Can you earn ISACA CISA? Eligibility and prerequisites
Before you spend a dollar, know whether you can actually earn this credential now. Below is what the certifying body requires — every fact sourced and dated. A recommendation is labelled a recommendation, never a rule.
Eligibility: Not an entry credential. This requires years of verified, relevant work experience to fully earn. You can often pass the exam first and hold a provisional/associate status until you meet the experience — but it is not a first credential for someone with no experience. The alternative path is below.
See the certification itself: ISACA CISA · what it costs · how to study for it free.
What it takes to earn it
| Requirement | Detail | Source |
|---|---|---|
| Work experience to earn it | 5 years — 5 years of professional information-systems auditing, control, or security experience gained within the 10 years preceding application; up to 3 years are substitutable by education/other credentials, so at least ~2 years of real experience remain. | official |
| Prerequisites | None to sit the exam — you can take the exam before meeting the experience requirement. | official |
| Endorsement | Your experience is verified by your supervisor or manager (not family or HR), not by a peer endorser. | official |
| Open registration | Anyone can sit the exam; full certification requires the experience. | official |
| Code of ethics / agreement | ISACA Code of Professional Ethics, plus 120 CPE hours per 3-year cycle (minimum 20 per year). | official |
If you don't have the experience yet
Pass the exam first — you then have 5 years from the passing date to apply once you have the experience; or hold the CISA Associate designation (valid up to 4 years) until you meet it.
The honest read
If you're changing careers with no relevant experience, this is usually not the credential to start with — pursue an open, entry-friendly certification first and come back to this once you have the experience (or take the provisional/associate route above). Chasing an experience-gated credential first is the most common and most expensive wrong turn.
Being eligible to earn a credential is not the same as getting hired, and no certification guarantees a job. Requirements change — verify on the official page before you pay.
Good to know
Experience must fall in the CISA job-practice areas.
Sources
- Official eligibility / requirements page: https://www.isaca.org/credentialing/cisa/get-cisa-certified
Citation Ledger
| ID | Supports | Evidence | Source |
|---|---|---|---|
| CIT-01 | Eligibility & prerequisites for ISACA CISA (as of 2026-06-14) | Official certifying-body eligibility page | link |