ISACA ISSUED · MULTIPLE CREDENTIALS · EXPERIENCE + EXAM · CPE MAINTAINED

ISACA Certification Guide 2026

Choosing between ISACA's credentials rather than treating 'ISACA certification' as one thing: what each certification is for, which roles they map onto in audit, risk and compliance functions, and what they have in common.

Updated August 2026

By GlobalCybers Editorial Team · Reviewed by our Data Desk · Published Aug 2026

Direct Answer

What is ISACA certification and which credential should I choose?

ISACA is a global professional association for information systems audit, governance, risk, security and privacy, and it issues several distinct certifications rather than one. The best known is the Certified Information Systems Auditor, the audit and assurance credential. Alongside it sit a certification for information security management aimed at security leadership rather than hands-on engineering, one for risk and information systems control aimed at risk professionals, one for governance of enterprise IT aimed at senior leaders accountable for how technology is directed and overseen, and a data privacy engineering credential covering the technical implementation of privacy. ISACA also issues shorter certificates and foundational credentials for people entering the field. All of the flagship certifications share a common architecture: a proctored examination against published job practice domains, a documented professional experience requirement, agreement to ISACA's Code of Professional Ethics, and ongoing continuing professional education with annual and three-year minimums plus a maintenance fee. Choosing between them is a question of role, not of difficulty ranking.

ISACA Certifications — the professional association's credential portfolio — ISACA ISSUED · MULTIPLE CREDENTIALS · EXPERIENCE + EXAM · CPE MAINTAINED

Key takeaways

ISACA is an association issuing several distinct certifications, not a single credential.
Credentials map to different roles: audit, security management, risk and control, IT governance and data privacy.
All flagship certifications combine an examination with verified experience and an ethics agreement.
Every credential is maintained through annual and three-year continuing professional education plus a maintenance fee.

ISACA at a glance

Cost	Examination, application and annual maintenance fees are set per credential by ISACA and differ for members and non-members — see ISACA's current fee schedule for the credential you are considering
Duration	Each flagship credential is a single proctored examination, typically four hours
Issued by	ISACA
Format	Proctored examination against published job practice domains, plus an experience-verified certification application
Expiry	Maintained continuously through annual and three-year continuing professional education requirements and an annual maintenance fee
Who needs it	Internal and external auditors, risk and compliance professionals, security managers, privacy specialists and IT governance leaders
Common architecture	Exam plus verified experience plus ethics agreement plus continuing education
Choose by	Role and responsibility — audit, security management, risk, governance or privacy

Sources: ISACA, official site · ISACA credentialing. Reviewed August 2026 by the GlobalCybers team.

Body

Not one credential

Shared model

Exam + experience

Upkeep

CPE + ethics

One Association, Several Credentials

'ISACA certified' is not a statement

Job adverts and résumés both use the phrase, and it means nothing on its own — ISACA issues credentials for audit, security management, risk and control, enterprise IT governance and data privacy, aimed at genuinely different jobs. Name the credential. A hiring manager reading 'ISACA certified' will assume the audit credential, because it is the association's oldest and largest, and the conversation gets awkward if that is not what you hold.

Mapping credentials to roles

Systems audit: For internal and external auditors testing controls over systems and data

Security management: For those managing an information security programme rather than operating tools

Risk and control: For risk professionals identifying, assessing and responding to IT risk

Enterprise IT governance: For senior leaders accountable for directing and overseeing technology

Data privacy: For specialists implementing privacy requirements technically

Which ISACA credential affects a career most?

It depends entirely on the function you work in: the audit credential dominates internal audit hiring, while the risk, security management and governance credentials appear in their own specialist job specifications. Choosing the wrong one is the common mistake. BLS reports pay by occupation, not by credential.

$83,680

BLS OEWS May 2025 national median for accountants and auditors (SOC 13-2011), the occupation most holders work in

Role-matched

Because each credential targets a different function, the value comes from matching the certification to the job specification rather than from collecting the association's credentials generally

$144,090

90th-percentile pay for accountants and auditors — where the most senior credentialed practitioners concentrate

GlobalCybers reimburses certification fees after a successful permanent placement through our network.

What ISACA Certifications Cover, Across the Portfolio

🎯

Choose by Role

Audit, security management, risk, governance and privacy are different jobs. The credential should follow the role you hold or are targeting.

📐

Job Practice Domains

Each credential publishes its domains and weightings, derived from practice analysis. They are the authoritative syllabus and the fairest way to compare credentials.

🧾

Verified Experience

The flagship credentials all require documented professional experience, verified as part of the application. Passing the exam alone never produces certification.

⚖️

Ethics Obligation

Every ISACA certification carries an agreement to the Code of Professional Ethics, enforceable through the association's processes.

📈

CPE Discipline

Annual and three-year continuing education minimums apply, so holding several credentials multiplies the maintenance obligation as well as the fees.

🚪

Entry Certificates

ISACA also offers shorter certificates and foundational credentials, which suit people entering audit, risk or privacy work before they have the experience for a flagship certification.

How do you choose and earn an ISACA certification, step by step?

Start from the job specification, not the credential list

Read the roles you want. Internal audit postings name the audit credential; risk functions name the risk credential; security leadership roles name the security management credential. Let the market tell you which to pursue.

Check the experience requirement for that credential

Each flagship certification has its own documented experience requirement and its own waiver rules, published by ISACA. Verify the current terms before committing, because they have been revised over time.

