What's the total cost of renewing CISA?

Approximately $540 over 3 years if you're an ISACA member ($135/year membership × 3 + $45/year cert fee × 3). Non-members pay ~$750. Both totals assume you cover all CPEs through free ISACA content + the Journal — most CISAs do, since membership unlocks both.

Do CPEs from one ISACA cert count toward another I hold?

Yes — partially. CPEs earned from activities relevant to multiple ISACA Job Practices count toward each applicable credential. A webinar on "Continuous Auditing in Cloud Environments" can count toward CISA + CISM if both Job Practices reference the topic. You still need to meet each cert's individual annual floor and total — there's no automatic shared credit.

What does an ISACA audit actually look like?

ISACA selects ~10% of certified members per cycle for audit. Selected members have 90 days to upload, per CPE entry: sponsor verification (email or certificate), proof of attendance, and a brief Job Practice tie. ISACA's audit is methodical but not adversarial — clean documentation clears in 3–4 weeks. The most common failure is the Job Practice tie missing, not the documents themselves.

Can I substitute a passing exam re-take for CPEs?

No. Unlike some CompTIA and AWS credentials, ISACA does not offer exam re-take as a renewal path. CPEs are the only mechanism. If you've fallen behind and the cycle is ending, your best move is to clear the ISACA Journal Quiz backlog (uncapped, ~1 CPE per article) and book a paid ISACA conference if you can swing it.

What happens if I miss the deadline?

ISACA moves the credential to a 90-day grace status. CPEs submitted in grace count toward the prior cycle; fees must be cleared. Beyond grace, the cert is revoked and full re-examination is required to reinstate. Members who anticipate falling short should email ISACA before the cycle ends — case-by-case extensions are sometimes granted for documented hardship.

CISA continuing education

ISACA's Certified Information Systems Auditor requires 120 Continuing Professional Education (CPE) hours over a 3-year cycle, plus a minimum of 20 CPEs each calendar year. The annual floor is the rule that catches most candidates off-guard — earning 60 CPEs in year 1, 60 in year 3, and nothing in year 2 fails maintenance even though the total looks healthy.

Recommended paths

If you were starting fresh

CPE TOTAL

95.3

COST

$799

TIME

22 hrs

ACTIVITIES

Free pool gets you 95.3 CPE toward the 120.0 gap. Add paid options to close it.

SOC Level 1 — TryHackMe Learning Path
Self-paced · TryHackMe · Free
+20
Cybersecurity Compliance Framework, Standards & Regulations
Self-paced · Coursera · Free
+12.5
Advanced Endpoint Investigations — TryHackMe Learning Path
Self-paced · TryHackMe · Free
+8
Systems Acquisition, Development and Implementation
Self-paced · Coursera · Free
+3
Practical Detection Engineering with Sigma Rules
Self-paced · Cybrary · 3 hr · Free
+3
AI For Incident Responders
Self-paced · Cybrary · Free
+2
AI For Grc Analysts
Self-paced · Cybrary · Free
+2
SOC Level 1 (Legacy) — TryHackMe Learning Path
Self-paced · TryHackMe · Free
+3
Access Control Basics
Self-paced · Cybrary · Free
+2
AI Foundations For Compliance Professionals — edX Professional Certificate
Self-paced · edX · Free
+2
Azure Assets Security Auditing Best Practices
Self-paced · Pluralsight · Free
+2
Audit and search activity in Microsoft Purview
Self-paced · Microsoft Learn · 1 hr 34 min · Free
+1.5
20 Critical Security Controls
Self-paced · SANS Institute · Free
+1.5
Open Season Cyberthreats i Threat Hunting 101
Self-paced · SANS Institute · Free
+1.5
Empowering Incident Response Automation
Self-paced · SANS Institute · Free
+1.5
Detecting Malicious Activity Large Enterprises
Self-paced · SANS Institute · Free
+1.5
Do CISOs Need Their Own Legal Counsel? Some Lessons from SolarWinds and Uber
Jan 15 · BrightTALK · Free
+1.5
Cloud Risk Management: A CISA's Field Guide
Jun 6 · ISACA · 1 hr 30 min · Free
+1.5
Tabletop Exercise: Ransomware Across a Hybrid Estate
Self-paced · BrightTALK · 1 hr 30 min · Free
+1.5
Cisco SecureX: Building the Integrated SOC
Self-paced · Cisco U · 1 hr 30 min · Free
+1.5
From Vulnerability Management to Exposure Management: Evolution or Revolution?
May 31 · BrightTALK · Free
+1.5
Everything You Need to Know about CGRC in North America
May 31 · BrightTALK · Free
+1.5
NEW-LIVE Ransomware Crisis Simulation with You in Control
May 31 · BrightTALK · Free
+1.5
PCI DSS 4.0: What Auditors Are Actually Asking For
Jun 30 · BrightTALK · 1 hr 15 min · Free
+1.3
Implement and manage Microsoft 365 retention and recovery
Self-paced · Microsoft Learn · 1 hr 19 min · Free
+1.3
Building an Effective Insider Risk Program
May 26 · ISACA · 1 hr 15 min · Free
+1.3
Certified in Governance, Risk and Compliance (CGRC) Info Session
Mar 12 · BrightTALK · Free
+1
The Workforce Under Pressure: Burnout, Skills Gaps and Organizational Risk (#1)
Oct 20 · BrightTALK · Free
+1
Building Maturing Threat Hunt Program
Self-paced · SANS Institute · Free
+1
Vulnerability Assessment and Management
Self-paced · Coursera · Free
+2
Improve Threat Detection Hunting Aws Cloud Mitre Att ck Matrix
Self-paced · SANS Institute · Free
+1
How to Ensure Your SOC is Built for Tomorrow’s Threats
Jun 7 · BrightTALK · Free
+1
Ransomware and Third-Party Global Supply Chains: Understanding & Mitigating Risks
Oct 3 · BrightTALK · Free
+1
Risks of Identity and Credential-Based Cyber Attacks: A Real-World Cybersecurity Incident Walkthrough
Sep 5 · BrightTALK · Free
+1
Trends from Hyperproof's 2024 IT Risk and Compliance Benchmark Report
May 30 · BrightTALK · Free
+1
Everything You Need to Know about CGRC
May 31 · BrightTALK · Free
+1
Vulnerability Intelligence, Three Ways
May 31 · BrightTALK · Free
+1
Level Up Your Cybersecurity Scalability
May 31 · BrightTALK · Free
+1
How to Implement Posture Management to Address Cyber Risks
Sep 22 · BrightTALK · Free
+1
Unmasking VENOM SPIDER— the Hacker Behind Golden Chickens Malware
Sep 19 · BrightTALK · Free
+1
Planning for COMPLETE Recovery from a Ransomware Attack
Jul 20 · BrightTALK · Free
+1
ISO 27001:2022 Transition — A Field Report
Self-paced · BrightTALK · 45 min · Free
+0.8
SOC Analyst Bootcamp: Live Triage Lab
Jun 20 · SANS Institute · 8 hr · $799
+8

