Prepare from ISACA's current job-practice domains rather than memorizing leaked questions. This guide turns the official CISA, CISM, CRISC, and CDPSE outlines into a practical study method built around audit judgment, governance, risk decisions, information-security management, and privacy engineering.
ISACA updates job-practice areas over time. The domain names and question counts below were checked against current ISACA pages on September 30, 2026. Verify the linked exam content outline before your test date.
The four certifications overlap in governance and risk vocabulary, but they test different professional viewpoints. Study becomes much easier when you know which role the question expects you to inhabit.
Use CISA when your work centers on planning audits, evaluating controls, collecting sufficient evidence, reporting findings, reviewing governance, assessing system acquisition and change, evaluating operations/resilience, and protecting information assets.
Use CISM when your work centers on security governance, risk management, security-program design and operation, and incident management. The management viewpoint matters more than hands-on configuration trivia.
Use CRISC when your work centers on governance, risk assessment, risk response/reporting, and the technology/security controls that support treatment decisions. Expect questions about ownership, appetite, response, monitoring, and evidence.
Use CDPSE when your work bridges privacy governance and technical implementation: privacy risk, compliance, data lifecycle, architecture, and engineering controls that turn policy obligations into system behavior.
ISACA's current CISA exam content outline lists 150 questions across five job-practice domains: Information System Auditing Process; Governance & Management of IT; Information Systems Acquisition, Development & Implementation; Information Systems Operations and Business Resilience; and Protection of Information Assets.
Study audit planning, risk-based scope, evidence quality, sampling, testing, analytics, reporting, follow-up, independence, and professional judgment. In scenario questions, distinguish what the auditor should verify from what management should operate.
Understand strategy alignment, organizational structures, policies, enterprise architecture, portfolio decisions, performance measurement, sourcing, and governance accountability. Ask who owns the decision and which evidence shows governance is working.
Review business cases, requirements, project governance, SDLC controls, testing, data migration, change management, implementation readiness, and post-implementation review. Focus on assurance that a system was authorized, tested, accepted, and changed through controlled processes.
Connect operations, service management, capacity, backup, disaster recovery, business continuity, identity, network security, cryptography, data protection, logging, vulnerability management, and incident response to audit objectives and evidence.
Owner sources: CISA Exam Content Outline and official CISA practice quiz.
ISACA's current CISM outline lists four domains: Information Security Governance, Information Security Risk Management, Information Security Program, and Incident Management. The unifying skill is management judgment: connect security decisions to business objectives, risk ownership, resources, policy, measurement, and response capability.
Study how security strategy, policy, roles, organizational structures, legal/regulatory context, metrics, and executive oversight support business objectives. The strongest answer is often the one that establishes authority, ownership, and direction before jumping to a technical control.
Practice identifying assets, threats, vulnerabilities, consequences, likelihood, existing controls, residual risk, appetite, treatment, and risk communication. Separate the role that analyzes risk from the business owner authorized to accept it.
Build a program as a managed portfolio of capabilities: roadmap, architecture, controls, workforce, awareness, vendors, budget, metrics, assurance, and continual improvement. Know how a program turns governance direction into repeatable operations.
Study preparation, detection, classification, escalation, response, communications, evidence, recovery, business continuity dependencies, post-incident learning, and program improvement. Do not assume the security manager personally performs every technical action.
Owner sources: CISM Exam Content Outline and official CISM practice quiz.
ISACA's current CRISC outline covers Governance, Risk Assessment, Risk Response and Reporting, and Technology and Security. Build a single risk-management loop in your notes and map every objective into it: context and ownership → identify/analyze → choose response → implement controls → monitor/report → reassess.
Know risk governance structures, culture, strategy, policies, standards, accountability, appetite/tolerance, enterprise risk integration, and the effect of laws, contracts, and third parties on risk decisions.
Practice scenarios where asset value, threat, vulnerability, control effectiveness, likelihood, and impact are incomplete. Identify what additional information changes the decision rather than automatically choosing the most restrictive control.
Compare avoidance, mitigation, transfer/share, and acceptance. Track action owners, deadlines, residual risk, KRIs, control performance, exceptions, escalation, and stakeholder reporting. A risk response is incomplete until ownership and monitoring exist.
Understand the technology enough to evaluate control design and risk consequence: architecture, identity, network/cloud, data, SDLC, resilience, security operations, privacy, and emerging technology. Study why a control reduces a specific risk rather than memorizing tool names.
Owner sources: CRISC Exam Content Outline and official CRISC practice quiz.
ISACA's current CDPSE outline lists four domains: Privacy Governance; Privacy Risk Management and Compliance; Data Life Cycle Management; and Privacy Engineering. That four-domain structure is important because older study material may describe a different blueprint.
Study privacy roles, policy, accountability, training, strategy, records, oversight, third parties, and governance evidence. Separate legal interpretation from the engineering decisions that implement approved privacy requirements.
Practice identifying privacy risk, evaluating controls, performing assessments, managing issues, tracking regulatory/contractual requirements, and producing evidence. Avoid treating every privacy rule as globally identical; scope and jurisdiction matter.
Map collection, use, storage, sharing, retention, archival, deletion, access, lineage, classification, and cross-system movement. Many privacy failures are lifecycle failures: the organization cannot answer where data came from, why it exists, who received it, or when it should be removed.
Translate privacy requirements into architecture and technical controls: minimization, access control, encryption, pseudonymization, consent/preference handling where applicable, logging, deletion, testing, secure development, and privacy-preserving design patterns.
Owner sources: CDPSE Exam Content Outline and official CDPSE practice quiz.
ISACA questions often present several technically plausible actions. Start by identifying the role implied by the certification and the phase of work in the scenario. An auditor gathers sufficient evidence before concluding. A manager establishes governance and risk ownership before prescribing a tool. A risk professional evaluates response options and residual risk. A privacy engineer implements controls from defined requirements and validates that the design actually behaves as intended.
ISACA provides free practice quizzes for these credentials. Use them to understand question style and the reasoning expected by the certification. Do not use recalled, copied, leaked, or live-exam questions. Build your own scenario bank from the official domains and explain why every distractor is weaker than the selected answer.
For every domain, record the key objective, the responsible role, the artifact that proves the work happened, and a scenario where that artifact would be insufficient. Examples include audit plans, risk registers, security strategies, incident plans, access reviews, privacy assessments, data-flow records, exception approvals, test evidence, and management reports.
Reviewed September 30, 2026. ISACA can update job-practice areas, application rules, fees, and delivery details. Verify the linked ISACA pages before registering or making a professional-credential decision.