CISA Fact Sheet¶

Exam Logistics¶

Domain Weights (Current Job Practice)¶

Eligibility and Substitutions¶

Audit Lifecycle (ITAF-Aligned)¶

The IS audit process per ITAF (Information Technology Audit Framework):

1. Audit Planning - audit charter, audit universe, risk assessment, annual audit plan
2. Risk Assessment - identify risks per auditable unit; prioritize engagements
3. Engagement Planning - scope, objectives, criteria, resources, timing
4. Fieldwork / Execution - control identification, walkthroughs, testing (compliance and substantive)
5. Reporting - findings, recommendations, management response, audit opinion
6. Follow-up - validate remediation; close findings or escalate

Audit Standards Hierarchy (ITAF)¶

CISA candidates must know that ITAF Standards are mandatory for ISACA members performing IS audits.

Types of Audits¶

Types of Controls¶

Compliance vs Substantive Testing¶

• Compliance testing - tests whether controls operated as designed. Example: sample 25 user access requests to verify each has manager approval.
• Substantive testing - tests whether data is materially accurate. Example: recalculate interest on a sample of loans.

If compliance testing reveals control failures, expand substantive testing.

Sampling Methods¶

Key sampling terms: - Population - complete set of items - Sample size - influenced by confidence level, expected error rate, tolerable error rate - Confidence coefficient (level) - typically 90-95% - Tolerable error rate - max acceptable rate of deviation - Expected error rate - auditor's prior expectation - Sampling risk - sample does not represent population

Audit Evidence Hierarchy (Reliability)¶

From most to least reliable:

1. Auditor's direct observation / re-performance (most reliable)
2. Externally generated documents addressed to auditor (e.g., bank confirmations)
3. Externally generated documents in client's possession
4. Internally generated documents from a strong control environment
5. Internally generated documents from a weak control environment
6. Oral evidence / management representation (least reliable)

Evidence types: documentary, observational, analytical, oral, electronic (CAATs output), physical.

Audit Evidence Quality Criteria¶

• Sufficiency - enough quantity to support conclusion
• Reliability - source and method of collection
• Relevance - directly addresses audit objective
• Usefulness - helps achieve the engagement objective

Risk Formulas¶

• Inherent Risk (IR) - risk before considering controls
• Control Risk (CR) - risk a control fails to detect/prevent
• Detection Risk (DR) - risk auditor fails to detect a material misstatement
• Audit Risk (AR) = IR x CR x DR
• Residual Risk = Inherent Risk - effect of Controls

The auditor cannot directly influence IR or CR but can adjust DR by changing the nature, timing, and extent of testing. Lower acceptable AR -> more substantive testing -> larger sample sizes.

Quantitative Risk (Same as CISSP)¶

• SLE = Asset Value x Exposure Factor
• ALE = SLE x ARO
• Cost-benefit = ALE before - ALE after - Annualized Cost of Safeguard
• ROSI (Return on Security Investment) = (ALE reduction - Cost) / Cost

COBIT 2019 Core¶

COBIT 2019 separates governance (set direction, monitor) from management (plan, build, run, monitor).

Governance Objectives Domain (5 objectives, EDM)¶

• EDM = Evaluate, Direct, and Monitor
• EDM01 Ensured Governance Framework Setting and Maintenance
• EDM02 Ensured Benefits Delivery
• EDM03 Ensured Risk Optimization
• EDM04 Ensured Resource Optimization
• EDM05 Ensured Stakeholder Engagement

Management Objectives Domains (35 objectives, APO + BAI + DSS + MEA)¶

• APO (Align, Plan, and Organize) - 14 objectives
• BAI (Build, Acquire, and Implement) - 11 objectives
• DSS (Deliver, Service, and Support) - 6 objectives
• MEA (Monitor, Evaluate, and Assess) - 4 objectives

COBIT 2019 Components (Enablers)¶

1. Processes
2. Organizational structures
3. Information flows
4. People, skills, and competencies
5. Culture, ethics, and behavior
6. Services, infrastructure, and applications
7. Principles, policies, and frameworks

Six Governance System Principles¶

1. Provide stakeholder value
2. Holistic approach
3. Dynamic governance system
4. Governance distinct from management
5. Tailored to enterprise needs
6. End-to-end governance system

Key Frameworks (Memorize)¶

ISO 27001 Annex A (2022 Revision)¶

The 93 controls in Annex A of ISO/IEC 27001:2022 are organized into 4 themes (down from 14 domains in the 2013 version):

NIST SP 800-53 Rev. 5 Control Families (20)¶

AC, AT, AU, CA, CM, CP, IA, IR, MA, MP, PE, PL, PM, PS, PT, RA, SA, SC, SI, SR.

COSO Internal Control - Integrated Framework (5 Components)¶

1. Control Environment (tone at the top)
2. Risk Assessment
3. Control Activities
4. Information and Communication
5. Monitoring Activities

Mnemonic: CRIME (Control env, Risk, Info, Monitoring, control activitiEs).

SDLC Phases (Generic Waterfall, CISA Domain 3)¶

1. Feasibility study (cost-benefit, risk, alternatives)
2. Requirements definition
3. Design (logical and physical)
4. Development (coding)
5. Testing (unit, integration, system, UAT, regression)
6. Implementation (deployment, conversion, training)
7. Post-implementation review (was the business case realized?)

