Is the CISA certification worth it?
3 of 8,110 cybersecurity analyst job ads in the United States name the CISA (Adzuna, October 2026)
The answer to "is CISA certification worth it" is yes for people who audit IT systems. For beginners, the CISA (Certified Information Systems Auditor) comes later: the title needs five years of experience, and education can replace up to three.
The CISA is the audit credential of ISACA, a professional association for IT audit, risk and governance. Auditing here means checking that a company's IT controls (the rules, settings and procedures that keep systems and data reliable and secure) actually work.
Verdict by situation:
- Years in IT audit, internal controls, risk or compliance already: take it. Its five subject areas describe your work. Security years count too, but if you want to stay technical, see the fourth point.
- A student or recent graduate aiming at audit or GRC work (governance, risk and compliance: teams that set policies, assess risk and check that rules are followed), for example as an IT auditor: you can take the exam now. A bachelor's degree waives two years, so after a pass you need three years of qualifying work, within five years of the pass.
- No IT, audit or security job yet: start with an entry-level security certificate such as CompTIA Security+ (a beginner security exam) and search for junior IT support, IT audit or compliance jobs.
- You want to stay in hands-on technical security work: the CISA tests audit, so look at the technical options in the comparison section.
- You run, or want to run, a company's security team and policies: the CISM (Certified Information Security Manager), ISACA's security-manager credential, fits that job and has its own experience rule.
Your first step: add your years in IT audit, controls or security to the waiver for your degree in the experience section. If they add up to five, and you can show them within five years of passing, book the exam. No years yet? Start with the third point above.
The exam costs $760, or $575 for ISACA members; the three-year cost is in the cost section. Our job-ad figures, including small UK, Indian and Brazilian samples, are in the job-ads section (how we count ads).
Jump to: experience rule · cost · comparison with other credentials
Show the numbers
| Item | Ads | Share of ads |
|---|---|---|
| SIEM | 415 | 5.1% |
| CISSP | 338 | 4.2% |
| CompTIA | 162 | 2.0% |
| CISM | 134 | 1.7% |
| CompTIA CySA+ | 119 | 1.5% |
| CompTIA Security+ | 112 | 1.4% |
| Splunk | 100 | 1.2% |
| CEH | 81 | 81 of 8,110 |
| CISA | 3 | 3 of 8,110 |
Is CISA worth it for you?
Instant answer from October 2026 job ads. No email needed.
Rarely named
3 of 8,110 cybersecurity analyst job ads in the United States name CISA.
- Most-named alternative
- CISSP 4.2%
- Skill asked for most
- SIEM 5.1%
- Official exam fee
- $575 member, $760 non-member source
Source: Adzuna job ads, October 2026.
Get your full report
Two optional questions shape your first step. No email needed.
On this page
- Is the CISA certification worth it in 2026? What security-analyst ads show
- Do you need experience before taking the CISA exam?
- How much does the CISA cost?
- How hard is the CISA, and how long does it take?
- Does the CISA expire? Renewal and CPE
- What is the CISA certification salary?
- How does the CISA compare with the CISM, CISSP, CIA and CPA?
- Is the CISA worth it? What Reddit posters ask
- What we did not check
- Sources
Is the CISA certification worth it in 2026? What security-analyst ads show
For audit jobs, our count cannot answer that: it covers security-analyst ads only, and audit, IT-audit and GRC ads, the CISA's main market, are not in our sample. Read our figures as how often employers hiring security analysts spell out the CISA's title, not as proof that the CISA pays off.
We count how often employers name a certificate in ads for one role in each country, using the local job title. For the CISA, that role is security analyst, the nearest role our sample covers, and the phrase we search for is the full title certified information systems auditor. Of the 8,110 US security-analyst ads we counted in October 2026 (Adzuna), 3 contained that phrase.
Ads that write only the acronym are not counted, so this is a lower bound.
