Independent certification and training decisions

ISACA certifications: choose audit, security, privacy or governance work

Compare CCOA cybersecurity operations with audit, security management, risk, privacy and governance work, plus the distinct AAIA, AAIR and AAISM AI routes. Those advanced AI exams require active qualifying designations. Preparation, registration and receiving a credential are different decisions—not a mandatory badge sequence.

All certification guides · Official ISACA credential directory

Official directory link checked October 2–5, 2026; CCOA checked October 5. This hub covers published Learnerside guides, not every vendor credential. Exam and training observations retain the separate dates shown in each guide.

Browse ISACA guides ↓

Choose by work, not badge count

Which ISACA route fits your requirement?

Investigate alerts and support incident response

Use CCOA to investigate a specific gap in alert triage, incident analysis or vulnerability handling. Compare explanation, hands-on practice and feedback before buying an exam or a course.

CCOA operations training guide

Evaluate controls and security management

Compare CISA for audit and assurance with CISM for managing information security. Neither is proof of hands-on incident-response readiness or a prerequisite for every other ISACA credential. Check the experience rules and the outline applicable to your exam date.

CISA audit decision guide

Assess technology risk and controls

CRISC addresses governance, risk assessment, response and reporting. Full certification requires three years across at least two domains; exam access is open before that requirement is complete. Passing does not grant authority to accept an organization’s risk.

CRISC risk decision guide

Engineer privacy into systems and data handling

CDPSE focuses on privacy governance, risk, data lifecycle and engineering. Full certification requires three years of relevant work. Start with a synthetic data-flow exercise, not a generic SOC career promise or an assumption of legal authority.

CDPSE privacy decision guide

Support enterprise IT governance

CGEIT is for experienced governance, advisory and oversight work. Its five-year requirement spans at least three domains and includes a year in Domain 1. It is not an entry-level project-coordination credential or permission to approve investments.

CGEIT governance decision guide

Audit evidence about AI

AAIA is for active CISA or specified qualifying audit/accounting holders with an IT audit/advisory focus. Assess evidence quality and assurance limits—not a beginner AI badge.

AAIA audit preparation and decision guide

Integrate AI into the risk program

AAIR accepts a wider named designation list, not CRISC alone. Compare risk appetite, lifecycle and acceptance decisions; conflicting issuer annual fees require confirmation.

AAIR risk preparation and fee uncertainty

Own AI security-management decisions

AAISM requires active CISM or CISSP. Compare security-program accountability, AI risk and controls; registration and a course do not establish performed work.

AAISM security-management decision guide

Test practical readiness with the guide’s tasks and original assessment where available. Recommended experience, formal eligibility and a requirement owner’s approval are different questions. Neither a score nor course completion guarantees passing or employment.

Vendor catalog

ISACA certifications

Browse the ISACA guides available on Learnerside. Filter by subject, experience requirements, dated exam status and cost, renewal model, and official preparation.

9 published guides—not the vendor’s entire credential inventory. Each card carries its own observation dates; these do not verify every guide fact, a current training price or an available seat. Experience requirements and recommendations remain separate; neither predicts a pass rate or job outcome.

More filters: gate, subject, exam status, cost, renewal, and free prep

Renewal filters describe recorded requirements, not a price or guaranteed eligibility. Check the guide and issuer before paying.

Training options, course outlines and total cost

What should you verify before paying for ISACA training?

Match the exact credential, applicable outline, work exercises and required instructor feedback before buying. ISACA’s free quizzes, member-only communities, paid manuals, question databases and courses have different access terms; not every credential has the same products. Confirm an outside provider’s exact entity and credential authorization using the issuer’s directory, then check the actual package, modality, time zone, access and cancellation terms. Authorization does not establish a current seat or identical courseware packages.

Start with the official preparation linked from the credential guide. Free reading or videos do not establish that labs, practice exams or a voucher are included. Pay for structure, feedback, accessibility, a workable schedule or team support when those solve a real constraint.

Use a guide’s training comparison where available; no comparison link means Learnerside has not published one, not that training is unavailable. A dated price is not a quote and a published class is not a confirmed seat. Confirm time zone, modality, per-learner versus cohort price, taxes, voucher, retake, lab and recording access, cancellation and accessibility before purchase. Unknown extras are not zero.

Exam registration, certification application, membership, annual maintenance and continuing education are separate. Holder-specific maintenance reductions and qualifying CPE can change the cost; these cards do not calculate a universal three-year ownership bill. Check the credential-specific policy and ISACA’s certification training-partner directory before interpreting an outside authorization claim.

Roles, skills and salary context

What does the credential show—and what does it not show?

Audit and assurance, security management, technology risk, privacy engineering and enterprise governance are distinct work directions—not one progression into SOC work or a guaranteed salary increase. A course or exam pass does not create the verified experience required for certification.

Where a guide supplies wage context, read the occupation, geography, reporting year and mapping limits. Occupational wages are not the salary of credential holders, a causal certification pay premium or an offer you should expect. If a reviewed role mapping or wage source is missing, the answer remains unknown.

Keep researching, get employer support or ask a short question

You can use these guides without contact. For an employer or team, start with the work outcome, current skills, schedule and delivery preference. An exact budget is not required to ask for help. A request permits Learnerside to reply; provider sharing requires separate consent naming the recipient.

Ask about ISACA training Prepare an employer brief Plan team training