What is covered on the CISA exam?

Providing industry-standard audit services to assist organizations in protecting and controlling information systems, Domain-1 affirms your credibility to offer conclusions on the state of an organization’s IS/IT security, risk and control solutions.

This domain confirms to stakeholders your abilities to identify critical issues and recommend enterprise-specific practices to support and safeguard the governance of information and related technologies.

Domains 3 and 4 offer proof not only of your competency in IT controls, but also your understanding of how IT relates to business.

Domains 3 and 4 offer proof not only of your competency in IT controls, but also your understanding of how IT relates to business.

Cybersecurity now touches virtually every information systems role, and understanding its principles, best practices and pitfalls is a major focus within Domain 5.

1. Plan an audit to determine whether information systems are protected, controlled, and provide value to the organization. 
2. Conduct audits in accordance with IS audit standards and a risk based IS audit strategy. 
3. Apply project management methodologies to the audit process. 
4. Communicate and collect feedback on audit progress, findings, results, and recommendations with stakeholders. 
5. Conduct post-audit follow up to evaluate whether identified risk has been sufficiently addressed. 
6. Utilize data analytics tools to enhance audit processes. 
7. Evaluate the role and/or impact of automatization and/or decision-making systems for an organization.  
8. Evaluate audit processes as part of quality assurance and improvement programs. 
9. Evaluate the IT strategy for alignment with the organization's strategies and objectives. 
10. Evaluate the effectiveness of IT governance structure and IT organizational structure. 
11. Evaluate the organization's management of IT policies and practices, including compliance with legal and regulatory requirements. 
12. Evaluate IT resource and project management for alignment with the organization's strategies and objectives. 
13. Evaluate the organization's enterprise risk management (ERM) program. 
14. Determine whether the organization has defined ownership of IT risk, controls, and standards. 
15. Evaluate the monitoring and reporting of IT key performance indicators (KPIs) and IT key risk indicators (KRIs). 
16. Evaluate the organization's ability to continue business operations. 
17. Evaluate the organization's storage, backup, and restoration policies and processes. 
18. Evaluate whether the business cases related to information systems meet business objectives. 
19. Evaluate whether IT vendor selection and contract management processes meet business, legal, and regulatory requirements. 
20. Evaluate supply chains for IT risk factors and integrity issues.
21. Evaluate controls at all stages of the information systems development life cycle. 
22. Evaluate the readiness of information systems for implementation and migration into production. 
23. Conduct post-implementation reviews of systems to determine whether project deliverables, controls, and requirements are met. 
24. Evaluate whether effective processes are in place to support end users. 
25. Evaluate whether IT service management practices align with organizational requirements. 
26. Conduct periodic review of information systems and enterprise architecture (EA) to determine alignment with organizational objectives.
27. Evaluate whether IT operations and maintenance practices support the organization's objectives. 
28. Evaluate the organization's database management practices. 
29. Evaluate the organization's data governance program. 
30. Evaluate the organization's privacy program. 
31. Evaluate data classification practices for alignment with the organization's data governance program, privacy program, and applicable external requirements. 
32. Evaluate the organization's problem and incident management program. 
33. Evaluate the organization's change, configuration, release, and patch management programs. 
34. Evaluate the organization's log management program. 
35. Evaluate the organization's policies and practices related to asset life cycle management. 
36. Evaluate risk associated with shadow IT and end-user computing (EUC) to determine effectiveness of compensating controls. 
37. Evaluate the organization's information security program. 
38. Evaluate the organization's threat and vulnerability management program. 
39. Utilize technical security testing to identify potential vulnerabilities. 
40. Evaluate logical, physical, and environmental controls to verify the confidentiality, integrity, and availability of information assets. 
41. Evaluate the organization's security awareness training program. 
42. Provide guidance to the organization in order to improve the quality and control of information systems. 
43. Evaluate potential opportunities and risks associated with emerging technologies, regulations, and industry practices.