CISA Syllabus: Sections and Question Counts

Last verified: 11 November 2026. This is an independent guide; it is not affiliated with ISACA or any government body. Exam details can change, so check the exam page at ISACA before relying on any figure.

How the questions are split

The exam has 150 questions in 240 minutes, split across the sections according to the exam specification from ISACA.

The two largest sections are Information Systems Operations and Business Resilience and Protection of Information Assets: together 78 of the 150 questions (52%). Start with them, then take the rest in order of size.

Notes on this split

• Arabic explanations support study; Arabic is not a listed CISA exam language.
• Passing the exam is one step toward certification; experience and an application are also required.

Topics in each section

Information Systems Auditing Process (27 questions)

• Audit planning, ethics and risk
• Testing, sampling and audit analytics
• Evidence, reporting and audit quality

Governance and Management of IT (27 questions)

• Governance, strategy and enterprise risk
• Data governance and privacy
• Resources, vendors and performance

Information Systems Acquisition, Development and Implementation (18 questions)

• Project governance and business cases
• Development methods and control design
• Testing, implementation and review

Information Systems Operations and Business Resilience (39 questions)

• Operations, assets and change management
• Business resilience, continuity and recovery
• Logs, problems and incidents

Protection of Information Assets (39 questions)

• Identity and access management
• Network, cloud and cryptographic protection
• Physical security and data protection
• Security monitoring, testing and response

How to use this split

Start with the 10 free questions, no sign-up: your score comes back split by section, so you see the weakest one. Then spread your study days according to the table above, as laid out in the study plan.