ISACA certifications

ISACA's two flagship exams certify different jobs. CISA — Certified Information Systems Auditor — is built around five job-practice domains from the auditing process through governance, systems acquisition, operations and resilience, and protection of information assets; it is the credential for IT auditors and assurance professionals. CISM — Certified Information Security Manager — covers four domains: governance, risk management, the security program and incident management, and is the credential for people who run security functions rather than audit them.

Both are experience-gated. You may sit either exam without the experience, but ISACA grants the certification only after verifying years of relevant professional work, with substitutions for education and other credentials. Exams are delivered through PSI, in person or by online remote proctoring, scored on a scale with a published passing score, and priced differently for ISACA members and non-members. Both certifications are kept through ISACA's continuing professional education policy and an annual maintenance fee.

ISACA's exams are offered in continuous testing windows through the year rather than on fixed dates; registration is valid for a set period during which you schedule with PSI, and a preliminary result appears on screen at the end of the session with the official report following. Certification maintenance is an annual obligation: continuing professional education hours reported each year and across a rolling multi-year cycle, plus the annual fee, with ISACA auditing a sample of reported hours.

How to use this family page: choose audit or management, open the exam guide for the domain weights, and work the practice sets by domain — the two exams overlap in governance but diverge sharply elsewhere. Register as a member if you will sit either exam, since the fee difference is large, and start documenting experience early because the certification waits on it.