Masterclass - CISA Exam (Updated 2026)

Learn how enterprise governance of information and technology aligns information technology with business objectives, manages information technology risks, and derives value from investments to optimize technology use for the organization.

Master enterprise governance of information and technology (EGIT) by ensuring IT adds value, aligns with organizational strategy, defines roles and accountability, and secures top management and board oversight.

Define IT policies, guidelines, and standards and explain how they guide acceptable behaviors and intent. Show how antivirus, access control, and information security policies support ISO 27001 compliance and audits.

Explore top down and bottom up approaches to policy development, their differences, advantages like consistency and risk assessment, and the case for using both together in organizations.

Identify the five key IT governance roles—board of directors, IT strategic committee, IT steering committee, system development management, and user management/project sponsor—and explain ownership, requirements, and deliverables.

Differentiate the IT strategy committee from the IT steering committee, outlining who advises the board and who implements IT projects. Emphasize alignment with business objectives, budgets, and performance monitoring.

Define enterprise architecture and its role in aligning technology initiatives with the IT framework, using the Zachman framework to cover current and future objectives.

Identify and apply four risk responses—mitigation, acceptance, avoidance, and transfer—or risk sharing through insurance and contracts to reduce risk to an acceptable level.

Explore risk analysis methods—quantitative, qualitative, and semi-quantitative—and learn to quantify risk using probability and impact, while considering data availability and cost-benefit implications.

Master enterprise risk management by identifying assets, threats, and vulnerabilities across IT, operational, investment, market, reputational, legal, and compliance risks; apply structured, qualitative risk assessment to inform security policy.

Explore the capability maturity model for risk management, identify gaps between current and desired states, and drive continuous improvement from initial to optimized processes.

Identify applicable laws and regulations, ensure adherence through a strong governance, risk, and compliance program, and manage offshore data storage, privacy, confidentiality, intellectual property rights, and financial information integrity.

Explore IT resource management, software escrow agreements with third-party escrow agents, and how to mitigate vendor risk, enforce access revocation, and align IT projects with business objectives.

Information systems auditors review outsourcing contracts to ensure agreements include IPR, data privacy, and BCP/DRP clauses; address jurisdiction and privacy when providers are abroad; monitor performance via service level agreements.

Identify critical IT processes, set targets for performance metrics, and use Six Sigma, Lean Six Sigma, IT balanced scorecard, KPIs, benchmarking, and root-cause analysis to measure and improve IT performance.

explains the IT balanced scorecard's dual aims to measure and optimize IT performance, using KPIs aligned with customer satisfaction, internal processes, and ability to innovate (CIA), monitored regularly.

Learn to differentiate quality assurance and quality control, focusing on process vs product. Explore how autonomous QC and segregation of duties drive continuous improvement in a quality management system.

Master PERT, CPM, FPA, EVA, and Gantt chart methods to estimate durations, monitor progress, size software, and apply timebox management for prototyping timelines.

Explore project management structure and prioritization techniques for timelines, including PERT, CPM, and Gantt charts; examine timebox management and critical path concepts.

Analyze the business case and feasibility analysis to justify projects, assess return on investment, risks, costs, and benefits, and support decision making.

Explore agile system development, emphasizing rapid coding with minimal pre-planning and limited documentation. Learn why lack of documentation is the major CISA risk and how end-of-iteration reviews capture lessons learned.

Explore object-oriented system development and its core concepts, including encapsulation and polymorphism, with an emphasis on how these ideas support modular reuse for the CISA exam.

Explore prototype and rapid application development to test concepts, achieve significant time and cost savings, and deliver continually updated prototypes with top-down testing and change control considerations.

Explore key aspects of system development methodologies, including Agile's fast iterations and documentation trade-offs, Waterfall's staged testing, prototype risks, rapid application development, and reuse-focused object-oriented and component-based approaches.

Analyze system development methodologies, emphasizing agile documentation challenges, rapid application development, prototyping benefits, and how prototyping reduces deployment time and costs.

Explore how a check digit ensures data accuracy by validating a 12-digit bank account number, with the 12th digit derived from the 11 digits to detect transposition and transcription errors.

