Passed CISA or CISM? How to Apply for Certification
Congratulations on passing. You cannot call yourself CISA or CISM certified until ISACA approves your certification application.
What certification requires
- Pass the exam.
- Submit an application with verified work experience.
- Agree to the Code of Professional Ethics and the CPE policy.
- Pay the application processing fee.
The experience rules
- Both credentials require five years of relevant work experience.
- For CISM, ISACA states the experience must be information security management work within the CISM job practice areas, gained within the 10 years before you apply, and you must apply within five years of passing.
- CISA has its own definition of qualifying experience in IS audit, control, assurance and security. Check ISACA's current requirements for the details and any substitutions.
Getting experience verified
Each period of experience must be verified by someone who supervised you or can attest to your work. To avoid delays:
- Tell your verifiers in advance and confirm their contact details.
- Describe your work in terms of the job practice domains.
- Make sure dates and job titles match your records.
Common reasons for delays
- Verifiers who do not respond.
- Experience descriptions that do not map to the job practice.
- Experience outside the allowed time window.
While you wait
Start logging CPE hours: the annual requirement begins the year after you are certified, but learning now still benefits you.
Related on Auditor Path
Sources
ISACA "Earn a CISM Certification" and CISA certification pages; ISACA application instructions.