ISACA CPE Requirements Explained: Keeping CISA and CISM Active
Passing the exam and certifying is not the end. ISACA certifications stay active only if you meet continuing professional education (CPE) requirements and pay an annual maintenance fee.
The requirements
- Earn and report at least 20 CPE hours every calendar year, starting the year after you are certified.
- Earn and report at least 120 CPE hours over each rolling three-year cycle.
- Pay the annual maintenance fee.
- Comply with ISACA's Code of Professional Ethics.
Failing to meet the requirements can lead to revocation of the certification.
Annual versus cycle requirement
The annual minimum stops you from leaving everything to the end. The three-year total means you need to average 40 hours a year, so 20 a year is not enough on its own.
What usually counts
ISACA's CPE policy describes qualifying activities. Commonly accepted categories include:
- Professional education: training courses, conferences, webinars.
- ISACA chapter meetings and events.
- Self-study courses with assessments.
- Teaching, presenting and writing on relevant topics.
- Contributions to the profession, such as exam item writing or volunteering.
Activities must relate to the certification's job practice. Check the current policy for limits on certain categories and for documentation rules.
Keep evidence
ISACA audits a sample of holders each year. Keep certificates of attendance and records of each activity for the period the policy requires.
Practical tips
- Log hours as soon as you earn them.
- Choose learning that also advances your career: cloud, AI governance, privacy, resilience.
- Holders of more than one ISACA certification can often count the same activity toward each, where relevant — check the policy.
Related on Auditor Path
Sources
ISACA CPE Policy; ISACA "Maintain CISA" and "Maintain CISM" pages.