CISA cheat sheet — every exam topic on one page

Information Systems Auditing Process

CISA Audit Planning: Standards, Ethics, Risk-Based Planning and Controls

• The audit charter sets the internal audit function's authority and access and is approved by the board or audit committee; an engagement letter sets the terms of one engagement.
• ITAF standards are mandatory; departing from a guideline is allowed if you can justify it and still meet the standard.
• Audit criteria must be suitable: currently in force, independent of the subject being audited and grounded in the organization's own requirements or a recognized standard.
• Report suspected irregularities to a level above those involved; if senior management is implicated, go to the audit committee.
• Disclose any independence impairment before the work starts; auditors recommend controls, management implements them.
• A risk-based plan starts with a risk assessment of the audit universe, covers whether systems provide value as well as whether they are protected and controlled, and is revised with committee approval when risk changes.
• Auditors set scope on risk; any exclusion is judged on the risk it leaves, documented, and reported as a scope limitation where it limits the conclusion.
• High inherent or control risk means lower acceptable detection risk and more substantive testing.
• IS materiality depends on what relies on the control and on cumulative effect, not on the system's cost.
• Prefer preventive controls; test a compensating control's design and operation before relying on it, and rely on automated controls only when IT general controls are effective.

CISA Audit Execution: Sampling, Evidence, Data Analytics, Reporting and Follow-up

• Scope changes and delays go to audit management (and the sponsor) to be assessed and approved; never extend scope or cut procedures silently.
• A failed key control means no reliance: expand substantive testing. An effective control lets the auditor reduce substantive testing in the area it covers.
• Attribute sampling estimates a rate, variable sampling a value; discovery sampling finds a rare event, and stop-or-go keeps a sample minimal when errors are rare.
• Sample size rises with confidence and expected error, falls as tolerable error rises, and barely moves with population size once the population is large.
• Overreliance (accepting an ineffective control) threatens effectiveness and is the greater concern. Non-sampling risk is reduced by supervision and guidance, not by bigger samples.
• Evidence is most reliable when it is independent, obtained directly by the auditor, documentary and covers the period; reperformance is the strongest test of operation.
• Reconcile extracted data to the source and run CAATs under auditor control with read-only access. Full-population tests remove sampling risk only, and only for what the logic checks.
• Try alternative procedures before declaring a scope limitation; report an unresolved limitation to the audit committee and in the report.
• Fraud indicators go promptly to management above those involved; the auditor does not confront, investigate alone or act as management.
• Supported findings are reported despite disagreement, corrected issues are reported with the corrective action, and follow-up tests evidence and checks that any risk acceptance was made by someone with authority.

Governance and Management of IT

CISA IT Governance: Strategy, Committees, Policies and Enterprise Architecture

• Governance (the board) sets direction and risk appetite and monitors value and risk; management plans, builds and runs IT within that direction.
• Board reporting must show value realized and risk against appetite rather than operational service metrics, and it must reach the board itself.
• IT strategy committee: board level, advises on direction and value. IT steering committee: executive level, business-represented, prioritizes and monitors projects.
• The best evidence of IT–business alignment is each major initiative traced to a business objective with a business sponsor.
• Never combine development with production migration; when duties cannot be split, add independent review of activity logs as a compensating control.
• Fix reporting-line bias with business-wide prioritization and an independent security reporting line, never by moving security under internal audit.
• Policies state intent and need senior approval; standards hold specific mandatory values; procedures give steps; guidelines are optional. Effectiveness is proven by tested practice.
• Deviations need documented exceptions accepted by the accountable owner, with compensating controls and an expiry or re-review date.
• Identify legal and contractual requirements first (with legal counsel), then turn them into policies and controls; ISO certification is not proof of legal compliance, and PCI DSS binds by contract.
• Enterprise architecture needs a target state and roadmap; make architecture review a gate before acquisitions, and govern new technology by assessing risk, setting policy and naming an accountable owner.

