A question I have been getting more often from people preparing for the CISA is whether the exam content has kept pace with the cloud security landscape. Specifically, whether studying for a credential that was established decades ago in a primarily on-premises world is going to give you relevant knowledge for the environments most organizations actually operate in today.
The concern is understandable. ISACA updates the CISA curriculum on a regular basis, but the exam has a reputation, not entirely undeserved, for being weighted toward traditional IT audit concepts that were developed in an era when the phrase “infrastructure as code” would have gotten a blank stare from most audit professionals.
Has the CISA Kept Up With Cloud?
Having spent time with both the current CISA content and the practical realities of cloud security auditing, my honest assessment is that the CISA gets more right than its critics acknowledge, particularly in a few specific areas, while still having gaps that are worth acknowledging.
What Does the CISA Get Right About Cloud Auditing?
What the CISA gets genuinely right for cloud environments is the foundational framework for evaluating controls regardless of where those controls are implemented. The Protection of Information Assets domain, for instance, covers logical access, including the concepts of identity management, authorization, authentication, and access reviews in ways that apply directly to cloud IAM systems even though the specific technology implementations are different from what the original exam authors were thinking about. The auditor who understands what adequate access controls look like, what evidence to request, and how to evaluate whether the controls in place match the policy is going to be effective whether the environment is an on-premises Active Directory implementation or an AWS IAM configuration. The framework knowledge transfers even when the specific technology does not.
How Does the CISA Handle Shared Responsibility?
Shared responsibility is a cloud security concept that the CISA curriculum handles reasonably well given that it maps to the longstanding audit principle of clearly defining control responsibilities between an organization and its third-party service providers. The cloud shared responsibility model, where the cloud provider handles security of the underlying infrastructure and the customer handles security in the configuration they deploy on top of it, is a specific instance of a more general third-party responsibility question that IT audit has always needed to address. CISA-trained auditors who understand the general principle are well-positioned to apply it to cloud-specific scenarios.
CISA Boot Camp
Instructor-led, with the exam voucher included.
Where Does the CISA Fall Short on Cloud?
Where the CISA content is less complete is in the technical specifics of cloud-native security architecture, the nuances of different cloud service models and their control implications, and the audit procedures specific to cloud provider environments. These gaps are real and they reflect the pace of cloud adoption outrunning the certification update cycle. Supplementing CISA preparation with cloud security-specific resources, including the CSA Security Guidance and the cloud provider security documentation available from AWS and through Microsoft’s compliance documentation, fills those gaps meaningfully.
The practical recommendation for CISA candidates who work in cloud-heavy environments is to treat the CISA as providing the governance and audit methodology foundation and to build cloud-specific knowledge on top of that foundation through supplemental study. The credential validates the methodology. Your cloud-specific knowledge demonstrates that you can apply it in the environment your employer actually operates.
Frequently Asked Questions
What domains are on the CISA exam?
As of 2026, ISACA’s CISA exam content outline has five domains: Information System Auditing Process (18 percent), Governance and Management of IT (18 percent), Information Systems Acquisition, Development and Implementation (12 percent), Information Systems Operations and Business Resilience (26 percent), and Protection of Information Assets (26 percent). Identity and access management is covered in the Protection of Information Assets domain.
How many questions are on the CISA exam?
The CISA exam has 150 questions, according to ISACA’s exam content outline. The questions are spread across the five domains in proportion to their weights.
How much experience do you need for CISA certification?
ISACA requires at least five years of professional information systems auditing, control or security work experience. That experience must be gained within the 10 years before you apply for certification.
How do you keep a CISA certification active?
CISA holders must earn and report at least 120 continuing professional education (CPE) hours in each three-year reporting period. At least 20 of those hours must be earned every year.
Where can you get instructor-led CISA training?
ExamNav offers a CISA (Certified Information Systems Auditor) boot camp. ISACA also sells its own CISA study materials, including a practice question subscription.
Related reading
- SolarWinds Changed Everything. Here's What the CISA Exam Gets Right About It.
- GDPR Just Went Live. Here's Why Your IT Audit Program Isn't Ready.
- CISA (Certified Information Systems Auditor) boot camp
Kim Walsh is a CISSP and seasoned cybersecurity practitioner with deep, hands-on experience in enterprise security architecture, risk management, and compliance. She is passionate about bringing the next generation into the IT and AI space, actively mentoring young people who are just finding their footing in the field. As the mother of five kids, she has both the patience and the battle-tested communication skills to explain just about anything to just about anyone.