The UK and Indian samples are small. The full title appeared in 2 of 235 UK security-analyst ads and in 2 of 250 Indian ones in October 2026 (Adzuna). A single posting moves these figures, so read them as a rough signal, not a ranking of countries. In Brazil, the English title appeared in none of the 434 analista de segurança (security analyst) ads in October 2026 (Adzuna); in Mexico, Spain and Italy, the samples were too small to report.
Is the CISA worth it in India?
In India, the test is the same as elsewhere: the audit or GRC roles you want name it, and you can show the years. The ISACA rules we read have no India-specific version, and our small Indian sample says little about Indian demand.
US government work
One fact outside our count is relevant to US defense work. In a press release dated May 21, 2024, ISACA announced that the CISA is approved for use with DoD Manual 8140.03, the US Department of Defense's rules on which qualifications its cyber workforce needs. The release, as we read it, does not say which DoD work roles accept the CISA, so check the role you want with the hiring office.
Do you need experience before taking the CISA exam?
You can take the CISA exam without experience; you need the experience for the title. ISACA certifies you only after you show five years of relevant work (ISACA support article on CISA requirements).
The rules on ISACA's Get CISA certified page and its support article on CISA requirements:
- Five years of professional information systems auditing, control or security work, as described in the CISA job practice areas (ISACA's name for the five exam subject areas).
- The work must fall within the 10 years before the date you apply for certification.
- You have five years from the date you pass the exam to apply.
- The experience must cover at least one of the five subject areas, and someone who knows your work, such as a supervisor, manager, colleague or client, must verify it.
- The application carries a one-time $50 processing fee.
ISACA's exam candidate guide caps experience waivers (years of the requirement that ISACA lets education replace) at three years. Only one education waiver applies, and ISACA asks for documents to support it. The main education waivers:
| Education | Years it replaces |
|---|---|
| Associate degree (a two-year college degree), the IT Audit Fundamentals certificate (a course certificate in IT audit basics), or the Certificate of Cloud Auditing Knowledge (CCAK, a cloud-audit certificate) | 1 |
| Bachelor's, master's or doctorate in any field; ISACA also lists the CIMA and ACCA accountancy qualifications | 2 |
| Master's degree in information systems or a related field | 3 |
Source: ISACA support article What are the requirements to become CISA certified and ISACA's exam candidate guide.
With a bachelor's degree in any subject, you need three years of that work. With a master's in information systems, you need two. The waiver list we read names no CISSP credit, so do not count on a CISSP to cut the requirement.
Passing first is a sound plan only if you will have the work years within five years of the exam.
Show the numbers
| Item | CISA |
|---|---|
| Questions | 150 questions |
| Exam time | 240 minutes (4 h) |
| Passing score | 450 (scale 200–800) |
| Format | Multiple choice |
| Where you take it | test center · online, proctored |
How much does the CISA cost?
The exam costs $760, or $575 for ISACA members, plus a one-time $50 application fee and an annual maintenance fee of $85 for non-members or $45 for members (ISACA, US dollars, read October 11, 2026).
| Item | ISACA member | Non-member | When you pay |
|---|---|---|---|
| Exam registration | $575 | $760 | Each attempt |
| Application processing fee | $50 | $50 | Once, after you pass |
| Annual maintenance fee | $45 | $85 | Every year you hold it |
| ISACA professional membership | $145 to join, plus local chapter dues; renewal price not checked | None | When you join |
Source: ISACA CISA page, Get CISA certified, Maintain CISA certification and professional membership pages, and ISACA's exam candidate guide. Analysis: CertWorthIt.
Over the first three years with one exam attempt, a non-member pays $1,065: $760 for the exam, $50 to apply and three yearly maintenance fees of $85 ($255). A member pays $760 in fees ($575 exam, $50 application, three fees of $45), plus $145 to join ISACA and dues for a local chapter (a regional branch), so at least $905. Both sums assume the annual fee starts at certification, which we did not check.
Joining saves $185 on the exam, so it pays off in the exam year only if $145 plus your chapter's dues come to less than $185. After that, membership saves $40 a year on maintenance, against a renewal price we did not check.
