What are the CISA certification requirements in 2026?

You need three things: pass the CISA exam, submit your certification application within five years of the passing date, and show five years of professional information systems auditing, control or security work. That experience must fall inside the 10 years before you apply. A Bachelor's or Master's degree removes one year, and one of CISA, CISM, CPA, CMA, CFE or CISSP removes another. Holding both leaves you needing three years of experience.

Can I meet the CISA certification requirements without five years of IT audit experience?

Yes, often with fewer years than you expect. Four years of experience plus a Bachelor's or Master's degree qualifies. So do four years plus one of CISA, CISM, CPA, CMA, CFE or CISSP. Three years plus a degree and one of those certifications also qualifies. The rule you must not miss is recency. ISACA only counts experience from the 10 years preceding your application, so older work can expire while you wait.

What does the CISA certification cost in total, not just the exam?

The exam is US$575 for ISACA members and US$760 for non-members, plus a US$50 application processing fee. Add professional membership at US$145 a year plus chapter dues, and an annual maintenance fee of US$45 for members or US$85 for non-members. Over three years that is US$1,195 as a member and US$1,065 as a non-member. Membership is cheaper until about month 21, then it costs about US$105 more each year.

How long do I have to apply for the CISA after passing the exam?

You have five years from the passing date to submit your certification application, and ISACA states you must pass the exam within the last five years. The application fee of US$50 is charged at that point. Watch the second clock as well. Your qualifying experience must fall inside the 10 years before you apply, so a long gap between passing and filing can leave you short.

Does anything make the CISA mandatory for me?

For US Department of Defense roles, yes. On 21 May 2024, ISACA announced that CISA and CISM are approved qualifications under the DoD 8140.03 Cyberspace Workforce Qualification and Management Program, covering authorized work roles. ISACA does not state a mandate for other jobs on the pages used here, so check each job posting. ISACA also reports a US$149K+ average annual salary for CISA holders, which is its own figure.

CISA Certification Requirements

What are the CISA certification requirements for 2026 candidates?

CISA stands for Certified Information Systems Auditor. ISACA, the Information Systems Audit and Control Association, issues the credential. The CISA certification requirements have three parts, each with its own deadline.

The first part is the exam. The second is the application. ISACA's Earn a CISA certification page says you must pass the exam within the last five years. You then file your application inside that window.

The third part is the work history. You need at least five years of professional information systems auditing, control or security work. The catch is recency. That experience has to fall inside the 10 years before you apply. Work you did 12 years ago no longer counts.

Pass the exam - computer-based, at a PSI center or remote
Apply within five years of passing
Show five years of qualifying work within the last 10 years

You do not always owe five full years. ISACA's matrix lets a degree or an accepted certification remove one year, and holding both removes two. The accepted certifications are CISA, CISM, CPA, CMA, CFE and CISSP.

The areas the exam tests are covered in what is CISA certification.

How many years of experience do you still owe?

Read the matrix as simple addition. The CISA certification requirements start from a five-year base. Add one year for a Bachelor's or Master's degree, and one more for one of the six accepted certifications. Whatever the total falls short of five, you still owe.

Relevant experience you already have	Bachelor's or Master's degree?	Other cert (CISA/CISM/CPA/CMA/CFE/CISSP)?	Years still needed to qualify
5 years	No	No	0 - qualify now
4 years	No	No	1 more year
3 years	No	No	2 more years
2 years	No	No	3 more years
4 years	Yes	No	0 - qualify now
4 years	No	Yes	0 - qualify now
3 years	Yes	Yes	0 - qualify now
2 years	Yes	Yes	1 more year

Work the table from the top. A candidate with three years of experience and no degree still owes two years. The same candidate with a degree and a CISSP already qualifies. If the CISSP is still on your plan, CISSP certification requirements follow a separate matrix.

Job practice domain	Weighting	Questions out of 150
Information Systems Auditing Process	18%	27
Governance & Management of IT	18%	27
Information Systems Acquisition, Development & Implementation	12%	18
Information Systems Operations & Business Resilience	26%	39
Protection of Information Assets	26%	39
Total	100%	150

Operations and resilience and protection of assets each carry 26 percent, or 78 of the 150 questions together. Auditing process and governance add 27 each. Acquisition and development is smallest at 18.

