All certifications / CISA / Lessons
CISA 2024 job practice lessons
Study CISA for free
A week-by-week plan with every lesson, quizzes, checkpoint tests, a practice exam and hands-on labs.
Open the CISA study planA week-by-week plan with every lesson, quizzes, checkpoint tests, a practice exam and hands-on labs.
Domain 1: Information system auditing process
- IS audit standards, guidelines and the ISACA Code of Professional Ethics
- Types of audits, assessments and reviews: IS, compliance, financial, operational, integrated, forensic
- Risk-based audit planning: audit universe, risk assessment, annual plan and engagement scope
- Types of controls: preventive, detective, corrective, compensating; general vs application controls
- Audit project management: objectives, audit program, fieldwork, resourcing and independence
- Audit testing and sampling: compliance vs substantive tests, statistical and non-statistical sampling
- Audit evidence collection: sufficiency, reliability, relevance; inquiry, observation, inspection, reperformance
- Audit data analytics and CAATs, continuous auditing and continuous monitoring
- Audit reporting, follow-up and quality assurance of the audit function
Domain 2: Governance and management of IT
- Laws, regulations and industry standards affecting the organization
- IT governance, organizational structure and IT strategy: board, steering committee, business alignment
- IT policies, standards, procedures and governance frameworks such as COBIT
- Enterprise architecture and enterprise risk management (ERM)
- Privacy programs and privacy principles
- Data governance and data classification
- IT resource management: segregation of duties, staffing, budgeting and portfolio management
- IT vendor management: outsourcing, contracts, right to audit and SOC reports
- IT performance monitoring, reporting and quality management: KPIs, balanced scorecard, maturity
Domain 3: Information systems acquisition, development and implementation
- Project governance and management: roles, steering, earned value and project risk
- Business case and feasibility analysis
- System development methodologies: SDLC, agile, DevOps, prototyping and RAD
- Control identification and design: input, processing and output application controls
- System readiness and implementation testing: unit, integration, system, UAT and regression
- Implementation configuration and release management; changeover approaches
- System migration, infrastructure deployment and data conversion
- Post-implementation review and benefits realization
Domain 4: Information systems operations and business resilience
- IT components and IT asset management: hardware, software, inventory and licensing
- Job scheduling, production process automation and system interfaces
- End-user computing and shadow IT
- Systems availability and capacity management
- Problem and incident management
- IT change, configuration, release and patch management
- Operational log management and IT service level management
- Database management: DBMS controls, integrity, normalization and DBA duties
- Business impact analysis: criticality, RTO, RPO and MTD
- System resiliency and data backup, storage and restoration
- Business continuity and disaster recovery plans: recovery sites, testing and maintenance
Domain 5: Protection of information assets
- Information asset security policies, frameworks, standards and guidelines
- Physical and environmental controls
- Identity and access management: authentication, authorization, provisioning and access reviews
- Network and endpoint security: firewalls, segmentation, IDS/IPS, remote access and EDR
- Data loss prevention and data encryption
- Public key infrastructure (PKI) and digital signatures
- Cloud, virtualized, mobile, wireless and IoT environments
- Security awareness training and information system attack methods
- Security testing tools and techniques: vulnerability scanning, penetration testing and configuration review
- Security monitoring: logs, SIEM and alert management
- Security incident response management, evidence collection and forensics