CISA Study Kit
Everything you need to prepare for the ISACA CISA exam, built around a 12-week plan at 5–7 hours per week.
Target exam date: Tuesday 22 December 2026.
Start here
- Read 01-Study-Plan.md this week. It contains the calendar, the booking steps and the hour budget.
- Do the two administrative actions in Section 5 of the plan (join ISACA, register and buy the voucher). The voucher is valid for a year, so registering early is a free option — not a commitment.
- Read 07-Exam-Tactics-and-Question-Strategy.md once now. It changes how you read every practice question, so it pays to have it in your head from Week 1.
- Work through the domain notes in order, roughly one per 1–2 weeks, and start practice questions in Week 1.
What's in the kit
| File | Covers | When to use it |
|---|---|---|
| 01-Study-Plan.md | Exam facts, eligibility, weekly rhythm, 12-week calendar, booking logistics, practice strategy, risk management, readiness checklist | Week 1, then re-check at Weeks 6 and 11 |
| 02-Domain1-IS-Auditing-Process.md | D1 — 18% · ITAF, ethics, independence, audit types, risk-based planning, control classification, sampling, evidence, CAATs, reporting | Weeks 1–2 |
| 03-Domain2-IT-Governance-and-Management.md | D2 — 18% · governance vs management, COBIT 2019, ISO 38500, EA, ERM, privacy law, data governance, vendor & resource management, quality | Weeks 3–4 |
| 04-Domain3-IS-Acquisition-Development-Implementation.md | D3 — 12% · project governance, business case, SDLC, application controls, testing, cutover, data conversion, post-implementation review | Week 5 |
| 05-Domain4-Operations-and-Business-Resilience.md | D4 — 26% · infrastructure, asset management, incident/problem/change/patch, logging, SLAs, databases, EUC, BIA, RTO/RPO, backup, BCP/DRP | Weeks 7–8 |
| 06-Domain5-Protection-of-Information-Assets.md | D5 — 26% · security frameworks, physical, IAM, network/endpoint, crypto, PKI, cloud & virtualisation, DLP, mobile/IoT, attacks, monitoring, incident response, forensics | Weeks 9–10 |
| 07-Exam-Tactics-and-Question-Strategy.md | The ISACA answer-selection logic, question-stem decoding, distractor patterns, time management, domain reflexes, last-48-hours plan | Week 1 and Week 11 |
| 08-Rapid-Revision-Cheat-Sheet.md | All five domains compressed to recall tables, plus numbers, mnemonics and the final 10 rules | Week 12 and exam morning only |
| 09-Progress-Tracker-and-Wrong-Answer-Log.md | Weekly hours/questions tracker, the wrong-answer log template, domain confidence ratings, the readiness gate | Fill in weekly from Week 1 |
The one thing to understand about this exam
The domain weights are not equal, and they are not intuitive:
| Domain | Weight |
|---|---|
| D1 Auditing Process | 18% |
| D2 Governance & Management of IT | 18% |
| D3 Acquisition, Development & Implementation | 12% |
| D4 Operations & Business Resilience | 26% |
| D5 Protection of Information Assets | 26% |
Domains 4 and 5 are 52% of the exam. Most candidates over-invest in Domain 1 because it feels like "the auditing part". Earn Domains 4 and 5 first, and treat Domain 3 (only 12%) as the one to compress if you fall behind.
How to use the domain notes
Each domain file follows the same structure, so you always know where to look:
- "What this domain is really testing" — read first, sets the mindset
- "How the exam asks it" — the recurring question patterns
- Official ISACA subtopics as section headings, in ISACA's own order
- TRAPS — the specific ways ISACA makes that domain tricky
- 60-second recall — the absolute must-memorise list for final revision
Read for the exam, not for depth. You are being tested on judgement and control classification, not on your ability to implement a firewall.
Course notes (L1–L6)
A second, independent set of notes taken from the six lectures of the Information System Audit module in the PG Dip in IT (IT/IS Project Management). They are not a replacement for the domain notes above — they are the lecture's spine, rewritten for exam use, with the course's own examples and the traps its wording creates.
Use them when:
- you have just sat a lecture and want the exam version of it;
- a domain section assumes a piece of infrastructure you have never formally studied (L3 and L4 fill that gap for D4);
- you want a faster second pass on a topic you already met in the domain notes.
| Note | Covers | Feeds |
|---|---|---|
| L1 · IS Audit | Why audit exists, governance failure, asset/threat/vulnerability, audit types, independence test, data owner/user/custodian, project framing, hardware & physical security, malware | D1, D5 |
| L2 · Audit Process | The 10 steps, charter vs engagement letter, audit committee, pre-planning, scope restriction, risk responses, evidence and its life cycle, compliance testing & CAAT, illegal activity, sampling, follow-up | D1 |
| L3 · Networking Technology | CPU/RAM/bus architecture, boot sequence, OS requirements, machine roles, privilege states, storage & RAID, port access, OSI layers and devices, DNS/DHCP, wireless, syslog/sniffer/SNMP | D4 |
| L4 · IT Service Delivery | Policy/standard/procedure, balanced scorecard, metrics (4 types, 9 elements), help desk, SLA components, the four control families, change management, licensing, disposal, monitoring, capacity | D4 |
| L5 · Asset Protection | Computer crimes, hackers/crackers, passive vs active attacks, CSO/CPO/ISSM, classification, access paths, physical security, biometrics errors, DMZ, SSO, symmetric vs asymmetric, remote access | D5 |
| L6 · IT Governance | IT governance, strategy, steering committee and its seats, policy types, IT strategy plan, BPR, performance management, DR vs BC, BCP phases, backup types, insurance | D2, D4 |
Where the course and CISA diverge, this kit flags it. The clearest example is L2's audit committee: the lecture describes members as business executives, while CISA and IIA practice emphasise independence from management. Both are noted, side by side, rather than silently reconciled.
Study method in three lines
- Read the domain section, then write your own 5-line summary of it. If you can't compress it, you haven't understood it.
- Do questions the same week — ~35–40% of your total study time should be practice questions, not reading.
- Log every wrong answer's underlying rule, and revise only those rules in December. That log is worth more than any book in the final fortnight.
Practice target: 700–900 questions total, at least 300 of them in the final three weeks, mixed across domains rather than blocked by topic.
Aim to enter the exam consistently scoring above 75% on mixed, timed sets.
Honest caveats
- Domain names, weights and the official subtopic lists come from ISACA's published CISA exam content outline.
- Exam format (150 multiple-choice questions, 240 minutes, scaled 200–800, pass at 450) is confirmed by ISACA.
- Fee, retake waits and experience-waiver details are drawn from publicly documented ISACA policy and third-party summaries. These change — verify them directly with ISACA before you rely on them financially or logistically.
- These notes are a study aid, not an official ISACA product. Where a note and ISACA's own material disagree, ISACA is right. If you buy one external resource, buy the official CISA Questions, Answers & Explanations (QAE) database — it is the closest thing to the real exam.