What does the CISA certification cost over three years?

The exam fee is the number most pages quote, and it is only part of the bill. ISACA charges US$575 for members and US$760 for non-members. A US$50 application processing fee follows when you apply after passing.

Two more bills keep coming. ISACA professional membership costs US$145 a year, plus local chapter dues that vary by location. Every holder also pays an annual maintenance fee, due by January 1, of US$45 for members and US$85 for non-members.

Add those lines across a three-year reporting cycle and the two paths look like this.

Cost line	ISACA member	Non-member
Exam fee	$575	$760
Certification application fee	$50	$50
ISACA dues (3 years at $145/yr)	$435	$0
Annual maintenance fee (3 years)	$135	$255
Total for 3 years	$1,195	$1,065
Year 1 only	$815	$895
Membership break-even	Cheaper until month ~21, then $105/yr more expensive	Cheaper from year 2 onward

Membership is the line to watch. As a member you save US$185 on the exam, once. You also pay US$145 a year in dues, and you save US$40 a year on the maintenance fee. Over three years, that leaves a non-member US$130 cheaper.

The crossover sits near month 21. In year one a member pays US$815 against US$895. From year two the member pays US$190 a year against US$85, so the member runs US$105 a year behind. ISACA's maintain your CISA certification page sets the maintenance fee and CPE rules.

Two things can flip that. ISACA lists student membership at US$25 a year and recent-graduate membership at US$68 a year, both plus chapter dues. Members also earn 72 or more free CPE credits. A third ISACA certification drops the maintenance fee to US$25 for members and US$50 for non-members.

For the full line-by-line breakdown, see CISA certification cost in 2026.

What happens after you pass?

CPE means Continuing Professional Education. It is the training you complete to keep a credential current. You need at least 120 CPE hours related to CISA over a three-year reporting period. You also need 20 hours in each year. Falling short can lead to revocation of your CISA designation.

For members, the arithmetic is easier. ISACA lists 72 or more credits of free CPE. A member still has to source about 48 of the 120 hours. A non-member has to find all 120.

Two deadlines sit next to each other. The annual maintenance fee is due by January 1 each year. And you have five years from the passing date to file the certification application, with the US$50 processing fee attached.

Plan the hours early. Do not leave CPE hunting to December.

Who is required to hold the CISA?

For US federal work, there is a firm rule. On 21 May 2024, ISACA announced that CISA and CISM are approved qualifications for DoD work. DoD stands for the Department of Defense. The ISACA press release names the DoD 8140.03 Cyberspace Workforce Qualification and Management Program.

That approval covers authorized DoD work roles. It is not a general rule for every security job.

Outside that setting, check each job posting. ISACA reports a US$149K+ average annual salary for CISA holders. That is ISACA's own figure, not an independent survey, and it is no promise for any one candidate.

What should you do next?

Start with four checks.

List your experience years - write down each role and its dates
Mark any year outside the 10-year window - those years do not count
Add your offsets - one year for a Bachelor's or Master's, one more for CISA, CISM, CPA, CMA, CFE or CISSP
Book the exam - you have six months from registration to sit it, and five years after passing to apply

You qualify when your experience, your degree and your accepted certifications add up to five years. Every counted year must sit inside the 10-year window before you apply. The credential costs US$1,195 as a member or US$1,065 as a non-member across three years. Members pay about US$105 more each year from year two. They can cover 72 of the 120 CPE hours with free credits.

Photo: Tumisu, Pixabay Content License, via Pixabay (https://pixabay.com/photos/audit-accounting-ledger-figures-4190945/)

CISA Certification Requirements - Do You Qualify?

What are the CISA certification requirements for 2026 candidates?

Related Articles

CISM Certification Requirements - Do You Qualify?

ITIL Certification How Long Does It Take - Which Route?

AWS Developer Associate vs Solutions Architect - Which One?

CompTIA Network+ vs CCNA - Which Exam Comes First?

Try It in the Browser

How many years of experience do you still owe?

What does the CISA exam look like?

What does the CISA certification cost over three years?

What happens after you pass?

Who is required to hold the CISA?

What should you do next?

CCSP vs CISSP - Which One Should You Take First?

CKAD vs CKA - Which Kubernetes Exam Fits Your Job?