Is the ISACA CISA worth it in 2026?

The numbers that matter

Before any opinion: here are the facts as of Q2 2026, drawn from the ISACA certification page and current US job-board scans.

• Exam cost: $760 USD for ISACA members, $1,055 USD for non-members via PSI testing centers or online proctoring. ISACA professional membership is $135/year plus a $50 one-time application fee, so for a single exam attempt the non-member route is usually cheaper; for repeat attempts or candidates planning CISM/CRISC later, joining first wins.
• Format: 150 multiple-choice items in a 4-hour window. Scaled scoring from 200 to 800; 450 is the pass mark. The scaled score is set by ISACA’s psychometric team — raw-percentage rules of thumb mislead, and there are no published raw-to-scaled tables.
• Blueprint: five domains weighted Information System Auditing Process (D1, 18%), Governance and Management of IT (D2, 18%), Information Systems Acquisition, Development and Implementation (D3, 12%), Information Systems Operations and Business Resilience (D4, 26%), and Protection of Information Assets (D5, 26%). Domains 4 and 5 together drive over half the score — underweighting them is the most common failure mode.
• Pass rate: ISACA does not publish official numbers. Community-reported first-attempt rates cluster around 50–60%, with the Reddit r/CISA and LinkedIn cohorts trending toward the higher end among candidates who complete a full QAE Database pass before sitting.
• Experience gate: 5 years of professional IS auditing, control, or security work experience, verified by an employer or peer. ISACA allows substitutions: up to 1 year for general IT experience, up to 1 year for a relevant 2-year degree, up to 2 years for a 4-year degree, and up to 3 years for a master’s in IS or a related field. You can sit the exam first; you then have 5 years from the pass date to file the experience.
• Annual maintenance: $45 USD AMF for ISACA members, $85 USD for non-members, plus 120 CPE hours every 3-year cycle (20/year minimum). The CPE bar is the same as CISM and CRISC, so if you hold multiple ISACA credentials you can apply most CPEs across them.
• Salary anchor: The official ISACA CISA page is the authoritative source for exam mechanics and fees. The US Bureau of Labor Statistics reports a 2024 median wage of $124,910 for Information Security Analysts, with the top decile above $182,000; CISA-anchored IT audit roles consistently sit at or above that median in major US metros and well into the top decile at the manager and director level.

The ROI math in plain terms

Total investment to clear CISA on the non-member route: $1,055 for the exam, $130 for the official Review Manual, $300 for a one-year QAE Database subscription, and roughly 150 hours of study time. At a $45/hour opportunity cost — realistic for mid-career IT and audit professionals — the total investment is approximately $8,250.

Typical return: a $25,000/year salary lift for an internal auditor or compliance analyst adding CISA and moving into an IT-audit-anchored role, or a SOX-controls specialist pivoting into IT-audit-manager territory. That’s roughly $2,080 per month. The cert pays for itself in just under four months of opportunity cost — and against the exam fee alone, in under two weeks. Over three years the cumulative salary advantage exceeds $75,000 even after AMF and CPE costs — a return above 800% on the original investment.

When CISA IS worth it

• Internal auditor, external auditor, or SOX-controls analyst targeting an IT-audit specialization, an IT-audit-manager promotion, or a Big-4 risk-advisory seat. CISA is the gate roughly 60% of those postings list.
• GRC analyst or compliance specialist pivoting toward IT-control testing — CISA is the credential procurement, regulators, and audit committees recognize on sight.
• US federal contractor, US government employee, or DoD-adjacent work. CISA satisfies DoD 8140 IAM Level II and IAM Level III. Many cleared GRC, A&A, and audit-liaison positions list it as required or preferred.
• Banking, insurance, healthcare, and utilities IT staff in SOX-, HIPAA-, NERC-CIP-, or PCI-DSS-heavy environments. CISA is the audit-side counterpart to the controls these compliance regimes mandate.
• Working IT pro moving into consulting or advisory. CISA on a résumé signals you can talk controls, evidence, and risk in the language audit committees actually use — not just configuration.

When CISA is NOT worth it

• You have zero audit, controls, or risk responsibilities in your day job. The 5-year experience gate is strict; ISACA verifies. Substitutions help, but you still need real IS audit, control, or security work to endorse.
• Your trajectory is deeply technical — pentesting, application security, cloud security engineering. OSCP, GIAC GWAPT, CCSP, AWS SCS-C02, or AZ-500 carry more weight on those interviews. CISA is process-and-evidence depth, not exploit or build depth.
• You already hold CISM. Audit and security-management overlap is real and the second ISACA cert rarely doubles the salary signal. Pick CRISC, CCSP, or a vendor security specialty instead.
• You want a cheap entry-level credential. CISA is senior-track in IT audit and the experience endorsement gates the salary lift. Start with CompTIA Security+ or ISACA’s entry-level ITCA / Cybersecurity Fundamentals if you’re still building the resume.

CISA vs CISSP vs CISM — the recurring confusion

CISSP is for engineers and architects building and defending systems. Its CBK is breadth across eight technical-and-management domains; the salary lift is largest in senior-engineer and security-architect tracks. CISSP’s AMF is $135/year vs CISA’s $45 (member) or $85 (non-member) — modest difference, but it stacks across decades.

CISM is for security managers building and running programs. Its four domains are governance, risk management, program development, and incident management — the day-to-day of an information-security-officer or security-program-manager role. CISM and CISA share an AMF and CPE structure, so dual-holders can pool most credits.

CISA is for auditors evaluating those systems and programs. The auditor lens is what makes it distinct: independence, sampling, evidence sufficiency, and report defensibility. If your week revolves around control testing, walkthroughs, evidence packages, or audit reports, CISA is the cert that maps cleanly onto the job. If it doesn’t, you’re likely better served by CISSP or CISM.

Two gotchas the marketing pages skip

The experience endorsement is strict. ISACA requires a verifier — a manager, peer, or HR rep with knowledge of your duties — to attest to specific tasks under specific domains. “General IT” doesn’t count past the 1-year substitution cap. If your current role has zero audit, control-design, control-testing, or IS-security duties, line up a future role or a tour-of-duty before you book the exam.

The CPE clock starts immediately. 20 hours in year one is mandatory, not just the 120/3-year average. Many new CISAs underbudget year-one CPE and end up scrambling in December — ISACA publishes a free monthly journal and offers webinars that count, but plan the cadence rather than racing the deadline. Annual reporting plus the AMF is also a hard requirement; let either slip and the cert moves into “under review” status, with a 12-month window to fix before revocation.

Bottom line

For working IT auditors, GRC analysts, and SOX-controls specialists within a year of meeting the experience endorsement, the CISA remains the highest-ROI single credential in the IT-audit stack in 2026. It’s the only cert that simultaneously satisfies a US federal compliance regime, gates 60% of US IT-audit postings, and translates to a measurable $20–35k salary lift across nearly every metro. If you’re in that window, book the voucher — pay the $135 to join ISACA first if you’re likely to attempt twice or stack CISM/CRISC later. If your day job has no audit, control, or risk surface yet, fix that first; CISA is the cap on an IT-audit career, not the on-ramp.

Frequently asked questions