Each retake costs the full registration fee, so a non-member who passes on the second attempt pays $1,520 in exam fees alone. ISACA's candidate guide gives you six months after registering to take the exam; one extension costs $75. Training courses and books are extra.
ISACA charges less to maintain a third or later ISACA certification: $25 a year for members and $50 for non-members. That matters only if you also hold two other ISACA credentials, such as the CISM and the CRISC (Certified in Risk and Information Systems Control, ISACA's risk credential).
Show the numbers
| Item | Fee |
|---|---|
| Fees to get certified: Exam | $760 |
| Fees to get certified: Annual fee, $85 a year × 3 years | $255 |
How hard is the CISA, and how long does it take?
ISACA publishes no pass rate on the pages we read, so the format is the best guide to difficulty. The exam has 150 multiple-choice questions in four hours (240 minutes), and you need a scaled score of 450 on a scale of 200 to 800 (ISACA's CISA page and scoring article). A scaled score is your raw result converted to a common scale, not a percentage.
You can take the exam at a PSI test center (PSI is the testing company ISACA uses) or remotely proctored, meaning online with a live supervisor watching through your webcam. The language table in ISACA's candidate guide lists English, Spanish, Simplified Chinese, French, German, Korean and Japanese for the CISA; we did not check which languages each delivery method offers.
The exam covers five subject areas, which ISACA calls domains, in the outline that took effect in August 2024:
| Domain | Weight | In plain words |
|---|---|---|
| Information systems auditing process | 18% | Planning and running an IT audit |
| Governance and management of IT | 18% | How leaders direct and oversee IT |
| Information systems acquisition, development and implementation | 12% | How systems are bought, built and launched |
| Information systems operations and business resilience | 26% | Running systems day to day and recovering from outages |
| Protection of information assets | 26% | Keeping data and systems secure |
Source: ISACA CISA exam content outline page; effective date from ISACA's exam candidate guide.
The last three domains, 64% of the exam together, cover how systems are built, run and secured, judged from an auditor's point of view. If you come from accounting or internal audit, they are the technical part; if you come from security, the audit process and governance domains are new ground.
ISACA's candidate guide allows four attempts in any 12-month window, with waits of 30, 90 and 90 days between them.
On time: ISACA's pages give no study-hours figure, so we report none; the content outline above is ISACA's own list of what to study. The title then waits on the work years, which you can complete after the exam.
Show the numbers
| Country | CISA | Ads | Share of ads |
|---|---|---|---|
| United Kingdom | 2 | 235 | 2 of 235 |
| India | 2 | 250 | 2 of 250 |
| United States | 3 | 8,110 | 3 of 8,110 |
| Brazil | 0 | 434 | 0 of 434 |
Does the CISA expire? Renewal and CPE
The CISA runs in three-year reporting periods, and you keep it by meeting ISACA's maintenance rules: continuing professional education (CPE: courses, conferences, webinars and similar learning, counted in hours) plus an annual fee.
ISACA asks CISA holders for at least 120 CPE hours in each three-year reporting period, with a minimum of 20 hours every year, plus the annual fee of $85, or $45 for members.
Show the numbers
| Item | |
|---|---|
| 1. Experience | 5 years of work experience |
| 2. Exam | 150 questions, 240 minutes |
| 3. Renewal | 120 CPE hours every 3 years |
Show the numbers
| Level | Certification | Experience | Named first |
|---|---|---|---|
| Entry | ISC2 CC | no work experience required | – |
| Entry | Google Cybersecurity | no work experience required | – |
| Entry | IBM Cybersecurity Analyst | beginner course (vendor) | – |
| Associate | SSCP | required: 1 year of work experience | – |
| Professional | CompTIA Security+ | recommended: 2 years of work experience | – |
| Professional | CEH | required: 2 years of work experience | – |
| Professional | CompTIA PenTest+ | recommended: 3 years of work experience | – |
| Professional | CRISC | required: 3 years of work experience | – |
| Expert | CISSP | required: 4 years of work experience on the shortest route (4–5 years, depending on the route) | – |
| Expert | CompTIA CySA+ | recommended: 4 years of work experience | – |
| Expert | CISM | required: 5 years of work experience | – |
| Expert | CISA | required: 5 years of work experience | – |
| Expert | ISO 27001 Lead Implementer / Auditor | required: 5 years of work experience | – |
| Expert | CompTIA SecurityX (CASP+) | recommended: 10 years of work experience | – |
What is the CISA certification salary?
