) protects against site loss but says nothing about recoverability, and a media reconciliation (D) proves the tapes are where they should be, not that they restore.

Question 2: Domain 5, Protection of Information Assets

From PrepClubs CISA Practice Test 4, question 122.

An organization has a data classification scheme with four levels, but an IS auditor finds no rules stating how each level must be stored, transmitted, or disposed of. Which of the following BEST describes the weakness?

• A. Labels have no practical effect without defined handling requirements.
• B. Four levels are more than staff can apply consistently in practice.
• C. Classification levels were assigned by IT rather than by the data owners.
• D. The scheme has not been mapped to the records retention schedule.

Answer: A. Classification exists to drive different protection for different data. Without handling rules per level, staff have a label and no instruction, so confidential data is handled like public data. Three to five levels is common, so the count (B) is not the defect. The facts do not say who assigned the labels (C). Retention (D) is only one of the missing handling rules.

Both questions share the CISA's core pattern: several options are real activities, and the credited one is the answer that gives genuine assurance, not the one that looks busiest.

The CISA passing score: why 450 is not 56 percent

The passing mark is 450 on a 200-to-800 scale, per ISACA. The trap is arithmetic: 450 divided by 800 is about 56 percent, so people conclude they need a little over half the questions right. That is wrong.

CISA scoring fact	Value
Score scale	200 to 800
Passing score	450
Deductions for wrong answers	None, so never leave a question blank
Result timing	Preliminary result at the end of the exam, official score report afterward
Score report detail	Scaled score with a breakdown by domain

Different versions of the exam contain different questions, and some sets are slightly harder than others. ISACA converts your raw performance onto the common 200-to-800 scale, adjusting for the difficulty of your set, so scores stay comparable. Two consequences follow:

• There is no fixed number of correct answers that guarantees 450. On a harder set the raw score needed is a bit lower, on an easier set a bit higher.
• The 56 percent figure is meaningless. It is a calculation on the scale, not on your answers.

A score above 450 earns nothing extra; there is no honors tier. The per-domain breakdown on your report is the useful part if you need a retake, because it shows which areas pulled your scaled score down. In practice, aim for consistent, comfortable passes on full-length timed sets of 150 questions, so a slightly harder real set still clears the bar and your accuracy holds into hour four.

The five-year experience requirement

Passing the exam and holding the certification are separate steps. To certify, ISACA requires five years of information systems audit, control, assurance or security experience within the ten years before you apply. You must also have passed the exam within the last five years, so a pass does not expire the next day.

You do not need the experience to sit the exam, only to certify. Waivers can reduce it, per ISACA's certification application:

Waiver	Years waived
General IS or non-IS audit work experience	1
Associate degree	1
Bachelor's, master's or doctorate in any field	2
Master's degree in information systems or a related field	3
CIMA full certification or ACCA member status	2

The combined maximum is three years, so every candidate needs at least two years of verifiable, hands-on IS audit, control, assurance or security work. Some older guides say a four-year degree waives only one year; ISACA's current form lists two.

If you are a student, ISACA's CISA Associate designation (introduced in 2025) lets students who pass the exam through an ISACA partner program hold a recognized status while they build experience. It needs active ISACA membership, a one-time $25 application fee, and lasts up to four years or until you meet the experience requirement.

Staying certified

Once certified, you pay the annual maintenance fee ($45 members, $85 non-members) and earn 120 CPE hours per three-year cycle, with at least 20 hours each year, per ISACA's maintenance requirements. Treat both as recurring costs when you budget the lifetime price of the credential.

Is the CISA worth it?

For an IT auditor, a compliance analyst or anyone on a governance-and-controls track, usually yes: it is the recognized credential for information systems auditing. For a hands-on security engineer the answer is mixed, because the CISA validates audit judgment, not technical build skills.

Your role	Is the CISA worth it?	Why
IT auditor / IS auditor	Strong yes	It is the standard credential for the job
GRC or compliance analyst	Usually yes	Directly relevant to controls and governance work
Security engineer (hands-on)	Depends	Useful for pivoting into audit or GRC, not for proving build skills
Aspiring CISO or security manager	Often yes	Governance fluency is expected at leadership level
Red team or offensive security	Usually no	Technical certs signal your skill far better

The CISA certifies that you can evaluate whether an organization's information systems and controls are effective and well governed, using the auditor's posture: assess, document, report, recommend. Roles that ask for it include IT auditor, IS auditor, risk manager and compliance officer across finance, healthcare, tech and government. Pay in those roles reflects the years of experience the credential requires, so treat the CISA as what keeps you in contention for them rather than as a salary lever on its own.

For an engineer, the CISA is worth it when you want to move toward GRC, security management or a hybrid assurance role, because it shows you understand controls and governance, not just tooling. If you are staying purely hands-on, spend your certification budget on technical credentials. If you are weighing it against the CISSP, our CISSP vs CISA comparison splits the two by career path.

FAQ

How much does the CISA exam cost?

$575 for ISACA members and $760 for non-members, per ISACA, covering one attempt. After passing, there is a one-time $50 application processing fee, and certified holders pay an annual maintenance fee of $45 (members) or $85 (non-members).

How much does a CISA retake cost, and how soon can I retake?

A retake costs the full exam fee again. You can take the exam four times in a rolling 12 months: 30 days must pass before the second attempt, and 90 days before each of the third and fourth, per ISACA's retake policy.

What are the five CISA domains and their weights?

Information Systems Auditing Process (18%), Governance and Management of IT (18%), Information Systems Acquisition, Development and Implementation (12%), Information Systems Operations and Business Resilience (26%) and Protection of Information Assets (26%), per ISACA's 2024 outline.

What is the CISA passing score, and is 450 the same as 56 percent?

Passing is a scaled 450 on a 200-to-800 range. It is not 56 percent or any fixed number of correct answers, because ISACA adjusts for the difficulty of your question set. Aim for consistent passes with room to spare on full-length practice.

How many questions are on the CISA exam?

150 multiple-choice questions in 4 hours, about 96 seconds per question. There is no penalty for wrong answers, so answer every question.

Do I need experience to sit the CISA exam?

No. Experience is required to certify, not to test. You need five years within the ten years before applying, waivers can cover up to three, and you must apply within five years of passing. Students in an ISACA partner program can hold the CISA Associate designation meanwhile.

Is the CISA worth it?

For IT auditors, GRC analysts and aspiring security leaders, usually yes. For hands-on engineers staying technical, a technical certification signals more. It pays off most when your target role is audit, controls or governance.

Is ISACA membership worth it for the CISA?

Often. The member exam rate is $185 lower and the annual maintenance fee is $40 lower every year, which can offset the membership fee, especially if you plan further ISACA certifications. Compare the totals for your situation.

Related on PrepClubs

• CISA practice questions, question types and study plan: four more worked questions, the FIRST, BEST and GREATEST qualifiers, and a 10 to 12 week plan.
• CISSP vs CISA: security leadership versus IS audit, and which fits your path.
• CISSP exam format: how the other senior security exam is built, if you are weighing both.

Pass the CISA on the first attempt

With the full fee due on every sitting and a 30-day minimum wait after a fail, the cheapest CISA is the one you pass first time. PrepClubs' CISA track has 10 full-length, 150-question practice tests plus a 25-question diagnostic, weighted to the five domains like the real exam, with a written rationale on every question that models the auditor judgment ISACA scores. More than 3,700 students have prepared with PrepClubs, and the track is backed by our Money-back Guarantee. Practice at prepclubs.com/tests/cisa.