| CISA exam domain | Weight | Aligned CPE hours |
|---|
| Domain 1 - Information System Auditing Process | 18% | 90 x 18% = 16.2 |
| Domain 2 - Governance & Management of IT | 18% | 90 x 18% = 16.2 |
| Domain 3 - Information Systems Acquisition, Development & Implementation | 12% | 90 x 12% = 10.8 |
| Domain 4 - Information Systems Operations & Business Resilience | 26% | 90 x 26% = 23.4 |
| Domain 5 - Protection of Information Assets | 26% | 90 x 26% = 23.4 |
| Total | 100% | 90 aligned hours |
These targets are a suggested allocation for your own planning. ISACA sets the 90-hour floor, not the split. Domains 4 and 5 carry 26% each, so they take 23.4 hours each. Domains 1 and 2 take 16.2 hours each. Domain 3 takes 10.8.
What does renewing a CISA cost over three years?
Maintenance fees are set per certification and per year. The first and second ISACA certifications cost US$45 a year for members. Non-members pay US$85. A third or subsequent certification drops to US$25 and US$50.
Multiply the annual fee by three to price a full cycle. US$45 x 3 gives US$135 for a member with one certification. US$85 x 3 gives US$255 for a non-member. Two certifications at the full rate come to US$270 for a member over three years, and US$510 for a non-member. A third certification costs US$75 for a member over three years, and US$150 for a non-member. These figures leave out ISACA membership dues, which are priced separately, so a member saves less than the fee gap suggests.
| ISACA certification | Member per year | Non-member per year | Member per three years | Non-member per three years |
|---|
| First ISACA certification | US$45 | US$85 | US$135 | US$255 |
| Second ISACA certification | US$45 | US$85 | US$135 | US$255 |
| Third or subsequent certification | US$25 | US$50 | US$75 | US$150 |
| One CISA plus one CISM | US$90 | US$170 | US$270 | US$510 |
Membership also lowers the exam price. The CISA exam is US$575.00 for members and US$760.00 for non-members, a difference of US$185. A separate one-time US$50 application processing fee applies after you pass. If you are taking the exam and renewing, compare CISA certification cost in 2026 with your three-year fee total. A second credential follows the same arithmetic, as shown in CISM certification cost in 2026.
Entry tiers cost less again. ISACA student membership is US$25 a year. Recent Graduate membership is US$68 a year. Both come plus local chapter dues, and both include free CPE credits.
Which activities earn CPE hours?
The ISACA How to Earn CPE page lists eligible activities and their caps. Self-study counts only with a provider-issued completion certificate.
- ISACA webinars and Virtual Instructor-Led Trainings - up to 36 free credits a year; quizzes are members only
- Qualifying university course - 15 CPE per semester credit hour, 10 per quarter
- Vendor sales or marketing presentation - capped at 10 CPE a year, and it stops qualifying from 2027
- Mentoring - 1 CPE per assistance hour, 10-hour annual limit
- Exam-question development - 2 CPE per question accepted by ISACA
- Chapter volunteering - 1 CPE per active hour, 20 a year and 60 per three years when exam aligned
Passing a related professional exam earns 2 CPE per examination hour, with no limit.
What evidence does an ISACA CPE audit require?
ISACA selects holders at random for the annual CPE audit. If you are selected, you must provide supporting documentation for every activity you reported in the relevant calendar year. Each record should identify five things.
- Attendee - your name on the record
- Sponsoring organization - who ran it
- Activity title and description - what it covered
- Activity date - when it took place
- CPE hours awarded or claimed - hours worth
Acceptable evidence is a letter, a completion certificate, an attendance roster, a Verification of Attendance form, or another independent completion attestation. Keep that file for 12 months after each three-year cycle ends.
If a CPE-related revocation happens, you can appeal it with a written explanation and your supporting documentation. Reinstatement costs the outstanding maintenance fees plus US$50 per certification.
What should you do next?
Four short steps cover the rest of this cycle.
- Check your logged years against the 20-hour annual minimum.
- Mark the 90-hour aligned block for the cycle starting 1 January 2027.
- Split your activity list across the five CISA domains.
- Save one evidence record per activity.
To recap, the CISA renewal requirements for 2026 stay simple: 20 hours a year and 120 across the cycle. The 2027 policy adds one filter, because 90 of the 120 hours must match the exam outline. Membership decides what you pay and whether you can claim the 36 free credits a year. If you still compare credentials, best cybersecurity certifications for 2026 sets out the other options.
Photo: stevepb, Pixabay Content License, via Pixabay (https://pixabay.com/photos/time-clocks-hourglass-2387976/)
Fazlur Rahman