We found no CISA certification salary figure we could source and date. ISACA's CISA page shows an average annual salary with no date and no source, so we do not repeat it, and we do not report salaries from job ads.
A salary range for holders mixes the credential with seniority, since the title follows years of qualifying work. To judge pay yourself, read a salary survey for IT-audit and GRC roles in your country, such as official pay statistics or a recruiter's salary guide, then check whether the employers you target name the CISA in their ads. Our cybersecurity-analyst page covers pay sources for the analyst role by country.
Show the numbers
| Item | |
|---|---|
| Do you have 5 years of the work experience it requires? | No: Not yet. Look at CISM (Certified Information Security Manager) first, then the CISA once you qualify. |
| Yes | Apply for the CISA exam (required fees $760). |
How does the CISA compare with the CISM, CISSP, CIA and CPA?
The right second credential, or alternative, follows the job you want.
Show the numbers
| Country | CISA | CISSP |
|---|---|---|
| India | 2 of 250 | 18% |
| United Kingdom | 2 of 235 | 12% |
| United States | 3 of 8,110 | 4.2% |
| Brazil | 0 of 434 | 4 of 434 |
CISA vs CISM
The CISM (Certified Information Security Manager) is ISACA's credential for people who run a security program; the CISA is for people who check whether controls work. ISACA's CISM requirements article, which we saw only as a search-result excerpt, lists a current CISA in good standing (with CPE hours and fees up to date) as a two-year waiver toward the CISM experience requirement. Our CISA vs CISM comparison covers the choice in detail.
CISA vs CISSP
The CISSP (Certified Information Systems Security Professional) is the broad security credential of ISC2, a security certification body, with its own entry rules on our CISSP page. Which to take first follows the job: audit work, the CISA; broad security work, the CISSP. Our CISA vs CISSP comparison covers the order. For hands-on technical work such as testing systems for weaknesses, the CEH (Certified Ethical Hacker) is closer to the job than either.
CISA vs CIA
The CIA (Certified Internal Auditor) is the internal-audit credential of the IIA (Institute of Internal Auditors). Internal audit reviews a whole organization's processes, finances and risks; the CISA overlaps with the IT part of that work. Choose the CIA for a general internal-audit career, the CISA for IT systems and controls.
The IIA's CIA page (read October 11, 2026) lists three exam parts and asks for one year of internal audit work with a master's degree or two with a bachelor's. A non-member pays a $240 application fee plus $445 for Part 1 and $415 each for Parts 2 and 3: $1,515, against $810 for the CISA exam and application. These are the IIA's US-dollar prices; regional prices were not checked.
CISA vs CPA
The CPA (Certified Public Accountant) is a US accounting license issued by each state's board of accountancy, the body that licenses accountants in that state. The exam has three four-hour core sections and one four-hour discipline section you choose, according to the AICPA (American Institute of Certified Public Accountants). Choose the CPA for accounting and financial-statement audit (checking a company's published accounts); choose the CISA for IT audit.
| CISA | CIA | CPA (US) | |
|---|---|---|---|
| Issued by | ISACA | The IIA | Each state's board of accountancy |
| Focus | IT audit, control and security | Internal audit | Accounting and financial-statement audit |
| Exam | One exam: 150 questions, four hours | Three parts: 125 questions in 2.5 hours, then two parts of 100 questions in two hours each | Four sections of four hours each |
| Exam fees, one attempt each | $760 non-member, $575 member (plus $50 application after passing) | $1,515 non-member, $990 member (application included) | Not checked (see your state board) |
| Work experience | Five years, up to three waivable | With a degree: one year with a master's, two with a bachelor's | Typically one year (NASBA's traditional route; states differ) |
Source: ISACA CISA pages; IIA CIA page; AICPA CPA exam page; NASBA (National Association of State Boards of Accountancy).
