Certified Information Systems Auditor (CISA)

Module 1: Domain 1 – Information System Auditing Process

Learning Objectives:

1. Strategize and plan information system audits to assess protection, control, and value delivery.
2. Execute audits in line with IS audit standards and a risk-based IS audit strategy.
3. Effectively communicate audit progress, findings, and recommendations to stakeholders.
4. Conduct post-audit follow-up to ensure risk mitigation.
5. Assess IT management and control monitoring.
6. Utilize data analytics tools to enhance audit efficiency.
7. Provide consulting services to enhance information system quality and control.
8. Identify opportunities for improving IT policies and practices.

Topics:

1. IS Audit Standards, Guidelines, Functions, and Codes of Ethics
2. Types of Audits, Assessments, and Reviews
3. Risk-based Audit Planning
4. Types of Controls and Considerations
5. Audit Project Management
6. Audit Testing and Sampling Methodology
7. Audit Evidence Collection Techniques
8. Audit Data Analytics
9. Reporting and Communication Techniques
10. Quality Assurance and Improvement of Audit Process

Module 2: Domain 2 – Governance and Management of IT

Learning Objectives:

1. Evaluate IT strategy alignment with enterprise strategies and objectives.
2. Assess IT governance and organizational structure effectiveness.
3. Review IT policies and practices for compliance with regulatory requirements.
4. Evaluate IT resource and portfolio management alignment with enterprise strategies.
5. Assess enterprise risk management policies and practices.
6. Evaluate IT management and monitoring of controls.
7. Review monitoring and reporting of IT key performance indicators.
8. Assess IT supplier selection and contract management processes.
9. Evaluate IT service management practices alignment with business requirements.
10. Conduct periodic reviews of information systems and enterprise architecture.
11. Evaluate data governance policies and practices.
12. Assess information security program effectiveness and alignment with enterprise strategies.

Topics:

1. Laws, Regulations, and Industry Standards
2. Organizational Structure, IT Governance, and IT Strategy
3. IT Policies, Standards, Procedures, and Guidelines
4. Enterprise Architecture and Considerations
5. Enterprise Risk Management (ERM)
6. Privacy Program and Principles
7. Data Governance and Classification
8. IT Resource Management
9. IT Vendor Management
10. IT Performance Monitoring and Reporting
11. Quality Assurance and Quality Management of IT

Module 3: Domain 3 – Information Systems Acquisition, Development, and Implementation

Learning Objectives:

1. Evaluate the business case for proposed changes to information systems.
2. Assess enterprise project management policies and practices.
3. Evaluate controls throughout the information systems development lifecycle.
4. Assess information systems readiness for implementation and migration into production.
5. Conduct post-implementation reviews of systems.
6. Evaluate change, configuration, release, and patch management policies and practices.

Topics:

1. Project Governance and Management
2. Business Case and Feasibility Analysis
3. System Development Methodologies
4. Control Identification and Design
5. System Readiness and Implementation Testing
6. Implementation Configuration and Release Management
7. System Migration, Infrastructure Deployment, and Data Conversion
8. Post-implementation Review

Module 4: Domain 4 – Information Systems Operations and Business Resilience

Learning Objectives:

1. Evaluate the enterprise’s ability to continue business operations.
2. Assess IT service management practices alignment with business requirements.
3. Conduct periodic reviews of information systems and enterprise architecture.
4. Evaluate IT operations and maintenance practices.
5. Evaluate database management practices.
6. Assess data governance policies and practices.
7. Evaluate problem and incident management policies and practices.
8. Evaluate change, configuration, release, and patch management policies and practices.

Topics:

1. IT Components
2. IT Asset Management
3. Job Scheduling and Production Process Automation
4. System Interfaces
5. End-user Computing and Shadow IT
6. Systems Availability and Capacity Management
7. Problem and Incident Management
8. IT Change, Configuration, and Patch Management
9. Operational Log Management
10. IT Service Level Management
11. Database Management
12. Business Impact Analysis
13. System and Operational Resilience
14. Data Backup, Storage, and Restoration
15. Business Continuity Plan
16. Disaster Recovery Plans

Module 5: Domain 5 – Protection of Information Assets

Learning Objectives:

1. Conduct audits in line with IS audit standards and a risk-based IS audit strategy.
2. Evaluate problem and incident management policies and practices.
3. Assess information security and privacy policies and practices.
4. Evaluate physical and environmental controls for safeguarding information assets.
5. Evaluate logical security controls for ensuring information confidentiality, integrity, and availability.
6. Review data classification practices for alignment with policies and external requirements.
7. Evaluate policies and practices related to asset lifecycle management.
8. Assess the information security program effectiveness and alignment with enterprise strategies.
9. Perform technical security testing to identify potential threats and vulnerabilities.

Topics:

1. Information Asset Security Policies, Frameworks, Standards, and Guidelines
2. Physical and Environmental Controls
3. Identity and Access Management
4. Network and End-Point Security
5. Data Loss Prevention
6. Data Encryption
7. Public Key Infrastructure (PKI)
8. Cloud and Virtualized Environments
9. Mobile, Wireless, and Internet-of-Things Devices
10. Security Awareness Training and Programs
11. Information System Attack Methods and Techniques
12. Security Testing Tools and Techniques
13. Security Monitoring Logs, Tools, and Techniques
14. Security Incident Response Management
15. Evidence Collection and Forensics