CISA and CISSP lead to different careers — IT audit versus broad security practice. Compare exams, requirements, costs and how to choose your fork.
Here is the misconception that sends people down the wrong study path: that CISA and CISSP are two rungs on the same ladder, and the only question is which to climb first. They are not rungs; they are forks. ISACA's Certified Information Systems Auditor certifies people who examine and assure systems and controls. ISC2's Certified Information Systems Security Professional certifies people who design, build and run security. One credential belongs to the assurance profession, the other to the security profession, and while the two careers overlap and trade staff constantly, they interview differently, report to different executives and reward different instincts.
Short answer: choose CISA if your career is heading into IT audit, assurance, compliance testing or working inside an audit function; choose CISSP if it is heading into security engineering, operations, architecture or security leadership. If you genuinely sit between the two — many governance, risk and compliance (GRC) roles do — the deciding factors below are your evidence base for experience, your appetite for each exam format, and which department you want signing your objectives in five years.
CISA is ISACA's flagship for IT auditors and has been the default credential of that profession for decades — ISACA reports more than 151,000 holders. Its five domains, refreshed in the 2024 exam content outline (effective 1 August 2024), are: the IS auditing process (18%), governance and management of IT (18%), systems acquisition, development and implementation (12%), operations and business resilience (26%), and protection of information assets (26%). Notice the shape: even the security domain is examined from the auditor's seat — can you evaluate whether controls exist, operate and are evidenced, rather than configure them yourself.
CISSP is ISC2's flagship for experienced security professionals. Its eight domains — security and risk management, asset security, security architecture and engineering, communication and network security, identity and access management, security assessment and testing, security operations, and software development security — cover the whole lifecycle of protecting an organisation. It is often described as "a mile wide", and the description is fair: CISSP tests broad, risk-informed judgement across everything a senior practitioner might touch.
The provider difference matters too. ISACA's ecosystem (CISA, CISM, CRISC, CGEIT, COBIT) is anchored in governance and assurance; ISC2's (CISSP, CCSP, SSCP) is anchored in practice. Which body's world you join shapes the conferences you attend, the CPE content you consume and the peer network you build.
Abstract domain lists hide the real difference, so picture the work.
An IT auditor with CISA spends her week planning an audit of the company's change-management process: sampling changes from the ticketing system, tracing approvals, testing whether emergency changes were retrospectively reviewed, writing findings that management cannot wriggle out of, and defending her conclusions to a steering committee. Her deliverable is an opinion, backed by evidence. Independence is her professional obligation — she must not design the controls she audits.
A security engineer or manager with CISSP spends the same week on the other side of that audit: tuning identity and access management roles, reviewing a new system's architecture against policy, running the weekly vulnerability triage, and — when the auditor's findings land — deciding which to fix now, which to risk-accept, and how to explain that decision upwards. His deliverable is defended systems and managed risk.
If the first paragraph sounds like your kind of satisfying, you are a CISA person. If the second does, you are a CISSP person. People who find both appealing usually belong in GRC — and should also weigh ISACA's risk-focused CRISC, a comparison we cover in CISSP vs CRISC.
| Factor | CISA (ISACA) | CISSP (ISC2) |
|---|---|---|
| Profession | IT audit, assurance, compliance | Security practice and leadership |
| Exam format | 150 multiple-choice questions, 4 hours, linear | Computerised adaptive (CAT), 100–150 items, up to 3 hours |
| Passing score | 450 on a 200–800 scale | 700 on a 0–1000 scale (result reported pass/fail) |
| Exam cost (2026) | US$575 ISACA member / US$760 non-member, + US$50 application fee | US$749 (Americas; regional prices vary) |
| Experience required | 5 years IS audit/control/assurance/security, waivers up to 3 years | 5 years cumulative in 2+ of 8 domains, 1-year waiver possible |
| Can you sit it early? | Yes — apply for certification within 5 years of passing | Yes — pass now, hold Associate of ISC2 status, up to 6 years to earn experience |
| Domains | 5, audit-centred | 8, security-wide |
| Renewal | 20 CPE hours/year, 120 per 3-year cycle, annual maintenance fee | 120 CPE credits per 3-year cycle, US$135 annual maintenance fee |
| Best for | Auditors, assurance consultants, compliance testers | Engineers, architects, security managers, consultants |
Fees are 2026 list prices and vary by region, membership and tax — confirm on isaca.org and isc2.org before registering.
Neither provider publishes pass rates, so ignore any article quoting one. What you can compare honestly is format and failure mode.
CISA's difficulty is judgement in the auditor's voice. Four hours and 150 questions is a test of stamina and consistency, but the real trap is answering as a practitioner. CISA's "best answer" is usually the audit-correct action — gather evidence, assess the control, report through the proper channel — and technically savvy candidates fail by choosing the hands-on fix instead. The scaled 450/800 pass mark has no published percentage equivalent, so aim for consistent domain coverage rather than a target raw score.
CISSP's difficulty is breadth under adaptive pressure. Since April 2024 the exam has been computerised-adaptive in every language: 100–150 items in a maximum of three hours, with no going back to previous questions. The adaptive engine keeps serving items near the edge of your ability, which feels punishing even when you are passing, and the sheer span of eight domains means almost every candidate has two or three weak areas. Most people who fail CISSP fail on breadth, not depth.
