ExamFinch.com My Study

Cheat sheet

CISA Cheat Sheet

Practice this exam

IS Auditing Process

  • 18% of exam
  • Standards Risk-Based Planning Sampling Evidence Reporting

Governance + Management

  • 18% of exam
  • IT Strategy Policies ERM Privacy Vendor Risk

Acquisition + Implementation

  • 12% of exam
  • Business Case SDLC Control Design Testing Migration

Operations + Resilience

  • 26% of exam
  • ITSM Change Logs BIA DRP

Asset Protection

  • 26% of exam
  • IAM Network Security Encryption Cloud Incident Response

Quick Facts

  • Exam CISA
  • Credential Certified Information Systems Auditor
  • Questions 150 MCQ
  • Time 4 hours
  • Pass 450/800 scaled
  • Domains 5
  • Owner ISACA
  • Delivery PSI test or remote
  • Experience 5 years

Finding Formula AU

  • Criteria, condition, cause, effect, recommendation
  • What should be What exists Why So what

Audit vs Assessment AU

Audit

  • Independent assurance
  • Formal opinion
  • Evidence driven

Assessment

  • Control review
  • Less formal
  • Improvement focused
  • Assurance vs review

Evidence Picker AU

  • Need population coverage → CAATs ( Full data )
  • Need control proof → Reperformance ( Direct evidence )
  • Need process behavior → Observation ( Live control )
  • Need owner context → Inquiry ( Weak alone )
  • Need defect estimate → Sampling ( Confidence based )

Audit Planning AU

  • Charter Authority and scope
  • Audit universe Auditable entity list
  • Risk-based plan Focus high risk
  • Materiality Decision impact threshold
  • Scope Audit boundary
  • Engagement letter Formal audit notice

Audit Execution AU

  • Evidence Sufficient and appropriate
  • Sampling Population testing subset
  • CAATs Automated audit testing
  • Observation Watch control operation
  • Inquiry Ask process owners
  • Reperformance Independently repeat control

Reporting + Follow-Up AU

  • Finding Condition vs criteria
  • Cause Why gap exists
  • Effect Business impact
  • Recommendation Risk-focused action
  • Management response Owner commitment
  • Follow-up Verify remediation

Risk Chain GO

  • Asset plus threat plus weakness equals risk
  • Owner accepts Controls reduce Residual remains

Inherent vs Residual GO

Inherent

  • Before controls
  • Natural exposure
  • Baseline risk

Residual

  • After controls
  • Accepted by owner
  • Remaining exposure
  • Before vs after

Governance Picker GO

  • Set risk appetite → Board ( Oversight )
  • Execute strategy → Management ( Accountable )
  • Measure risk trend → KRI ( Early warning )
  • Measure service value → KPI ( Performance )
  • Outsource critical service → SLA ( Monitor vendor )

IT Governance GO

  • Board Strategic oversight
  • Executive management Owns execution
  • IT strategy Business alignment
  • Policy Management direction
  • Standard Mandatory requirement
  • Procedure Step-by-step method

Policy vs Procedure GO

Policy

  • Management direction
  • High level
  • Mandatory intent

Procedure

  • Detailed steps
  • Operational method
  • Repeatable work
  • What vs how

Risk + Data GO

  • ERM Enterprise risk program
  • Risk appetite Accepted risk level
  • KRI Risk trend signal
  • KPI Performance measure
  • Data owner Classifies data
  • Privacy Personal data rules

Vendor Management GO

  • Due diligence Assess before selection
  • SLA Service commitments
  • Right to audit Verification clause
  • Exit plan Orderly transition
  • Fourth party Vendor's vendor
  • SOC report Control assurance

Project Controls AC

  • Business case, requirements, testing, signoff
  • Value first Trace requirements Users accept

UAT vs System Test AC

UAT

  • Business users
  • Requirements fit
  • Acceptance decision

System test

  • Technical testers
  • Integrated behavior
  • Defect discovery
  • Business vs technical

Implementation Picker AC

  • Need business signoff → UAT ( User acceptance )
  • Need low-risk rollout → Pilot ( Limited users )
  • Need immediate switch → Big bang ( High risk )
  • Need data integrity → Reconciliation ( Counts/checksums )
  • Need benefits check → PIR ( After go-live )

Project Governance AC

  • Business case Value justification
  • Feasibility Can succeed
  • Sponsor Business owner
  • Steering committee Project oversight
  • Requirements Business needs
  • Traceability Requirement test linkage