CISA Enterprise Risk Management, Privacy and Data Governance

• A board-approved risk appetite is the reference point for every risk decision; without it, no acceptance or priority can be judged.
• IT risk must be rated on the enterprise's common criteria so it can be aggregated and prioritized with every other risk.
• Risk owners are accountable business managers; IT and control owners operate controls but do not own business risk.
• Risk above appetite must be escalated to the level the delegation scheme reserves for it, typically the board or its risk committee, and related acceptances must be aggregated.
• Compare appetite with residual risk under controls that actually operate; a control not working as assumed understates the residual rating.
• ALE = asset value × exposure factor × ARO; a control is justified when the ALE it removes exceeds its annual cost.
• Insurance transfers financial loss only; avoidance (stopping the activity) is often the best response when the activity is worth less than its risk.
• Privacy governs proper use of personal data; test actual processing against purposes and consents for the best evidence it works.
• Do a privacy impact assessment before high-risk processing is built and update it when processing changes; confirm a cross-border transfer is lawful before assessing the provider.
• Data owners classify and approve access before it is granted; inventory and owners come before enforcement, and handling rules must meet the strictest applicable requirement.

CISA IT Management: Resources, Vendors, KPIs and Quality

• Alignment of IT investment is best evidenced by an enterprise-wide portfolio process that ranks every proposal on its business case and strategic fit; benefits realization checks the promised value after go-live.
• Mandatory leave with someone else doing the duties detects fraud; prompt access removal at termination is the main personnel access risk; a practised second person removes key-person dependency.
• Outsourcing transfers the work, never the accountability; a contractual duty the organization cannot verify is not a control.
• Vendor evaluation criteria are fixed before proposals are opened, due diligence is matched to the risk, and the procurement process itself should prevent signature before review.
• A right-to-audit clause is the only term that allows direct verification; for multi-tenant SaaS, exit terms for the organization's data matter more than source code escrow.
• SOC 2 Type II tests operating effectiveness over a period, Type I covers design at a point in time and SOC 3 is a general-use summary; a bridge letter covers a time gap, not a control gap.
• The client must operate its complementary user entity controls to rely on a report, and a carve-out leaves subservice controls untested, so assurance must come from elsewhere.
• Provider-produced SLA reports are checked against the organization's own records; service credits compensate for shortfalls but do not correct them.
• KPIs measure achieved performance; KRIs warn early of rising exposure and need thresholds, owners and required responses.
• QA reviews the process and must be independent of what it reviews; QC tests the product. Maturity improvement starts with a baseline and sets per-process targets by business value and risk.

Information Systems Acquisition, Development and Implementation

CISA Systems Acquisition and Development: Project Governance, Business Cases, SDLC Methods and Control Design

• The sponsor owns the business case, funding, benefits and acceptance; a business-led steering committee directs; the project manager delivers.
• The IS auditor advises early and reviews at gates, but never designs, approves or owns the controls they will later audit.
• Every scope change needs a request, an impact assessment covering cost, schedule and benefits, and approval at the right level before it is built.
• Progress is the earned value of completed work, not budget or hours consumed; a slip on the critical path moves the end date, a slip within float does not.
• A business case needs alternatives (including doing nothing), whole-life costs and measurable benefits with an owner, and is revalidated when costs, scope or benefits change materially.
• Sunk costs never justify continuing; compare remaining costs with the benefits still achievable.
• Compare options on total cost of ownership and NPV; payback shows how fast money returns, not how much value is created.
• Feasibility is technical, economic, operational, schedule and legal; skipping operational feasibility risks a system the business never adopts.
• Pick the methodology that fits requirement stability, delivery timing and sign-off needs; in agile, controls live in acceptance criteria and the definition of done.
• Controls are cheapest at requirements and design: put them in the RFP when buying, trace every requirement to design and test, and prefer preventive designs such as segregated roles.

CISA Information Systems Implementation: Testing, Release, Changeover, Data Conversion and Post-implementation Review

• Test levels run unit → integration → system → acceptance, and each should be stable before the next begins.
• Load testing works at the expected peak, stress testing goes beyond it to the breaking point, volume testing uses large data quantities, recovery testing checks restart.
• Regression testing reruns previously passed tests with the same data after a change; impact analysis selects them when the full suite cannot fit.
• Approval for production rests on user acceptance testing designed from business criteria and signed off by the business owner, not on vendor or IT testing.
• Mask or substitute sensitive production data before it reaches test, using substitutes that keep the format and validity the tests need.
• Open defects at go-live are acceptable only when the accountable owner formally accepts the risk with compensating controls; the auditor ensures this, not decides it.
• Certification is the technical security evaluation; accreditation is senior management's authorization to operate and acceptance of residual risk.
• An independent group promotes approved, baselined releases from a controlled library, and a hash check proves the deployed build is the accepted one.
• Parallel changeover is lowest risk and highest effort; direct cutover is highest risk and needs go/no-go criteria and a rehearsed fallback.
• Counts and totals prove conversion completeness; only record-level reconciliation catches swapped values; the business data owner signs off; a PIR waits until results are measurable.

