Certified Information Systems Auditor (CISA®)

Course subjects

Domain 1: Information Systems Auditing Process
Providing audit services in accordance with standards to assist organisations in protecting and controlling information systems. Domain 1 affirms your credibility to offer conclusions on the state of an organisation's IS/IT security, risk and control solutions.

A. Planning

• IS Audit Standards, Guidelines, and Codes of Ethics

• Business Processes

• Types of Controls

• Risk-Based Audit Planning

• Types of Audits and Assessments

B. Execution

• Audit Project Management

• Sampling Methodology

• Audit Evidence Collection Techniques

• Data Analytics

• Reporting and Communication Techniques

• Quality Assurance and Improvement of the Audit Process

Domain 2: Governance and Management of IT
Domain 2 confirms to stakeholders your abilities to identify critical issues and recommend enterprise-specific practices to support and safeguard the governance of information and related technologies.

A. IT Governance

• IT Governance and IT Strategy

• IT-Related Frameworks

• IT Standards, Policies, and Procedures

• Organisational Structure

• Enterprise Architecture

• Enterprise Risk Management

• Maturity Models

• Laws, Regulations, and Industry Standards affecting the Organisation

B. IT Management

• IT Resource Management

• IT Service Provider Acquisition and Management

• IT Performance Monitoring and Reporting

• Quality Assurance and Quality Management of IT

Domain 3: Information Systems Acquisition, Development and Implementation
Domains 3 and 4 offer proof not only of your competency in IT controls, but also your understanding of how IT relates to business.

A. Information Systems Acquisition and Development

• Project Governance and Management

• Business Case and Feasibility Analysis

• System Development Methodologies

• Control Identification and Design

B. Information Systems Implementation

• Testing Methodologies

• Configuration and Release Management

• System Migration, Infrastructure Deployment, and Data Conversion

• Post-implementation Review

Domain 4: Information Systems Operations and Business Resilience
Domains 3 and 4 offer proof not only of your competency in IT controls, but also your understanding of how IT relates to business.

A. Information Systems Operations

• Common Technology Components

• IT Asset Management

• Job Scheduling and Production Process Automation

• System Interfaces

• End-User Computing

• Data Governance

• Systems Performance Management

• Problem and Incident Management

• Change, Configuration, Release, and Patch Management

• IT Service Level Management

• Database Management

B. Business Resilience

• Business Impact Analysis (BIA)

• System Resiliency

• Data Backup, Storage, and Restoration

• Business Continuity Plan (BCP)

• Disaster Recovery Plans (DRP)

Domain 5: Protection of Information Assets
Cybersecurity now touches virtually every information systems role, and understanding its principles, best practices and pitfalls is a major focus within Domain 5.

A. Information Asset Security and Control

• Information Asset Security Frameworks, Standards, and Guidelines

• Privacy Principles

• Physical Access and Environmental Controls

• Identity and Access Management

• Network and End-Point Security

• Data Classification

• Data Encryption and Encryption-Related Techniques

• Public Key Infrastructure (PKI)

• Web-Based Communication Techniques

• Virtualised Environments

• Mobile, Wireless, and Internet-of-Things (IoT) Devices

B. Security Event Management

• Security Awareness Training and Programs

• Information System Attack Methods and Techniques

• Security Testing Tools and Techniques

• Security Monitoring Tools and Techniques

• Incident Response Management

• Evidence Collection and Forensics