Explore how parity bits, checksums, and cyclic redundancy check detect data transmission errors and preserve data integrity, with forward error control correcting errors and CRC as the preferred detection method.

Learn control identification and design and balancing, data integrity principles (atomicity, completeness, isolation, durability), and error detection and correction methods like crc, checksum, parity, and forward error control.

Explore control identification and design for data integrity, covering input error controls, limit checks, automated balancing, parity bits, and atomicity.

Discover testing methodologies in SDLC, including unit, integration, system, and acceptance testing (QAT and UAT). Compare white-box and black-box approaches, and top-down versus bottom-up strategies, including regression and parallel testing.

Explore system migration techniques such as parallel, abrupt, and phased changeovers, evaluate their advantages, risks, and data ownership responsibilities, and learn how parallel testing and backout plans safeguard the transition.

Explore post-implementation review objectives, determine whether project met objectives, assess ROI and risk controls, and document lessons learned for future projects to ensure business requirements are met.

Explore RFID fundamentals, risks such as unauthorized data access and regulatory non-compliance, and controls including encryption, access restrictions, and self-destruct capabilities.

Identify and inventory IT assets, capturing ownership, custodian, location, and security classification, then enforce an approved software list and ensure source and object code synchronization with date-and-time stamps.

Learn how automated job scheduling reduces errors and increases availability and security by automatically running batch jobs, tape backups, and maintenance during non-peak times.

Explore end-user computing, where non-programmers create their own applications to speed deployment and reduce IT workload, while managing risks from limited testing, weak change controls, security gaps, and backups.

Master system performance management, covering software license requirements, source code management, log management, parameter setting, and registry control. Emphasize auditor practices for open source, escrow, version control, and centralized logging.

Analyze problem and incident management to prevent recurrence through root cause analysis, exception reporting, and effective support models, while distinguishing objectives of reducing incidents and rapid incident recovery.

Explore essential network management tools and reports, including response time, downtime, and help desk reports, online and network monitors, network protocol analyzers, and SNMP-based monitoring with agents.

Explore change, configuration, release, and patch management practices, including approval, testing, rollback, and code signing, to ensure accountability, proper logging, and effective emergency change handling.

Monitor service levels regularly under IT service level management, ensure data is used for agreed purposes, and rely on independent audits to confirm control effectiveness.

Explore the relational database model, focusing on primary and foreign keys, referential integrity, and how primary tables connect to related tables to safeguard consistent, linked data.

Understand database normalization, redundancy, and denormalization, and how denormalization increases data redundancy and integrity risk. Learn when an IS auditor should analyze justification and compensatory controls for non-normalized tables.

Explore database checks and controls, including concurrency control, atomicity, and acid properties (consistency, isolation, durability), along with integrity constraints and referential integrity.

explain roles and responsibilities of database administrators, enforce segregation of duties, use named accounts for changes, capture and review database activity logs, and protect log integrity to ensure accountability.

Explore database management with exam-focused topics like data owner authorization, data flow diagrams, and data integrity. Apply controls against unauthorized changes, review logs, and address default security settings.

Identify critical processes with highest impact, design early recovery strategies, and tailor recovery plans from BIA outcomes, using questionnaire, interview, and meeting approaches while weighing downtime and recovery costs.

Differentiate alternative routing from diverse routing, using split or duplicate cable facilities to reroute traffic. Distinguish last mile local loops from long haul and note redundancy consequences.

Learn to develop a well-documented, simple BCP aligned with risk assessment, ensuring an offsite location, disaster declarations, process owners, and alignment with IT plans for human life protection.

Explore full backups, differential backups, and incremental backups, including how each backs up data and their restoration speeds, with full backups restoring fastest.

Explore RTO and RPO definitions, their impact on downtime and data loss, and how backups, hot sites, and data mirroring shape disaster tolerance and costs.

Explore alternate recovery sites from hot, warm, cold, and mobile options, comparing speed, cost, and readiness, and understand reciprocal agreements for disaster recovery planning.

Differentiate BCP and DRP, noting BCP preserves operations via alternate sites while DRP restores IT-enabled operations; begin with a BIA and address RTO, RPO, downtime and recovery costs.

