Training Verdict

Which ISACA certification first: CISA for audit, CISM for security management or CRISC for risk

By Alexander Shick · Updated November 5, 2026

All three are a single 150-question exam that you can pass before you have the experience. You then have five years to apply, with a US$50 processing fee. CISA and CISM ask for five years of relevant work within the ten years before you apply, CRISC for three, and ISACA lists no experience waivers for any of them. You book through ISACA and sit with PSI, at a test center or online, within six months of registering.

CISA, CISM and CRISC on one page

ISACA certifications on this site, US exam fees and maintenance terms from ISACA's pages, checked November 5, 2026. ISACA does not use exam codes.
CertificationFocusExamUS exam feeFormal prerequisiteKeeping it
CISAIS audit150 questions, five weighted areas$760; $575 for members; plus $50 to applyTo sit, no. To certify, 5 years of IS audit, control or security work within the 10 years before applying$85 a year ($45 for members), 20 CPE hours a year and 120 per 3-year cycle
CISMSecurity management150 questions, four areas; updated exam from November 3, 2026$760; $575 for members; plus $50 to applyTo sit, no. To certify, 5 years of security management across 3 of the 4 domains within the 10 years before applying$85 a year ($45 for members), 20 CPE hours a year and 120 per 3-year cycle
CRISCIT risk150 questions in 4 hours, four domains; pass mark 450 on a 200 to 800 scale$760; $575 for members; plus $50 to applyTo sit, no. To certify, 3 years in both risk assessment and risk response (for passes after November 2025)$85 a year ($45 for members), 20 CPE hours a year and 120 per 3-year cycle

CRISC's rule is the one to check. ISACA's support article of September 22, 2026 sets three years in both risk assessment and risk response for anyone who passed after November 2025, while its get-certified page still shows the older wording of three years across two of four domains. If your risk work sits mainly in governance or technology, confirm with ISACA which rule covers your pass date.

Reaching ISACA from three starting points

ISACA for newcomers: not yet

None of these three is a first credential. Start with ISC2 CC or Security+, and come back once your work involves audit, risk or managing security.

ISACA from IT operations toward control work

You can sit an ISACA exam now and certify later. If you maintain a risk register or decide how risks are treated, CRISC has the shortest experience rule. If you spend much of your time with auditors or testing controls, CISA fits, with five years of audit, control or security work to build.

ISACA for experienced audit, security and risk staff

Auditors: CISA. People running a security program or team: CISM, and see CISA vs CISM and CISM vs CISSP. Risk owners: CRISC. ISACA counts continuing education hours that fit more than one of its certifications toward each.

ISACA rule and exam changes, 2025 to 2027

ISACA membership arithmetic

Professional membership costs US$145 a year, and most chapters add dues. Members save $185 on the exam, $30 on the review manual and $100 on the question bank, $315 together, so buying all three as a member comes out ahead unless chapter dues pass $170. The lower maintenance fee ($45 rather than $85) applies only after you certify.

What ISACA offers free, and what it charges for

ISACA's free material on our pages is thin: a 10-question CRISC practice quiz, plus online study groups for members. The core study products are paid: the review manuals, the question banks, which are the purchase our three pages recommend first (about $1,159 with the non-member exam), and an online review course for CRISC. For a live class, Risk Tide lists a four-day boot camp for each of the three at a $2,499 sale price with the exam included, and Learning Tree a class with the voucher at $3,850.

Next step

Ask whether your experience fits CISA, CISM or CRISC

Sources

Prices are published list prices we recorded on the dates shown, not quotes. How we research.