CISA — Certified Information Systems Auditor

Exam CISA ISACA Advanced

The audit and assurance certification. The standard credential for IT audit, and increasingly asked for in compliance-heavy sectors. The main course is short on Domains 3–5; the continuity course in Step 4 and the control labs in Step 3 fill part of the gap.

6 courses · 38 sections · 205 lectures · 24 labs · ≈ 33 h of hands-on labs

All 24 CISA hands-on labs on one page →

Free to start: the free lessons and guides for this roadmap →

Exam domains

Information System Auditing Process — 18%
Governance and Management of IT — 18%
Information Systems Acquisition, Development and Implementation — 12%
Information Systems Operations and Business Resilience — 26%
Protection of Information Assets — 26%

FreeThe 5 CISA Domains Explained

Try a free cloud security lab: Left open (~4 min) → A scripted simulation in your browser. No account needed.

The path

Start here →

Step 1 — Learn the CISA domains

Audit process, governance, acquisition, operations and asset protection: the five domains, by the current outline's names.

1 course · 10 sections · 74 lectures

Learn

CourseISACA - Certified Information Systems Auditor - CISA (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
10 sections · 74 lectures
1. Training Overview 1
2. Introduction 5
3. CISA Course and Certification 5
4. Basic Knowledge 10
5. Domain 1 — Information System Auditing Process 11
6. Domain 2 – Governance & Management of IT 17
7. Domain 3 – Information Systems Acquisition, Development, & Implementation 7
8. Domain 4 – Information Systems Operations and Business Resilience 10
9. Domain 5 – Protection of Information Assets 7
10. Audio Version of Training 1

Step 2 — Governance, risk and the three lines of defence

How governance, risk and controls fit together, and where IT audit sits as the third line of defence.

1 course · 15 sections · 72 lectures

Learn

CourseMastering Governance, Risk, and Compliance (GRC): A Handbook (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
15 sections · 72 lectures
1. Course Overview 2
2. Introduction 6
3. Module 1 - What is Governance Risk and Compliance - Quite Literally 9
4. Module 2 - The Three Lines of Defense 7
5. Module 3-Step 1 Information Gathering-Understand the organisation risk universe 11
6. Module 4 - Step 2: Drafting inherent risks 14
7. Module 5 - Step 3: Mapping the Lines of Defense - Roles and Responsibilities 4
8. Module 6 - Step 4: Existing Controls Environment 5
9. Module 7 - Step 5: Residual Risk 2
10. Module 8 - Follow Through 2
11. Module 9 - Bringing it all together 1
12. Module 10 - GRC Tools 2
13. Module 11 - IT Auditing: The Third Line of Defense 3
14. Module 12 - Course Conclusion 3
15. Audio Version of Training 1

Step 3 — Controls in practice

See the controls you will audit, working on real systems.

24 labs

Learn

CourseCovered in ISACA - Certified Information Systems Auditor - CISA (opens in a new tab)opens on courses.stationx.net — Domain 1 (auditing process) and Domain 5 (protection of information assets) chapters 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
10 sections · 74 lectures
1. Training Overview 1
2. Introduction 5
3. CISA Course and Certification 5
4. Basic Knowledge 10
5. Domain 1 — Information System Auditing Process 11
6. Domain 2 – Governance & Management of IT 17
7. Domain 3 – Information Systems Acquisition, Development, & Implementation 7
8. Domain 4 – Information Systems Operations and Business Resilience 10
9. Domain 5 – Protection of Information Assets 7
10. Audio Version of Training 1

Practise

LabsCritical Security Controls — 7 labs 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
- Auditing Service Accounts and Setting Up Automated Log CollectionDuration: 2 h
- CIRP Creation and DisasterDuration: 2 h
- Comparing ControlsDuration: 1 h
- Creation of Standard Operating Procedures for RecoveryDuration: 1 h
- Identifying Key AssetsDuration: 1 h
- Monitoring and Verifying Management SystemsDuration: 1 h
- Sensitive Information IdentificationDuration: 1 h
LabsCyber Security Fundamentals — 17 labs 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
- BCP DRP and Test PlanningDuration: 2 h
- BitLocker SetupDuration: 1 h
- Block Incoming Traffic on Known PortDuration: 1 h
- Creating a List of Installed Programs, Services and User Accounts from a WIN2K12 ServerDuration: 1 h
- Creation of BCP and DRPDuration: 3 h
- Data Backup to Prep for RecoveryDuration: 1 h
- Event LogDuration: 1 h
- Host Data Integrity BaseliningDuration: 1 h
- Installing Patches and Testing SoftwareDuration: 2 h
- MITRE - AttackDuration: 1 h
- MITRE - DefendDuration: 1 h
- Network DiscoveryDuration: 2 h
- Network Segmentation (FW/DMZ/WAN/LAN)Duration: 1 h
- Network Topology GenerationDuration: 2 h
- Open Source CollectionDuration: 2 h
- Windows Event Log Manipulation via Windows Event ViewerDuration: 1 h
- WiresharkDuration: 1 h

Free resources

Step 4 — Business resilience

Business continuity and disaster recovery planning — the resilience half of Domain 4 (26%).

1 course · 3 sections · 8 lectures

Learn

CourseBusiness Continuity and Disaster Recovery Planning (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
3 sections · 8 lectures
1. Descrition 1
2. BCP / DRP 6
3. Audio Version of Training 1

Step 5 — Land the audit job

Prepare for an IT auditor interview.

1 course · 6 sections · 38 lectures

Learn

CourseIT Auditor Interview (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
6 sections · 38 lectures
1. Training Overview 1
2. Introduction 1
3. General Job Interview Prep 13
4. Job Specific Prep 21
5. Conclusion 1
6. Audio Version of Training 1