CISA Exam Mindset Rules
Target audience: Security auditors, GRC engineers, compliance assessors, and engineers preparing systems for SOC 2, ISO 27001, or FedRAMP assessments.
- Auditor independence and objective evidence are paramount: An auditor cannot audit a system they designed, implemented, or currently operate. Observed system records and re-performance beat verbal assurances or policy documents.
- Verify separation of duties and compensating controls: Whenever a small team cannot separate conflicting duties (e.g., dev and prod deploy), look for independent audit log review and automated gating as compensating controls.
- Auditors report and recommend; management remediates: An IS auditor never modifies production configurations, rewrites policies, or accepts risk on behalf of the auditee. Doing so compromises auditor independence for future assessments.
DOMAIN 1 · 18% OF EXAM
Domain 1: Information Systems Auditing Process
Audit charter, independence, risk-based audit planning, sampling, evidence sufficiency/reliability, SOC 1/2/3 reports, and communicating audit findings.
Drill Domain 1 practice questions ↗
Objectives & Mapped Field Lessons
Objective 1.1: Plan and execute risk-based audits and evaluate objective evidence
Domain 1 Rapid-Review Cheat Sheet
DOMAIN 2 · 18% OF EXAM
Domain 2: Governance and Management of IT
IT governance, policy hierarchy, risk management, regulatory compliance, and personnel controls.
Drill Domain 2 practice questions ↗
Objectives & Mapped Field Lessons
Objective 2.1: Evaluate governance cadence, risk registers, policy exceptions, and regulatory boundaries
- Security governance and the policy hierarchy (R5 · 9 min)
- Governance as an operating cadence: NIST CSF 2.0 Govern in practice (R3 · 11 min)
- Write the risk sentence: cause, asset, and business impact (R1 · 9 min)
- Quantitative risk and BIA math: SLE, ALE, RTO, and RPO (R6 · 11 min)
- Law, ethics, and personnel security (R4 · 10 min)
Domain 2 Rapid-Review Cheat Sheet
DOMAIN 3 · 12% OF EXAM
Domain 3: Information Systems Acquisition, Development, and Implementation
SDLC controls, build vs. promote separation, database integrity, SAST/DAST/code coverage, and supply chain.
Drill Domain 3 practice questions ↗
Objectives & Mapped Field Lessons
Objective 3.1: Audit SDLC gates, CI/CD promotion boundaries, test coverage, and database integrity
- CI/CD trust boundaries: writing code vs promoting to production (A3 · 9 min)
- Software assurance: SDLC models, database integrity, and classic application attacks (A5 · 15 min)
- Software testing: SAST, DAST, IAST, SCA, fuzzing, and coverage math (AT3 · 10 min)
- SBOM evidence and priority: binding inventory to the running build (A4 · 7 min)
- Agentic SDLC security: coding assistants, autonomous PRs, and build gates (A3a · 8 min)
Domain 3 Rapid-Review Cheat Sheet
DOMAIN 4 · 26% OF EXAM
Domain 4: Information Systems Operations and Business Resilience
IT operations, incident management, forensics, BIA (RTO/RPO), backup strategies, RAID, DR sites, and DR testing.
Drill Domain 4 practice questions ↗
Objectives & Mapped Field Lessons
Objective 4.1: Evaluate incident response, forensic chain of custody, backups, RAID, and DR readiness
- Continuity operations: recovery sites, backup strategies, RAID, and DR testing (S6 · 14 min)
- Digital forensics: order of volatility, chain of custody, and legal evidence (S5 · 10 min)
- Data protection and resilience: why encryption is not a backup plan (F6 · 8 min)
- Investigate, respond, and verify: why HTTP 200 or 504 is not containment proof (S3 · 10 min)
Domain 4 Rapid-Review Cheat Sheet
DOMAIN 5 · 26% OF EXAM
Domain 5: Protection of Information Assets
IAM, access control models, federation, network security, encryption/PKI, physical/environmental controls, and data sanitization.
Drill Domain 5 practice questions ↗
Objectives & Mapped Field Lessons
Objective 5.1: Audit logical access, cryptography, network segmentation, physical controls, and media sanitization
- Identity, authentication, authorization, and recovery (F4 · 9 min)
- Access control models: DAC, MAC, RBAC, ABAC, and Rule-Based controls (IF5 · 10 min)
- Hashing, HMAC, digital signatures, and PKI lifecycle (AR4 · 11 min)
- Network segmentation, firewall generations, SASE, and NAC (N2 · 10 min)
- Environmental controls: HVAC, power anomalies, and fire suppression (AR6 · 10 min)
- Data remanence, retention, and NIST SP 800-88 sanitization (D2b · 10 min)