CISA study guide · 2026

The 5 CISA domains, explained

5 domains and 60 official sub-topics. Information Systems Operations and Business Resilience carries the most weight at 26%. Each guide explains what the domain covers, how its questions are framed and where candidates lose marks.

Start with Domain 4 See all domains
Questions
150
Time
4 hours (240 minutes)
Passing score
450 on a 200–800 scaled score
Outline
CISA Job Practice (Exam Content Outline), effective August 1, 2024 (current)

Exam blueprint

Bar widths follow the official weights. Weight ranges are drawn at their midpoint.

  1. 1 18%
  2. 2 18%
  3. 3 12%
  4. 4 26%
  5. 5 26%
  1. 1 Information Systems Auditing Process
  2. 2 Governance and Management of IT
  3. 3 Information Systems Acquisition, Development and Implementation
  4. 4 Information Systems Operations and Business Resilience
  5. 5 Protection of Information Assets

All 5 domains

60 official sub-topics 170–230 hrs suggested study

  1. Domain 01 18%

    Information Systems Auditing Process

    How an IS audit is planned, executed and reported under ISACA's standards. This domain teaches the auditor's mindset that the other four domains test: independence, evidence first, and risk driving every decision.

    Inside this domain

    • IS Audit Standards, Guidelines, and Codes of Ethics
    • Types of Audits, Assessments, and Reviews
    • Risk-Based Audit Planning
    • Types of Controls and Considerations
    • and 6 more sub-topics

    Watch for Fixing instead of reporting

    Sub-topics
    10
    Questions est.
    ~27
    Study time est.
    30–40 hrs
  2. Domain 02 18%

    Governance and Management of IT

    How the board and management direct, resource and measure IT, and how an IS auditor judges whether that direction serves the business. Expect questions that reward accountability and alignment over technical detail.

    Inside this domain

    • Laws, Regulations, and Industry Standards
    • Organizational Structure, IT Governance, and IT Strategy
    • IT Policies, Standards, Procedures and Practices
    • Enterprise Architecture and Considerations
    • and 7 more sub-topics

    Watch for Technical fix for a governance gap

    Sub-topics
    11
    Questions est.
    ~27
    Study time est.
    30–40 hrs
  3. Domain 03 12%

    Information Systems Acquisition, Development and Implementation

    How systems are justified, built or bought, tested and moved into production, and where an IS auditor adds value along the way. The smallest domain, but full of sequencing questions about what must happen before go-live.

    Inside this domain

    • Project Governance and Management
    • Business Case and Feasibility Analysis
    • System Development Methodologies
    • Control Identification and Design
    • and 4 more sub-topics

    Watch for Right activity, wrong stage

    Sub-topics
    8
    Questions est.
    ~18
    Study time est.
    20–30 hrs
  4. Domain 04 26%

    Information Systems Operations and Business Resilience

    The joint-heaviest CISA domain: how IT is run day to day and how the business keeps operating when it fails. Expect scenarios where the right answer comes from business impact, not from the most expensive technology.

    Inside this domain

    • IT Components
    • IT Asset Management
    • Job Scheduling and Production Process Automation
    • System Interfaces
    • and 12 more sub-topics

    Watch for Gold-plated recovery

    Sub-topics
    16
    Questions est.
    ~39
    Study time est.
    45–60 hrs
  5. Domain 05 26%

    Protection of Information Assets

    The joint-heaviest CISA domain: the controls that protect information assets and the processes that detect and respond to attacks. You audit security here, so the exam rewards knowing which control fits which risk and how to prove it works.

    Inside this domain

    • Information Asset Security Frameworks, Standards, and Guidelines
    • Physical and Environmental Controls
    • Identity and Access Management
    • Network and End-Point Security
    • and 11 more sub-topics

    Watch for Encryption for nonrepudiation

    Sub-topics
    15
    Questions est.
    ~39
    Study time est.
    45–60 hrs

Study the heaviest domains first

Marks follow weight. This order puts the most marks behind you first, across about 170–230 hrs of study.

  1. 4 Information Systems Operations and Business Resilience 26% · 45–60 hrs
  2. 5 Protection of Information Assets 26% · 45–60 hrs
  3. 1 Information Systems Auditing Process 18% · 30–40 hrs
  4. 2 Governance and Management of IT 18% · 30–40 hrs
  5. 3 Information Systems Acquisition, Development and Implementation 12% · 20–30 hrs

Try one

Practice questionDomain 4: Information Systems Operations and Business Resilience

A BIA states that an online ordering system can lose no more than 15 minutes of transactions and can be unavailable for up to 48 hours. Which recovery arrangement BEST meets these requirements at the lowest cost?

One trap from every domain

The answer that looks right, and the clue that gives it away.

  • Domain 1

    Fixing instead of reporting

    Clue The question asks what the IS auditor should do; look for report, recommend, or discuss with management.

  • Domain 2

    Technical fix for a governance gap

    Clue Look for complaints from business units, missing approvals or unclear ownership; those signal a governance answer.

  • Domain 3

    Right activity, wrong stage

    Clue Find the stage words: feasibility, design, testing, cutover or after go-live.

  • Domain 4

    Gold-plated recovery

    Clue If RTO and RPO values are given, find the cheapest option that meets both.

  • Domain 5

    Encryption for nonrepudiation

    Clue Words such as cannot deny sending or prove origin point to a digital signature.

Other Cybersecurity certifications

Study guides for exams that overlap with CISA.

Practise what you read

CISA domains: common questions

How many domains are in the CISA exam?

CISA has 5 domains with 60 official sub-topics between them: Information Systems Auditing Process, Governance and Management of IT, Information Systems Acquisition, Development and Implementation, Information Systems Operations and Business Resilience and Protection of Information Assets.

Which CISA domain carries the most weight?

Information Systems Operations and Business Resilience is the heaviest at 26%, followed by Protection of Information Assets (26%). The lightest is Information Systems Acquisition, Development and Implementation (12%). Weights come from ISACA's official outline.

What is the CISA exam format?

Questions: 150. Time allowed: 4 hours (240 minutes). Passing score: 450 on a 200–800 scaled score.

How long should I study for CISA?

Our planning estimate is 170–230 hrs across all domains, split by weight. It is an editorial estimate, not an official figure, so adjust it to your experience and to how you score on practice questions.

Where should I start?

Start with Information Systems Operations and Business Resilience, because it carries the most marks, then work down by weight. Use the checklist on each domain page to confirm you can do what the domain asks before moving on.

Which outline is this guide based on?

This guide follows CISA Job Practice (Exam Content Outline), effective August 1, 2024 (current), published by ISACA. It was last reviewed in October 2026.

Domain names, weights and sub-topics come from ISACA's official outline (CISA Job Practice (Exam Content Outline), effective August 1, 2024 (current)). Question counts and study hours are editorial planning estimates, not official figures. Last reviewed October 2026.