Information Systems Operations and Business Resilience

CISA IT Operations: Components, Asset Management, Job Scheduling, Interfaces and End-User Computing

• An accurate asset inventory comes first; every asset needs an owner accountable for its protection and retirement.
• Completeness is tested from discovered devices to the register; existence from the register to the device. A fixed-asset ledger omits expensed devices.
• License compliance compares usage with entitlements on the licensed metric: installations, named users or peak concurrent use.
• Anything leaving with storage is a disposal: purge SSDs with sanitize or cryptographic erase, retain failed warranty drives, and reconcile per-serial certificates.
• Schedulers reduce operator error but shift risk to job definitions; link dependent jobs by condition and derive parameters from the calendar.
• Sample schedule changes from the scheduler's audit log to approvals; ad hoc jobs need approval before they run; emergency access needs a review independent of development.
• Record counts prove records arrived; control totals prove values survived; rejected records need a suspense queue, not an overwritten error file.
• Rank EUC by output impact and logic complexity; the strongest compensating control reconciles results to source data; shadow IT is found through expense and proxy or CASB data and governed by risk assessment, not blanket bans.

CISA IT Service Operations: Availability, Incident, Problem, Change, Patch, Log, Service Level and Database Management

• Capacity management plans for peaks and forecast business demand; annual averages and historical trends alone hide the risk.
• Availability = MTBF / (MTBF + MTTR): improve whichever factor is weak; redundancy raises service availability by masking component failures.
• Incident management restores service fast; problem management removes causes, keeps known errors open until a permanent fix and is measured by fewer repeat incidents.
• Prioritize incidents by impact and urgency, escalate functionally and hierarchically by defined rules, and close only on confirmed resolution.
• Emergency changes are acceptable when approved after the fact within a defined period; recurring emergency changes to the same component signal bypassed change control.
• Only an independent group should update production; emergency IDs need full logging and independent review after each use.
• To find unauthorized changes, start from production and trace back to approved records; to test recorded changes, sample the tickets.
• Patch deadlines should follow severity and exposure; unpatchable systems need isolation, monitoring, a risk-owner-approved time-limited exception and a retirement plan.
• Trustworthy logs are centrally protected from the people logged, time-synchronized, detailed enough for their purpose, retained per legal needs and reviewed independently.
• SLAs need supporting OLAs and underpinning contracts, end-to-end user metrics and validation against the organization's own data; DBAs need named accounts, data-owner authorization and independent review.

CISA Business Resilience: BIA, Backup and Restoration, Business Continuity and Disaster Recovery Plans

• The BIA ranks processes by the impact of their loss over time; business owners validate it, and it comes before any recovery strategy.
• RPO limits data loss and drives backup frequency and copy location; RTO limits restore time and must not exceed the maximum tolerable downtime.
• An RPO is met for a scenario only if a recent enough copy survives that scenario, so local backups do not cover loss of the site.
• Size each recovery strategy where the combined cost of disruption and recovery is lowest; a cold site or reciprocal agreement is only as reliable as the equipment and capacity behind it.
• RAID, clustering and replication provide availability; only point-in-time backups kept elsewhere recover from deletion, corruption, ransomware or site loss.
• Differential restores need the full plus one set; incremental restores need the full plus every incremental since.
• Keep at least one backup copy off-site at a safe distance and one offline or immutable, and keep encryption keys recoverable away from the primary site.
• A validated restore to a test environment is the best evidence that backups work; job-success logs are not.
• Plans put life safety first, define who may declare a disaster and when, and restore critical systems together with their dependencies.
• Test from checklist and walk-through up to parallel and full interruption; judge tests on realistic conditions, documented procedures and tracked remediation.

