Overview
ISACA certifies professionals in IT audit, information security management, IT risk and governance. CISA (IT audit) and CISM (security management) are its best-known credentials. Exams are taken at PSI test centres or online with remote proctoring.
Who it is for
- IT auditors and internal auditors (CISA)
- Information security managers (CISM)
- Risk and control professionals (CRISC)
- IT governance leaders (CGEIT) and privacy engineers (CDPSE)
Versions
CISA
Certified Information Systems Auditor.
CISM
Certified Information Security Manager.
CRISC
Certified in Risk and Information Systems Control.
CGEIT
Certified in the Governance of Enterprise IT.
CDPSE
Certified Data Privacy Solutions Engineer. 120 questions, 3.5 hours.
Where it is accepted
- IT audit jobs in banks, Big Four firms and the public sector
- Information security management roles
- Regulatory and audit requirements that name CISA or CISM
Always check the current requirements of the university, employer, regulator or visa authority you are applying to.
Test format
| Section | What it involves |
|---|---|
| CISA, CISM, CRISC, CGEIT | 150 multiple-choice questions. 4 hours (240 minutes). |
| CDPSE | 120 multiple-choice questions. 3.5 hours (210 minutes). |
Total time: 4 hours (CISA, CISM, CRISC, CGEIT); 3.5 hours (CDPSE).
Scores and validity
- Scoring
- Scaled score from 200 to 800. 450 or more passes.
- Validity
- Holders must earn at least 20 CPE hours a year and 120 over each three-year period, and pay an annual maintenance fee. Candidates have five years from passing the exam to apply for certification.
How long results take is shown at the top of this page.
Fees
CISA exam, ISACA member (USD)
USD 575
Source (opens in a new tab)CISA exam, non-member (USD)
USD 760
Source (opens in a new tab)CISM exam, member / non-member (USD)
USD 575 / USD 760
Source (opens in a new tab)Certification application processing fee, after passing (USD)
USD 50
Source (opens in a new tab)
| Item | Official fee | Source |
|---|---|---|
| CISA exam, ISACA member (USD) | USD 575 | Source (opens in a new tab) |
| CISA exam, non-member (USD) | USD 760 | Source (opens in a new tab) |
| CISM exam, member / non-member (USD) | USD 575 / USD 760 | Source (opens in a new tab) |
| Certification application processing fee, after passing (USD) | USD 50 | Source (opens in a new tab) |
Fees are set by the test owner, were checked on 21 October 2026, and can change. Confirm the price when you book. GAPICT never takes exam fees.
On test day
Identification
One current, original, government-issued ID showing name, signature and photograph. The name must match the exam registration.
Arrive early, bring only what the test owner allows, and expect identity checks and a photo at check-in. Read our test day guide and exam day FAQs.
How to book
Exam seats for ISACA are booked and paid on the test owner's own system. Delivered through: PSI.
- 1
Register and pay on isaca.org, then schedule with PSI at a test centre or for remote proctoring.
- 2
Create or sign in to your account on the official booking site.
- 3
Choose your exam, then a test centre, date and time.
- 4
Pay the exam fee to the test owner and keep your confirmation email.
- 5
Check the ID rules and arrive early on test day.
You book and pay on PSI's test-taker site. Rescheduling rules depend on the exam.
Need help booking?
We can walk you through the test owner's registration, step by step.
GAPICT's status with these organisations
- PSIEnquiry made
ISACA FAQs
How many times can I sit the exam?
Is experience needed?
Can I take the exam online?
Is there a penalty for wrong answers?
Sources
Facts on this page were checked against these official sources on 21 October 2026. If anything here differs from the test owner's website, the owner's website is correct.
- ISACA CISA (opens in a new tab)
- ISACA CISM (opens in a new tab)
- ISACA Exam Candidate Guide 2026 (PDF) (opens in a new tab)
- ISACA CPE Policy (PDF) (opens in a new tab)
PSI and the PSI logo are registered trademarks of PSI Services LLC.
ISACA and related names are trademarks of their owners and are used here only to describe the test. GAPICT is independent of ISACA, is not endorsed by it, and is not currently an authorised centre for this test.