How CISA renewal actually works

On top of CPEs, ISACA charges two fees: an annual ISACA membership renewal (~$135 for members, ~$165 for non-members as of 2025; verify before quoting) and a separate certification maintenance fee per credential ($45 for members, $85 for non-members). Holding multiple ISACA credentials (CISA + CISM, for instance) means paying the maintenance fee per cert — the membership covers them all.

CPEs are tracked in the ISACA Member Portal. Each entry needs a sponsor, date, hours, and a tie to ISACA's CISA Job Practice domains. ISACA explicitly audits ~10% of certified members each year — high enough that documentation discipline matters more here than for most peer certs.

What counts (and the category caps that surprise people)

Activities split into ISACA-sponsored and non-ISACA-sponsored. ISACA-sponsored activities (chapter meetings, ISACA conferences, OneTrust/training partnerships, ISACA-issued micro-credentials) count without per-category caps and are the cleanest CPEs to log. Non-ISACA-sponsored activities are subject to category limits per 3-year cycle.

The category caps that catch CISAs: Self-study courses (vendor-led training without an exam) — capped at 30 CPEs/cycle. Teaching/presenting — uncapped IF you cover new material each time, capped at the equivalent of the first delivery if you re-present the same content. Publishing — 5 CPEs per published article (capped at 20/cycle for non-peer-reviewed content). Mentoring as a CISA-Recognised Mentor — capped at 10 CPEs/year.

The cap that catches the most candidates: "on-the-job training and personal experience" earns ZERO CPEs. ISACA is explicit: regular work duties don't count, no matter how technical or audit-relevant.

Where CPE-eligible content actually lives

ISACA's own portal (isaca.org) offers ~50 free webinars per year for members, each pre-tagged with CPE count and the relevant CISA domain. Members also get unlimited access to the ISACA Journal — 1 CPE per article read with a documented quiz pass via the Journal Quiz feature. Most candidates earn 30–40 CPEs/cycle from these two sources alone, no external content needed.

External CPE-rich sources: SANS webcasts (free, 1 CPE each), Black Hat / DEF CON briefings (8 CPEs per session attended), audit-focused conferences like the IIA International Conference. RecertHero flags whether an opportunity carries an ISACA-issued CPE certificate or just a generic completion — the distinction matters for ISACA audits, which want the issuing body identified.

Linkedin Learning and Coursera courses are eligible if they include a graded exam or assessment. Without an assessment, ISACA treats them as self-study (subject to the 30-CPE cap). Many candidates over-rely on these and discover the cap mid-cycle.

Common pitfalls (and how to avoid them)

Pitfall 1: Missing the 20-CPE annual floor. The 3-year total looks healthy but year-2 silence triggers a maintenance failure. Audit the portal at the end of every calendar year — if you're under 20 for the year, schedule one ISACA webinar block in December.

Pitfall 2: Letting the dual fee go unpaid. ISACA bills membership and the maintenance fee separately, often in different months. Members with auto-renew on the membership but manual on the cert fee occasionally lapse on the cert side alone — the credential goes inactive even with current membership.

Pitfall 3: Mis-documenting non-ISACA content. ISACA's audit asks for: sponsor name, completion record, date, hours, and a sentence on how the activity ties to the CISA Job Practice. The Job Practice tie is the most-failed element in audit responses. Keep evidence for the full 3-year cycle plus 12 months.

CISAInformation Systems Auditor

Recommended paths

How CISA renewal actually works

What counts (and the category caps that surprise people)

Where CPE-eligible content actually lives

Common pitfalls (and how to avoid them)

Frequently asked

Opportunities that count

Planning for COMPLETE Recovery from a Ransomware Attack

Unmasking VENOM SPIDER— the Hacker Behind Golden Chickens Malware

How to Implement Posture Management to Address Cyber Risks

Trends from Hyperproof's 2024 IT Risk and Compliance Benchmark Report

NEW-LIVE Ransomware Crisis Simulation with You in Control

Everything You Need to Know about CGRC

Everything You Need to Know about CGRC in North America

Level Up Your Cybersecurity Scalability

From Vulnerability Management to Exposure Management: Evolution or Revolution?

Vulnerability Intelligence, Three Ways

Risks of Identity and Credential-Based Cyber Attacks: A Real-World Cybersecurity Incident Walkthrough

Ransomware and Third-Party Global Supply Chains: Understanding & Mitigating Risks

Browse CISA opportunities by type

Related certifications

Know one we’re missing?