Protection of Information Assets

CISA Information Asset Security: Frameworks, Physical and Environmental Controls, Identity and Access, Network Security and DLP

• Policies set direction, standards make it mandatory and measurable, procedures give the steps and guidelines are optional advice; deviations need a formal, risk-accepted, time-limited exception.
• Only ISO/IEC 27001 is a certifiable ISMS requirements standard; 27002 is control guidance, and NIST CSF and COBIT offer no ISMS certification.
• The data owner classifies data and authorizes access; custodians and security administrators implement; the IS auditor never approves access.
• Mantraps prevent tailgating, visitors in a data center are escorted throughout, and a finding of access that should no longer exist is rated by first checking whether it was used.
• Pre-action sprinklers minimize accidental water discharge, clean agents leave no residue, CO2 needs an alarm and delay, and life safety always outranks equipment.
• A UPS bridges short disturbances until the generator takes over, and a generator that has never carried full load leaves the power design unproven.
• HR events should drive joiner, mover and leaver changes; contractors outside HR are the usual gap, and leaver tests sample from the complete HR population.
• Recertification by business owners works only when reports are understandable; re-perform a sample when approvals look rubber-stamped.
• MFA needs different factor types, SSO concentrates risk in the identity provider, and privileged access needs named accounts, tamper-proof logs and independent review.
• Use screened subnets, segmentation and default-deny rule bases; a WAF stops application-layer attacks; NAC adds posture checks; test coverage and enforcement directly; and build DLP by classifying data first, then tuning before blocking.

CISA Encryption, PKI, Cloud, Virtualization, Mobile and IoT Security

• Use symmetric ciphers for bulk data and public key methods to deliver the symmetric key; encrypt to the recipient's public key for confidentiality and sign with the sender's private key for nonrepudiation.
• A hash detects change only if its reference copy is protected; a MAC adds a shared key; only a digital signature, with a key one party alone holds, gives nonrepudiation.
• Key management is where encryption fails: keys stored beside the data, or one person holding both data and key access, defeat any algorithm.
• Escrow encryption keys so data stays recoverable, but never keep copies of signing private keys.
• TLS protects only the session; TDE does not stop DBAs; full-disk encryption with pre-boot authentication protects lost devices; destroying customer-controlled keys is the strongest cloud sanitization evidence.
• Rely on a CA through its practice statement and audits; keep the root offline; revoke first when a private key is compromised; online status checks close the CRL freshness gap.
• Cloud responsibility for operating controls follows the service model, but accountability for the data stays with its owner; test CUECs yourself and get separate assurance for carved-out subservice organizations.
• Hypervisor console compromise has the widest impact; traffic between guests on the same virtual switch is invisible to physical-network IDS; production snapshots need the protection of the data inside them.
• MDM with containers, selective wipe and continuous compliance protects mobile data; test coverage from the population that actually connects.
• Use 802.1X with server certificate validation, isolate guest traffic and hunt rogue access points; for IoT, inventory first, remove default credentials and segment what cannot be patched.

CISA Security Event Management: Awareness, Attacks, Testing, Monitoring, Incident Response and Forensics

• Judge awareness programs by behaviour (trended phishing click and report rates with varied lures), not completion or quiz scores; train everyone, contractors included, before access
• Social engineering is stopped by out-of-band verification using contact details already on record, and push fatigue by number matching or phishing-resistant MFA
• Root-cause fixes: parameterized queries for SQL injection, output encoding for XSS, session-bound anti-forgery tokens for CSRF
• Volumetric DDoS must be filtered upstream; ransomware with data theft is also a breach that needs a notification assessment
• Scans list potential weaknesses (credentialed scans see more, false positives must be verified); penetration tests show exploitability but never prove absence
• Penetration tests need written authorization, scope and rules of engagement first; double-blind tests the response team, targeted tests are efficient, internal tests show lateral movement
• A SIEM is only as good as its log sources, synchronized clocks and tuned, risk-ranked alerts; run a new IPS in detect-only mode and tune before blocking
• Incident response: contain first, preserve evidence before rebuilding; an auditor who finds an intrusion escalates to management rather than acting
• Severity criteria must include data sensitivity, and notification decisions run during the investigation; track MTTD/MTTC and lessons-learned actions to closure
• Forensics: unbroken chain of custody, most volatile first, bit-stream image through a write blocker, hash original and image, analyse copies only, legal hold to stop deletion