CISA – Certified Information Systems Auditor

Information System Auditing Process

• IS audit standards, guidelines, functions, and codes of ethics
• Types of audits, assessments, and reviews
• Risk-based audit planning
• Types of controls and considerations
• Audit project management
• Audit testing and sampling methodology
• Audit evidence collection techniques
• Audit data analytics
• Reporting and communication techniques
• Quality assurance and improvement of the audit process

Governance and Management of IT

• Laws, regulations, and industry standards
• Organizational structure, IT governance, and IT strategy
• IT policies, standards, procedures, and guidelines
• Enterprise architecture and considerations
• Enterprise risk management (ERM)
• Data privacy program and principles
• Data governance and classification
• IT resource and vendor management
• IT performance monitoring and reporting
• Quality assurance and quality management of IT

Information Systems Acquisition, Development & Implementation

• Project governance and management
• Business case and feasibility analysis
• System development methodologies
• Control identification and design
• System readiness and implementation testing
• Configuration and release management
• System migration, infrastructure deployment, and data conversion
• Post-implementation review

Information Systems Operations and Business Resilience

• IT components, asset management, and job scheduling
• System interfaces; end-user computing and shadow IT
• Systems availability and capacity management
• Problem and incident management
• IT change, configuration, and patch management
• Operational log management and IT service level management
• Database management
• Business impact analysis; system and operational resilience
• Data backup, storage, and restoration
• Business continuity and disaster recovery plans

Protection of Information Assets

• Information asset security policies, frameworks, and standards
• Physical and environmental controls
• Identity and access management
• Network and endpoint security; data loss prevention
• Data encryption and public key infrastructure (PKI)
• Cloud and virtualized environments
• Mobile, wireless, and Internet-of-Things device security
• Security awareness training and programs
• Attack methods, security testing tools, and monitoring
• Security incident response, evidence collection, and forensics