Time pressure differs too: CISA gives you a generous 96 seconds per question; CISSP's ceiling of three hours across up to 150 adaptive items leaves less slack, and the inability to revisit questions punishes dithering.
Study-wise, the formats reward different preparation. For CISA, drill full-length timed sets until the auditor's mindset is automatic. For CISSP, use practice questions diagnostically — score by domain, find your two weakest, and study those rather than re-reading what you already know. ExamPractice offers free sample questions for both the ISACA CISA exam and the ISC2 CISSP exam, with fuller question sets and a timed practice-test simulation for subscribers — useful for benchmarking readiness before you pay either provider's fee.
Both certifications separate passing the exam from being certified, and the details often decide the choice.
CISA: anyone can sit the exam. Certification requires five years of professional experience in IS audit, control, assurance or security, gained within the ten years before you apply, with waivers and substitutions available for up to three years. You have five years after passing to apply, plus a US$50 application fee.
CISSP: anyone can sit the exam too. Certification requires five years of cumulative paid experience in two or more of the eight domains; a relevant degree or an approved credential (CompTIA Security+ among them) waives one year, and only one waiver applies. Pass without the experience and you become an Associate of ISC2, with six years to accumulate the five. You then need an endorsement from an ISC2-certified professional within nine months of passing.
Practical implication: audit, control or security experience counts toward CISA, and security experience across two domains counts toward CISSP — so many mid-career professionals qualify for both. Write down what your last five years of work actually evidences before choosing; the credential you can defend in an application audit is worth more than the one you merely passed.
If you plan to hold both eventually — common at senior GRC and security-leadership levels — sequence by your current role, not by perceived prestige.
One sequencing myth to retire: CISA is not "easier CISSP" or a stepping stone to it. It is a peer-level credential for a different job.
The exam fee is the smallest number in this decision. Sketch the fuller picture before committing:
Both providers price regionally and adjust fees, so treat these as 2026 US figures and confirm before booking. On salary: both credentials sit in well-compensated territory — ISACA itself advertises a US$149K+ average annual salary for CISA holders, a self-reported provider figure — but pay tracks role, sector and geography far more than certificate. We take the full market-value question, including demand signals and salary evidence for both credentials, in a separate deep-dive on CISSP vs CISA salary and demand.
CISA's ceiling runs through audit management: senior IT auditor, IT audit manager, head of internal audit, chief audit executive — or the well-trodden exit into consulting, where Big Four and boutique assurance practices treat CISA as table stakes. From audit, professionals also cross into second-line risk roles, where ISACA's CRISC becomes relevant.
CISSP's ceiling runs through security leadership: senior engineer, architect, security manager, head of security, CISO — or principal-level consulting. If management is your endgame specifically, the closer comparison is ISACA's CISM rather than CISA; we settle that pairing in CISSP vs CISM.
The careers meet again at the top: CISOs answer to audit committees, and chief audit executives need credible security fluency. That is why senior people so often hold credentials from both bodies — and why choosing "wrong" at this fork costs you a detour, not a career.
Yes, and many senior GRC and security professionals do. Each is maintained separately — ISACA and ISC2 have independent CPE schemes and maintenance fees — but continuing education can often count toward both, and the combined signal (assurance plus practice) is strong for leadership roles.
Either can serve. If the role sits in the first line (running controls that must satisfy auditors), CISSP fits better; if it sits in the second or third line (testing and assuring those controls), CISA does. Read the reporting line in the job description, not just the title.
Usually not as a first flagship. Its brand is audit-specific, and outside assurance and GRC contexts it signals less than CISSP would. The exception is security professionals who interact heavily with auditors and regulators and want fluency in that world.
CISA gives a preliminary pass/fail on screen immediately, with the official score within ten working days. CISSP results are pass/fail with no numerical score reported to candidates.
Stop asking which certification is better and ask which profession you are joining. CISA is the auditor's credential: choose it if evidence, independence and assurance opinions are your trade, and let ISACA's wider governance stack (CRISC, CGEIT) extend it. CISSP is the practitioner's credential: choose it if building and running security is your trade, and let ISC2's concentrations extend that. If you are genuinely mid-fork, certify where your experience already lives, keep the other exam on a two-year horizon, and browse the full certification exam directory to see how either choice fits the wider credential landscape. Careers recover quickly from a suboptimal first flagship; they recover slowly from spending eighteen months studying for a profession you did not actually want.
Exam facts in this guide were checked against official certification-provider pages on . Fees, exam codes and policies change — confirm on the provider’s own site before you book.
Put it into practice
Reading about an exam only takes you so far. Work through practice questions for your certification and find the gaps before exam day does.
·10 min read
Certification or degree? Compare cost, time, employability and career ceiling honestly, with a decision framework for students and career changers.
Continue reading·10 min read
Network+ or CCNA? Compare difficulty, depth, cost, renewal and employer recognition, then pick the networking certification that fits your career plan.
Continue reading·9 min read
CCNA or CCNP? Since 2020 there is no prerequisite, so the choice is yours. Compare cost, difficulty, salary data and who should skip straight to CCNP.
Continue reading