Testing Types¶

Cutover (Implementation) Strategies¶

• Direct (big-bang) - cut over instantly; highest risk
• Parallel - old and new run together; safest, costliest
• Phased - module by module; balanced
• Pilot - one location/group first; localized risk

BCP/DR Recovery Metrics (Same as CISSP)¶

• RTO - Max acceptable downtime
• RPO - Max acceptable data loss
• MTD / MTPD - Maximum Tolerable Downtime; RTO must be less
• WRT - Work Recovery Time (data restore + validation after RTO)
• MTTR - Mean Time to Repair
• MTBF - Mean Time Between Failures
• SDO - Service Delivery Objective (degraded service level during DR)
• MTO - Maximum Tolerable Outage in alternate process mode

RTO + WRT must fit within MTD.

Recovery Sites¶

Backup Schemes¶

DR Test Types (Least to Most Disruptive)¶

1. Read-through (checklist)
2. Walk-through (structured discussion)
3. Tabletop (scenario-based discussion)
4. Simulation (operational exercise; no real failover)
5. Parallel (alternate site processes in parallel with prod)
6. Full interruption (production fails over to alternate; highest risk, highest realism)

Network Devices and OSI Layers¶

Identity and Access Models¶

• DAC - owner-controlled (Windows ACLs)
• MAC - system-enforced labels (military, SELinux)
• RBAC - permissions via roles
• ABAC - attribute-based rules
• RuBAC - rule-based (firewalls)

Cryptography Cheat Sheet¶

Common Audit Findings (Severity Levels)¶

Finding Structure (5 C's)¶

A well-written audit finding contains:

1. Criteria - the standard / requirement (policy, regulation, framework)
2. Condition - what was observed
3. Cause - why the condition exists
4. Consequence - the impact / risk
5. Corrective action (recommendation) - what management should do

ISACA Code of Professional Ethics (Memorize)¶

ISACA members and certification holders shall:

1. Support the implementation of and encourage compliance with appropriate standards, procedures, and controls.
2. Perform their duties with objectivity, due diligence, and professional care, in accordance with professional standards.
3. Serve in the interest of stakeholders in a lawful manner, while maintaining high standards of conduct and not engaging in acts discreditable to the profession or association.
4. Maintain the privacy and confidentiality of information obtained in the course of duties unless disclosure is required by legal authority. Such information shall not be used for personal benefit nor released to inappropriate parties.
5. Maintain competency in their respective fields and undertake only those activities they can reasonably expect to complete with the necessary skills, knowledge, and competence.
6. Inform appropriate parties of the results of work performed, including the disclosure of all significant facts known to them that, if not disclosed, may distort the reporting of the results.
7. Support the professional education of stakeholders in enhancing their understanding of the governance and management of enterprise IT, including audit, control, and security.

The exam tests application of these canons. When in doubt, prioritize objectivity, confidentiality, and competence.

Independence¶

• Independence in fact - actual freedom from bias
• Independence in appearance - perception of objectivity to outsiders

Independence applies to: - The audit function (organizational placement, ideally reporting to audit committee or board) - The individual auditor (no involvement in design/operation of audited area)

If independence is impaired, the auditor must disclose and may need to recuse.

Audit Charter¶

A foundational document approved by the board / audit committee that: - Establishes audit's authority and scope - Confirms reporting line (audit committee) - Establishes independence - Defines responsibilities

The audit charter is the FIRST artifact for any internal audit function and is required by ITAF.

CAATs (Computer-Assisted Audit Techniques)¶

Tools auditors use to test electronically: - Generalized audit software (ACL, IDEA) - read, analyze, sample data - Test data / Integrated test facility (ITF) - submit test transactions through production code - Parallel simulation - re-perform processing with auditor's logic; compare to production - Embedded audit modules / SCARF (Systems Control Audit Review File) - real-time monitoring of transactions - Snapshots - capture state of data at points in time - Mapping / Tracing - follow execution paths

CAATs increase efficiency and enable 100% population testing on large datasets.

Privacy Regulations (Domain 5 / Domain 2 Overlap)¶

• GDPR (EU) - DPO, DPIA, 72-hour breach notification, $20M / 4% global turnover fines
• CCPA / CPRA (California) - opt-out, opt-in for under 16
• HIPAA (US) - PHI, BAA, breach notification 60 days
• GLBA (US financial) - Safeguards Rule, Privacy Rule
• SOX (US public companies) - Section 302/404, IT general controls
• PCI DSS v4.0 (payment cards) - 12 requirements; contractual not legal
• PIPEDA (Canada), LGPD (Brazil), POPIA (South Africa), APPI (Japan)

Official Documentation Links¶

• ISACA CISA page: https://www.isaca.org/credentialing/cisa
• CISA exam content outline: https://www.isaca.org/credentialing/cisa/cisa-exam-content-outline
• ITAF: https://www.isaca.org/resources/itaf
• COBIT 2019: https://www.isaca.org/resources/cobit
• NIST publications: https://csrc.nist.gov/publications
• ISO standards catalog: https://www.iso.org/standards.html
• COSO: https://www.coso.org

CPE Categories (ISACA)¶

CPEs may be earned via: ISACA chapter meetings, conferences (ISACA, RSA, BlackHat), webinars, ISACA Journal articles, vendor training, college courses, teaching, exam authoring, mentoring, publication. The ISACA portal tracks CPEs in real time. Audit retention: 12 months past the reporting cycle.

Quick Mnemonic Reference¶

• 5 C's of findings - Criteria, Condition, Cause, Consequence, Corrective action
• CRIME (COSO) - Control env, Risk assessment, Info & communication, Monitoring, control activitiEs
• EDM-APO-BAI-DSS-MEA (COBIT 2019) - the 5 domains
• PDCA (ISO 27001) - Plan, Do, Check, Act
• NIST CSF 2.0 - Govern, Identify, Protect, Detect, Respond, Recover (GIPDRR)