Explore the information security management framework, focusing on security policy, data owners' responsibilities, data classification ownership, and IT security baseline sufficiency with practical questions on logical access controls.

Explore ISACA privacy principles and how organizations specify purposes, obtain consent for cross-border transfers, retain data as needed, and ensure security and governance.

Compare water-based and dry-pipe fire suppression systems, and evaluate halon, fm-200, argonite, and carbon dioxide for safety and environmental impact.

Explain the three factors of authentication—something you know, something you have, and something you are—using examples like password, pin, token, smart card, and biometrics.

assess identity and access management through logical access controls, data owners in data classification, and two-factor authentication for stronger security.

Explore identity and access management, emphasizing logical access controls, need-to-know access, and approved processes to protect the confidentiality and integrity of information.

Explore identity and access management fundamentals, including access control methods, two-factor authentication, single sign-on security, and best practices for preventing unauthorized access and secure data disposal.

Explore biometric systems that use palm geometry, fingerprints, retina, iris, voice, and DNA to identify individuals, and evaluate accuracy with far, frr, and cer/eer.

Learn the seven OSI layers from physical to application, their core functions, and how data traverses the layers from sender to receiver and back.

Review the OSI model layers and their roles in routing, addressing, and reliable data transfer for the CISA exam, covering application, network, data link, transport, session, presentation, and physical layers.

Explore firewall types and concepts such as bastion hosts and proxies, and compare packet filtering, stateful inspection, application-level, and circuit-level firewalls across OSI layers.

Explore firewall implementation structures—screened host, dual-homed, and screened-subnet firewalls—and Bastion Host concepts to see why screened-subnet offers maximum protection.

Explore how a virtual private network extends a private network over the internet with encryption and tunneling, enabling secure remote access while mitigating risks of encrypted traffic.

Explore LAN components: repeater, hub, switch, bridge, and router, and how OSI layers 1–3 define their capabilities and whether they use MAC or IP addressing.

Compare network physical media, twisted pair, coaxial, and fiber optic, distinguish UTP vs STP, and explain attenuation, EMI, and cross talk to identify fiber optic as secure, high-volume, long-distance option.

Explore voice over internet protocol (VoIP) basics, its security risks, and controls, including session border controllers, DoS protection, ARP poisoning, VLAN segregation, encryption, RBAC, and backup arrangements.

Master four wireless security best practices: enable MAC filtering and encryption, disable SSID and DHCP. WPA2 is the strongest encryption, and using static IPs reduces risk.

Explains the email flow via SMTP, why SMTP alone is insufficient, and how digital signatures provide end-to-end integrity and sender authentication for safer communications.

Identify information assets, inventory them, establish ownership, classify data as critical, sensitive, or private, label assets, and implement access control lists to protect integrity and confidentiality.

Compare symmetric and asymmetric encryption, and learn how public/private keys and message hashing support confidentiality, authenticity, integrity, and non-repudiation.

Explore the elements of public key infrastructure, including the roles of certificate authorities, registration authorities, the certificate lifecycle, the certificate revocation list, and the certification practice statement.

Evaluate the effectiveness of security awareness programs by interviewing employees and reporting incidents. Foster information security awareness through frequent training and accountability to address social engineering and phishing risks.

Explore information system attack methods and techniques, including botnets, buffer overflow, DoS, data diddling, pharming, and social engineering, and analyze how security controls mitigate these threats.

Explore key information system attack methods and techniques, including IP spoofing, social engineering, parameter tampering, data diddling, botnets, man-in-the-middle attacks, buffer overflow, phishing, and passive attack risks.

Investigate information system attack methods and techniques, from ip spoofing and ddos to social engineering, data diddling, and replay attacks, and apply security awareness training and password masking.

Compare network-based and host-based intrusion detection systems, and learn how signatures, statistics, and neural networks detect threats; distinguish ids from ips and their placement, components, and limitations.

Learn how incident response management minimizes outage duration and impact, coordinates a CSIRT with defined roles, real-time detection tools, and evidence handling to rapidly recover operations.

Master the chain of custody and key forensics steps for the CISA exam, including data protection, data acquisition, imaging, extraction, interrogation, ingestion, normalization, and reporting for admissible digital evidence.