CISA Study Plan by Time Left
What to study first for CISA: sections ranked by question count, with plans for four weeks, two weeks and the final week.
- Questions and time
- 150 questions · 240 minutes
- Pass mark
- 450 on the 200–800 scale
- Exam fee
- US$575 for members; US$760 for nonmembers
Start with 10 free questions to find what needs more work. No sign-up, with answer explanations.
Try 10 free questions and see your levelPut what you just read into practice
Start with 10 free questions to find what needs more work. No sign-up, with answer explanations.
Try 10 free questions and see your levelLast verified: 11 November 2026. This is an independent guide; it is not affiliated with ISACA or any government body. Exam details can change, so check the exam page at ISACA before relying on any figure.
This guide answers one question: with the days you have left before CISA, what do you study first? Section details are in the syllabus guide; booking and fees are in the registration guide.
The numbers behind the plan
| Fact | What it means for your study |
|---|---|
| 150 questions in 240 minutes (ISACA) | About 96 seconds per question. Answer recall questions quickly to leave time for the ones that need reading or calculation. |
| Pass mark: 450 on the 200–800 scale | Your practice accuracy does not convert to this score, so use it to compare your sections with each other. |
| Fee: US$575 for members; US$760 for nonmembers | Every extra attempt costs money and time, so do not book until your mock scores are steady. |
Sections in order of size
- Information Systems Operations and Business Resilience: 39 questions (26%)
- Protection of Information Assets: 39 questions (26%)
- Information Systems Auditing Process: 27 questions (18%)
- Governance and Management of IT: 27 questions (18%)
- Information Systems Acquisition, Development and Implementation: 18 questions (12%)
Four weeks or more
Give the sections 20 study days in proportion to their weight, then keep a week for mock exams:
- Information Systems Operations and Business Resilience: 5 days
- Protection of Information Assets: 5 days
- Information Systems Auditing Process: 4 days
- Governance and Management of IT: 4 days
- Information Systems Acquisition, Development and Implementation: 2 days
After each section, work its questions in the practice area and read the explanation for every option you got wrong before moving on.
Two weeks
Ten days for the larger sections and four for mock exams and review:
- Information Systems Operations and Business Resilience: 2 days
- Protection of Information Assets: 3 days
- Information Systems Auditing Process: 2 days
- Governance and Management of IT: 2 days
- Information Systems Acquisition, Development and Implementation: 1 day
The final week
- Day 1: the 10 free questions, to find your weakest sections.
- Days 2 to 4: Information Systems Operations and Business Resilience and Protection of Information Assets first because they are the largest, then your weakest section.
- Day 5: one full mock exam: 150 questions in 240 minutes without stopping.
- Day 6: go through every question you got wrong and read the explanation for each option.
- Day 7: light review, and check your appointment, test centre and required ID.
Finished reading? Try a set of questions
Start with 10 free questions to find your weakest units. Keep practising with the full question bank and mock exams from SAR 26.
Sources and references
- ISACA – exam page isaca.org
- ISACA – exam specification isaca.org