For the CPA, NASBA describes the traditional route as a bachelor's degree in accounting plus 30 more semester credits (college course credits), 150 semester hours in all, plus one year of experience and a pass on the exam. A newer route, a bachelor's degree plus two years of experience, applies only where a state has enacted it; check with your state board.
CISA, CRISC or Security+ first?
For someone with no audit or risk work yet, an entry-level certificate and a first job come before the CISA. The CRISC, ISACA's risk credential, has its own rules on our CRISC page. CompTIA Security+ is the entry-level security certificate of CompTIA, an IT industry body. Later on, CompTIA's SecurityX (formerly CASP+) is an advanced, hands-on technical security exam rather than an audit one.
Is the CISA worth it? What Reddit posters ask
Posters ask whether a CISA pass can stand in for experience, how to reach GRC work and what to take next. The posts come from r/SecurityCareerAdvice, r/ITCareerQuestions and r/cissp. Treat them as themes, not statistics.
A final-year UK student studying for the CISA asked whether to do a master's first or apply for junior GRC roles now "and use CISA as my main differentiator" (r/SecurityCareerAdvice). Until the work years are in, a pass is not the title. A master's in information systems would waive three years instead of the bachelor's two, and only one waiver applies, so the master's saves one year of the requirement.
A poster who is the only IT person at a bookkeeping and compliance firm asked what the chances of a job in the field would be after passing the CISA (r/ITCareerQuestions). Our data does not measure job chances, and a pass alone is not the title. Two checks help: read the requirements in IT auditor and compliance ads near you, and ask whether the poster's IT years fit ISACA's five subject areas and can be verified by someone who knows that work.
A poster who had passed the CISA two weeks earlier planned to take the CISSP within two to four months and asked about the overlap (r/cissp). The CISA gives 26% of its exam to protection of information assets, which is security content. The CISSP suits a move into broad security work more than staying in audit. Our CISA vs CISSP comparison covers the order.
A student without audit or risk experience asked whether to go straight for the CISA or CRISC or start with "a foundational cert like Security+" (r/SecurityCareerAdvice). The section on CISA, CRISC or Security+ first answers it.
A CISA holder with a cybersecurity degree, three years of lecturing and a three-year gap in another field asked how to position the CISA to get back into GRC (r/SecurityCareerAdvice). Job titles to search include IT auditor (tests IT controls), IT risk analyst (assesses IT risks) and compliance analyst (checks that rules are followed). A CISA held through a gap is current only if the holder kept up the yearly CPE hours and maintenance fees described in the renewal section.
What we did not check
- What ISACA does when a holder misses the CPE hours or the maintenance fee.
- CPA exam fees.
- Local ISACA chapter dues, which vary by chapter, and the ISACA membership renewal price.
- When the annual maintenance fee starts after certification.
- CISA prices in currencies other than US dollars.
- Job ads for IT auditors, internal auditors and GRC analysts.
Sources
All pages below were read October 11, 2026.
- ISACA, CISA: CISA page, Get CISA certified, CISA exam content outline, Maintain CISA certification, the exam candidate guide and the support articles on CISA requirements and exam scoring.
- ISACA, other: professional membership, Maintain CISM certification (fee for a third certification), CISM requirements support article (read in search results) and the DoDM 8140.03 press release (May 21, 2024).
- The IIA: CIA certification page.
- AICPA: CPA exam. NASBA: new CPA licensure pathways.
- Job ads: Adzuna API, October 2026, security-analyst ads in ten countries, phrase
certified information systems auditor. Analysis: CertWorthIt. Method. - Reddit: posts collected from r/SecurityCareerAdvice, r/ITCareerQuestions and r/cissp, linked where quoted; no usernames.
