CISA Training Course Overview:
- Prepare for the Certified Information Systems Auditor (CISA) Exam.
- Develop and implement a risk-based IT audit strategy in accordance with IT audit standards.
- Assess the effectiveness of an IT governance framework.
- Ensure the IT organizational structure and human resources management align with the organization’s goals and strategies.
- Review information security policies, standards, and procedures for completeness and alignment with industry best practices.
Certified Information Systems Auditor (CISA) Training Course Prerequisites:
Participants must have at least 5 years of experience in IS audit, control, assurance, and security.
Certified Information Systems Auditor (CISA) Certification Exam Information:
This course is tailored for experienced information security professionals preparing for the ISACA CISA exam. Click here to view more ISACA certification training.
The first step to becoming CISA certified is to take and pass the CISA certification exam. The exam consists of 150 questions covering 5 job practice domains and tests your understanding of the knowledge and practical abilities an expert professional brings to the real-life job practice as it relates to information systems. Your ability to pass the exam will amount to substantial proof of your own
expertise in these practical work-related domains:
CISA Training Learning Objectives:
Domain 1 – Information System Auditing Process
- Plan an audit to assess whether information systems are secure, well-controlled, and deliver value to the organization.
- Perform an audit in accordance with IS audit standards, using a risk-based IS audit strategy.
- Report audit progress, findings, results, and recommendations to relevant stakeholders.
- Conduct audit follow-ups to ensure identified risks have been adequately addressed.
- Assess the effectiveness of IT management and control monitoring.
- Use data analytics tools to enhance and streamline audit processes.
- Offer consulting services and advice to improve the quality and control of information systems within the organization.
- Identify opportunities to improve IT policies and practices in the enterprise.
Topics:
- IS Audit Standards, Guidelines, Functions, and Codes of Ethics
- Types of Audits, Assessments, and Reviews
- Risk-based Audit Planning
- Types of Controls and Considerations
- Audit Project Management
- Audit Testing and Sampling Methodology
- Audit Evidence Collection Techniques
- Audit Data Analytics
- Reporting and Communication Techniques
- Quality Assurance and Improvement of Audit Process
Domain 2 – Governance and Management of IT
- Assess the alignment of the IT strategy with the organization’s overall strategies and objectives.
- Evaluate the effectiveness of the IT governance framework and the IT organizational structure.
- Review the enterprise’s management of IT policies and practices.
- Ensure IT policies and practices comply with regulatory and legal requirements.
- Evaluate the alignment of IT resource and portfolio management with the organization’s strategic goals.
- Assess the enterprise’s risk management policies and practices.
- Review the management and monitoring of IT controls.
- Evaluate the monitoring and reporting processes for IT key performance indicators (KPIs).
- Assess whether IT supplier selection and contract management processes meet business needs.
- Evaluate the alignment of IT service management practices with business requirements.
- Conduct regular reviews of information systems and the enterprise architecture.
- Assess data governance policies and practices.
- Evaluate the effectiveness of the information security program and its alignment with the organization’s objectives.
- Assess potential opportunities and risks associated with emerging technologies, regulations, and industry trends.
Topics
- Laws, Regulations, and Industry Standards
- Organizational Structure, IT Governance, and IT Strategy
- IT Policies, Standards, Procedures, and Guidelines
- Enterprise Architecture and Considerations
- Enterprise Risk Management (ERM)
- Privacy Program and Principles
- Data Governance and Classification
- IT Resource Management
- IT Vendor Management
- IT Performance Monitoring and Reporting
- Quality Assurance and Quality Management of IT
Domain 3 – Information Systems Acquisition, Development, and Implementation
- Assess whether the business case for proposed information system changes aligns with business objectives.
- Review the enterprise’s project management policies and practices.
- Evaluate controls throughout all phases of the information systems development lifecycle.
- Assess the readiness of information systems for implementation and migration into production.
- Conduct post-implementation reviews to determine if project deliverables, controls, and requirements have been met.
- Evaluate the effectiveness of change, configuration, release, and patch management policies and practices.
Topics:
- Project Governance and Management
- Business Case and Feasibility Analysis
- System Development Methodologies
- Control Identification and Design
- System Readiness and Implementation Testing
- Implementation Configuration and Release Management
- System Migration, Infrastructure Deployment, and Data Conversion
- Postimplementation Review
Domain 4 – Information Systems Operations and Business Resilience
- Assess the organization’s ability to maintain business operations during disruptions.
- Evaluate whether IT service management practices are aligned with business needs.
- Conduct regular reviews of information systems and enterprise architecture.
- Assess IT operations to determine if they are effectively controlled and continue to support the organization’s objectives.
- Evaluate IT maintenance practices to ensure they are effectively controlled and aligned with the organization’s goals.
- Review database management practices for effectiveness and alignment with business needs.
- Evaluate data governance policies and practices to ensure proper control and management.
- Assess the effectiveness of problem and incident management policies and practices.
- Evaluate change, configuration, release, and patch management policies and practices.
- Review end-user computing processes to determine if they are effectively controlled.
- Evaluate policies and practices related to asset lifecycle management.
Topics:
- IT Components
- IT Asset Management
- Job Scheduling and Production Process Automation
- System Interfaces
- End-user Computing and Shadow IT
- Systems Availability and Capacity Management
- Problem and Incident Management
- IT Change, Configuration, and Patch Management
- Operational Log Management
- IT Service Level Management
- Database Management
- Business Impact Analysis
- System and Operational Resilience
- Data Backup, Storage, and Restoration
- Business Continuity Plan
- Disaster Recovery Plans
Domain 5 – Protection of Information Assets
- Conduct audits in accordance with IS audit standards and a risk-based audit strategy.
- Evaluate the effectiveness of problem and incident management policies and practices.
- Assess the organization’s information security and privacy policies and practices.
- Review physical and environmental controls to ensure information assets are adequately protected.
- Evaluate logical security controls to confirm the confidentiality, integrity, and availability of information.
- Assess data classification practices to ensure alignment with enterprise policies and relevant external requirements.
- Review policies and practices related to asset lifecycle management.
- Evaluate the effectiveness of the information security program and its alignment with organizational strategies and objectives.
- Perform technical security testing to identify potential threats and vulnerabilities.
- Evaluate potential opportunities and risks associated with emerging technologies, regulations, and industry trends.
Topics:
- Information Asset Security Policies, Frameworks, Standards, and Guidelines
- Physical and Environmental Controls
- Identity and Access Management
- Network and End-Point Security
- Data Loss Prevention
- Data Encryption
- Public Key Infrastructure (PKI)
- Cloud and Virtualized Environments
- Mobile, Wireless, and Internet-of-Things Devices
- Security Awareness Training and Programs
- Information System Attack Methods and Techniques
- Security Testing Tools and Techniques
- Security Monitoring Logs, Tools, and Techniques
- Security Incident Response Management
- Evidence Collection and Forensics CISA Exam Preparation
- CISA Exam Rules • Exam Tips • Day of the Exam • CISA Certification Step
CISA candidates must:
- Complete a 150-question multiple-choice exam within a four-hour time limit.
- Achieve a passing score of 450 on ISACA’s 200–800-point scale to become certified.Like other ISACA certifications, the CISA remains valid as long as holders:
- Participate in the continuing education program
- Pay an annual maintenance fee
The CISA renewal cycle is three years, during which you must earn 120 CPEs. Of these, at least 20 CPE credit hours must be logged and verified annually.