Prepare against the published domains

ISACA publishes job practice domains and weightings per credential, derived from practice analysis. They are the syllabus, and the weightings tell you where preparation time belongs.

Sit the proctored exam

Examinations are delivered at test centres and by remote proctoring. Registration and application fees differ per credential and between members and non-members, so check ISACA's current fee schedule.

Apply, agree to the ethics code, then maintain it

Submit the experience-verified application, agree to the Code of Professional Ethics, and thereafter meet the annual and three-year continuing education minimums plus the maintenance fee.

Employer & Regulatory Expectation

Why ISACA Credentials Appear in Job Specifications

None of these credentials is legally required. Their currency comes from the environment audit, risk and security functions operate in: regulators and examiners expect organisations to demonstrate that qualified people assess systems controls, audit committees ask who is doing the work, and procurement processes for external assurance providers ask for credentialed staff. Because ISACA's certifications combine an examination with verified experience and an enforceable ethics obligation, they satisfy that expectation in a way that a training certificate does not.

Type

Professional certifications

Driven by

Regulatory and audit expectations

Legal status

Not a licence

ISACA Certifications, Frequently Asked Questions

Is 'ISACA certification' a single credential?

No. ISACA is a professional association that issues several distinct certifications covering information systems audit, information security management, risk and information systems control, governance of enterprise IT, and data privacy, plus shorter entry-level certificates. Saying you are 'ISACA certified' without naming the credential tells a hiring manager very little, and they will usually assume the audit credential.

Which ISACA credential is best for an internal auditor?

The Certified Information Systems Auditor credential, which is the association's audit and assurance certification and by far the most commonly named in internal audit job specifications. Auditors who later move into risk management or security leadership frequently add a second ISACA credential aimed at that function rather than replacing the first.

Do all ISACA certifications require work experience?

The flagship certifications do. Each has its own documented professional experience requirement with its own waiver rules, verified as part of the certification application after the examination is passed. ISACA's shorter certificates and foundational credentials are aimed at people who do not yet have that experience and do not carry the same requirement.

How much continuing education does an ISACA credential need?

Each certification sets both an annual minimum and a three-year total of continuing professional education hours, recorded in your ISACA account, alongside an annual maintenance fee. Holding multiple ISACA credentials increases the obligation, though qualifying activity can often count toward more than one — check ISACA's current rules on how hours are applied.

Can I hold more than one ISACA certification?

Yes, and many professionals do as their role broadens from auditing controls to designing, managing or governing them. The practical considerations are the additional experience requirements, the additional maintenance fees and the compounding continuing education obligation, so most people add a second credential when a role change justifies it rather than pre-emptively.

Intent Network

ISACA credentialed? Name the credential.

Audit, risk and compliance functions hire against specific certifications. Tell us which one you hold.

Join the Network →

Quick Reference

Issued byISACA

PortfolioSeveral credentials

ModelExam + experience

ObligationEthics code

UpkeepAnnual + 3-year CPE

Related Certifications

Roles that need ISACA

More about ISACA

What is a job practice analysis and why does it matter?

It is the periodic research ISACA conducts into what practitioners in a role actually do, used to define the domains and weightings each examination is built on. It matters because it means the syllabus reflects current practice rather than an academic view of the field, and because it explains why domain weightings shift between examination versions — the job changed, so the exam followed.

How do ISACA credentials relate to security engineering certifications?

They generally sit above the tooling. ISACA's security management credential addresses building and running a security programme — governance, risk, incident response management and reporting to leadership — rather than configuring controls, and its audit credential assesses whether controls work rather than implementing them. Practitioners who need hands-on technical depth typically pair an ISACA credential with a technical certification from another body.

Is ISACA membership required to hold a certification?

No, but fees differ substantially between members and non-members across registration, application and annual maintenance, and membership provides access to chapter events and resources that make continuing education easier to accumulate. Many certificants join for that combination rather than because certification requires it, and the arithmetic often favours membership once one credential is held.

What happens if continuing education requirements are not met?

ISACA can revoke certification for failing to meet the continuing professional education requirements or the annual maintenance fee, and it publishes the process for reinstatement. Because the requirement includes an annual minimum as well as a three-year total, a certificant who does nothing for a full year has a compliance problem even if they later exceed the cycle total, which is the practical reason to log hours as they occur.

Your career research journey

Do your homework, then let the network do the rest.

💰

1. Know your salary

Salary guides →

🪪

2. Know your licences & certifications

Certifications →Licences →

🧭

3. Career guide

Career guides →

🎤

4. Interview preparation

Interview Q&As →

Get the job, then keep rising

Free

Get Job — Join Network →

🚀

Step 5

Get matching jobs

Set your intent, matching jobs come to you. No applying.

📈

Step 6

Career advancement plan

A roadmap to your next licence tier and higher pay band.

🎓

Step 7

We fund your fees

Once placed, we cover all certification, licence & career-guide fees.

⚡

Hiring trade workers?

Get a verified shortlist of 3–5 qualified candidates in 48 hours

GlobalCybers verifies active state licenses, trade certifications, Intent and right-to-work status before any candidate reaches your portal. Flat $2,999/mo RPO (Recruitment Process Outsourcing), up to 3 concurrent roles, or a free trial (pay on hire). 90-day written guarantee.

✓ Licenses verified✓ Intent & availability verified⚡ 48-hr shortlist🛡 90-day guarantee

Hire Talent →See how staffing works →