Edited by Jere Salmisto · Data checked October 11, 2026
Questions people ask
Is the CISA certification worth it?
For people who audit IT systems and controls, or who are building toward that work, yes. For a beginner with no IT, audit or security job, the CISA (Certified Information Systems Auditor) is a later step. ISACA, the IT audit association that issues it, certifies you only after five years of qualifying work, of which up to three can be waived. In our October 2026 count (Adzuna, a job-ad search site), the full title certified information systems auditor appeared in 3 of the 8,110 US security-analyst ads. That shows how often analyst employers spell out the title, not audit demand: ads that write only the acronym are not counted, and audit ads, the CISA's main market, are outside that count.
How much does the CISA cost?
ISACA, the professional body behind the CISA, charges $760 for the exam, or $575 for its members. After you pass, you pay a one-time $50 application fee and then an annual maintenance fee of $85, or $45 for members (ISACA pages read October 11, 2026). Over a first three-year cycle with one exam attempt, a non-member pays $1,065: $760 for the exam, $50 to apply and three yearly fees of $85. ISACA membership costs $145 to join, plus local chapter dues; we did not check the renewal price. Each retake costs the full exam fee.
How hard is the CISA?
The CISA exam has 150 multiple-choice questions in four hours. You need a scaled score of 450 on ISACA's scale of 200 to 800, which is a converted score, not a percentage. ISACA, which runs the exam, publishes no pass rate on the pages we read. Two of the five subject areas, running IT operations and protecting data and systems, each make up 26% of the exam.
How long does it take to get the CISA?
The CISA title takes five years of information systems audit, control or security work, gained in the 10 years before you apply. The issuing body, ISACA, can waive up to three of those years for education (two for a bachelor's degree in any field). You can pass the exam first and apply within five years of passing. Neither ISACA's pages nor the Reddit posts we collected give a study time, so we report none.
Does the CISA expire? How does CISA renewal work?
To keep the CISA, holders must meet the rules of ISACA, the professional body that issues it. ISACA asks holders for 120 hours of continuing professional education (CPE: courses, conferences and similar learning) in each three-year reporting period, with at least 20 hours every year. Holders also pay an annual maintenance fee of $45 for ISACA members or $85 for non-members (ISACA pages read October 11, 2026).
What is the CISA salary?
We have no CISA salary figure that we can source and date. The CISA page of ISACA, the credential's issuer, shows an average salary figure with no date and no source, so we do not repeat it, and we do not report pay from job ads. Any average for CISA holders mixes the credential with seniority: the title follows years of qualifying work (five, of which education can replace up to three). Our cybersecurity-analyst page covers the analyst role country by country.
Is the CISA worth it in India?
The pages we read from ISACA (the IT audit association behind the CISA) give no India-specific rules: the same experience rule and exam fees listed in US dollars ($760, or $575 for members). Our Indian sample is small: in October 2026, the full title certified information systems auditor appeared in 2 of the 250 Indian security-analyst ads (Adzuna, a job-ad search site), so read that figure with care.
CISA vs CIA: which should you take?
Take the CISA (Certified Information Systems Auditor, from ISACA) if you want to audit IT systems and controls. Take the CIA (Certified Internal Auditor, from the Institute of Internal Auditors, or IIA) if you want internal audit, which reviews a whole organization's processes, finances and risks. The CISA is one 150-question exam and asks for five years of work, up to three waivable. The CIA has three exam parts and, on the IIA's page, asks for one year of internal audit work with a master's degree or two with a bachelor's. For a non-member, all three CIA parts plus the application come to $1,515, against $810 for the CISA exam plus its $50 application fee; annual fees are not compared.
Can you take the CISA exam without experience?
Yes. ISACA, the IT audit association that awards the CISA, lets you take the exam before you have the experience. You become certified only after showing five years of information systems audit, control or security work, gained in the 10 years before you apply. You have five years from your passing date to apply, and ISACA caps experience waivers at three years.