SDLC Controls AC

  • SDLC Controlled system lifecycle
  • Agile Iterative delivery
  • DevSecOps Security integrated pipeline
  • Segregation Dev/test/prod separation
  • Code review Peer inspection
  • Change control Approved modification

Implementation AC

  • UAT Business acceptance test
  • Parallel Old and new
  • Pilot Limited rollout
  • Phased Incremental rollout
  • Big bang Single cutover
  • PIR Benefits and lessons

Resilience Order OP

  • BIA sets RTO and RPO
  • BCP keeps business DRP restores IT Backups support RPO

Incident vs Problem OP

Incident

  • Restore service
  • Immediate disruption
  • Workaround acceptable

Problem

  • Find root cause
  • Prevent recurrence
  • Known error path
  • Restore vs prevent

Resilience Picker OP

  • Prioritize processes → BIA ( Impact first )
  • Maintain business → BCP ( People/process )
  • Recover systems → DRP ( Technology )
  • Set downtime limit → RTO ( Time target )
  • Set data loss limit → RPO ( Data target )

IT Operations OP

  • IT asset Lifecycle managed resource
  • CMDB Configuration item record
  • Job scheduling Automated batch control
  • Capacity Resource demand planning
  • Availability Service uptime ability
  • Runbook Operational procedure

BCP vs DRP OP

BCP

  • Business survival
  • Process continuity
  • BIA driven

DRP

  • IT recovery
  • Systems restoration
  • RTO/RPO driven
  • Business vs IT

Service Management OP

  • Incident Service interruption
  • Problem Root cause
  • Known error Documented workaround
  • Change Controlled modification
  • Patch Vulnerability fix
  • Log management Event evidence control

Resilience OP

  • BIA Impact prioritization
  • BCP Business continuity plan
  • DRP IT recovery plan
  • RTO Recovery time target
  • RPO Data loss target
  • Backup Recoverable data copy

Security Flow PR

  • Identify, protect, detect, respond, recover
  • Least privilege Monitor logs Preserve evidence

Preventive vs Detective PR

Preventive

  • Stops event
  • Before loss
  • Access control

Detective

  • Finds event
  • After activity
  • Logs and alerts
  • Stop vs find

Security Picker PR

  • Verify identity → MFA ( Stronger auth )
  • Limit access → Least privilege ( Need only )
  • Protect data → Encryption ( Confidentiality )
  • Detect attacks → SIEM ( Correlation )
  • Preserve evidence → Forensics ( Chain custody )

Asset Security PR

  • CIA Security objectives
  • Classification Sensitivity label
  • IAM Identity access control
  • MFA Multiple proof factors
  • Least privilege Minimum needed access
  • DLP Data leakage prevention

Scan vs Pen Test PR

Scan

  • Find weakness
  • Automated breadth
  • Low impact

Pen test

  • Exploit proof
  • Authorized attack
  • Scoped depth
  • Find vs exploit

Technical Security PR

  • Firewall Traffic filtering
  • IDS Detects suspicious activity
  • IPS Blocks suspicious activity
  • Encryption Confidentiality control
  • PKI Certificate trust system
  • Cloud Shared responsibility

Security Events PR

  • Awareness User behavior control
  • Vulnerability scan Weakness discovery
  • Pen test Exploit validation
  • SIEM Security log correlation
  • Incident response Structured event handling
  • Forensics Evidence preservation

Common Traps

Auditor vs manager

  • Auditor recommends ≠ Management owns action

Evidence vs opinion

  • Evidence supports finding ≠ Opinion needs proof

Risk appetite vs tolerance

  • Appetite is target ≠ Tolerance is variation

SLA vs OLA

  • SLA faces customer ≠ OLA is internal

Backup vs continuity

  • Backup restores data ≠ BCP keeps business

UAT vs approval

  • UAT tests fit ≠ Approval authorizes release

Authentication vs authorization

  • Authentication proves identity ≠ Authorization grants access

Encryption vs hashing

  • Encryption hides data ≠ Hash verifies integrity

Last Minute

  • 1. Risk drives audit scope
  • 2. Evidence before conclusions
  • 3. Management owns remediation
  • 4. Board sets risk appetite
  • 5. Owner classifies data
  • 6. Custodian implements controls
  • 7. BIA precedes BCP/DRP
  • 8. RTO equals downtime target
  • 9. RPO equals data loss
  • 10. Least privilege beats convenience
  • 11. Logs need integrity protection
  • 12. UAT confirms business fit

CISA

  • Practice Questions 200 questions Study Guide 34 topics Cheat Sheet 90 facts Flashcards 50 cards Shorts 3 short s Videos 2 videos Blogs 2 blogs Free CE Podcast