Skip to content
CertGPS
Comparison

CISSP vs CISA: Building Security Controls or Auditing Them

CISSP is for people who build and run security controls, CISA for those who audit them. Exams, experience rules and how the two fit together, compared.

JW
Jennifer Williams
Security Architect
Published
Updated
Read time
4 min
On this page

Related certifications

Topics

CISSP vs CISA: Building Security Controls or Auditing Them

Ask which side of the control you work on. CISSP holders design and run security controls; CISA holders test whether someone else's controls work and report what they find. Both exams cover a wide spread of technology, but CISA grades you as an auditor, and an engineer who answers its questions by fixing the problem will lose marks.

The two exams in one table

CISSPCISA
IssuerISC2ISACA
FormatComputerized adaptive test; multiple choice and advanced item typesLinear exam; multiple choice, four options, one best answer
Questions100 to 150, including 25 unscored pretest items150
Time3 hours4 hours
Passing score700 out of 1000, reported as pass or fail450 on a scaled range of 200 to 800
Price$749 standard registration (Americas, Asia Pacific)US$575 members, US$760 non-members, plus US$50 application fee
ExperienceFive years of security work in two or more of eight domains; one year can be waivedFive years of IS audit, control, assurance or security work; up to three years can be waived
Renewal$135 a year and 120 CPE credits per three yearsUS$45 (members) or US$85 a year, 20 CPE hours a year and 120 per three years; ISACA auditing standards apply

Builders and assessors

CISA belongs to internal audit teams, audit firms, financial auditors moving into technology, and compliance staff whose work is testing other people's controls. If your deliverable is a findings report with management responses, it's your credential. ISACA counts more than 151,000 holders.

CISSP belongs to the people being audited: security engineers, architects, security managers and consultants who design programs. Its outline spends eight domains on how to build and operate security, from cryptography and identity to secure software development.

The awkward middle is the security professional who joins a risk or assurance function, or the auditor who specializes in security. For the first, CISSP is usually already earned and CISA adds the audit method. For the second, CISA comes first, and CISSP is worth adding if security reviews become most of the work. If your audits are mostly SOC 2 engagements, our SOC 2 auditor path covers what that work asks for beyond CISA.

What each exam asks you to be

The CISA outline gives the information system auditing process only 18% of the marks, yet its logic runs through every domain. Questions turn on what an auditor should do: plan by risk, pick a sampling method, decide whether evidence is sufficient, report rather than fix, and stay independent of the system under review. ISACA weights operations and business resilience at 26% and protection of information assets at 26%, so more than half the exam is about the systems you'd audit, judged from the auditor's chair.

CISSP covers audit too, from the other side. Domain 6, Security Assessment and Testing, asks you to design assessment and audit strategies, run vulnerability assessments and penetration tests, and conduct or facilitate internal, external and third-party audits. The question there is how to plan and survive an audit, and the person asking is the one who owns the controls. The rest of CISSP goes much deeper into security architecture, network design and cryptography than CISA's protection domain does.

The formats differ as much as the content. ISC2's adaptive engine targets questions you have about a 50% chance of answering correctly and ends the test as soon as it's confident of the result, so the CISSP can finish at 100 items. CISA is a fixed 150 questions in 240 minutes.

Holding both

Neither credential waives experience for the other. CISA isn't on ISC2's list of credentials that count for a year of CISSP experience, and CISSP isn't among ISACA's CISA waivers, which cover audit experience, degrees and a short list of audit and accounting credentials such as CIMA and ACCA. The experience itself transfers better. ISACA's candidate guide counts security work toward CISA's five years alongside audit, control and assurance, so a CISSP holder with five years in security may already meet CISA's requirement as written, provided two of those years fall within one CISA domain. Going the other way, audit work counts toward CISSP only where it sits inside its domains, such as security assessment and testing.

Both bodies offer a route for candidates who pass early. A CISSP candidate without the experience becomes an Associate of ISC2 with six years to earn it. ISACA members can hold the CISA Associate designation for four years for a US$25 fee.

Both appear in US defense hiring: ISC2 lists CISSP as approved under DoD Manual 8140.03, and ISACA announced CISA's approval for the same program in May 2024. Holding both means two annual fees and two sets of 120 CPE hours, and CISA holders must also follow ISACA's IS auditing standards.

Our view

If you're building an audit career, take CISA and treat CISSP as optional. CISA is the established IT audit credential, and CISSP's architecture and cryptography depth won't come up much in fieldwork. If you're a security engineer who sometimes faces auditors, CISSP is the better use of $749, and CISA only pays off when you move into assurance work for good. The pair makes most sense for someone who leads security reviews of other teams, where knowing how an auditor will test a control and how an engineer would build it are both part of the job. We'd also look at CISM vs CISA if management rather than engineering is the other half of your work.

Sources