Once you have earned the CISA certification, maintaining it comes down to two ongoing responsibilities: continuing to earn CPE and completing ISACA’s annual certification maintenance requirements. Under the current CISA CPE requirements, you need at least 20 CPE hours each year and at least 120 CPE hours over a three-year certification period.

Your CISA certificate carries an expiration date that reflects your three-year CPE cycle, while annual maintenance requirements still apply every year. As long as you meet the CPE, annual maintenance fee and other requirements, the certification can remain active. Routine renewal does not require you to retake the exam every three years.

From 1 January 2027, ISACA will update its CPE policy. The core requirement of 20 CPE per year and 120 CPE over three years remains unchanged, but the categories of CPE that can be counted will be more clearly defined.

1. How long is a CISA certification valid?

1.1 The three-year CPE cycle and annual maintenance both apply

ISACA explains that the expiration date shown on a CISA certificate reflects the holder’s three-year CPE cycle. This does not mean renewal only needs attention once every three years. Annual CPE, maintenance fees and other certification requirements still have to be completed each year.

If the annual requirements are not met, the certificate can lose its valid status before the three-year cycle ends. When planning your CISA renewal, it is therefore important to keep track of both the annual minimum and the three-year total.

1.2 When does CPE reporting start for a newly certified CISA?

Under the current CISA CPE Policy, the annual and three-year certification periods for a newly certified CISA begin on 1 January of the year following certification. There is no mandatory CPE reporting requirement in the certification year, but qualifying CPE earned from the certification date to 31 December can be reported toward the initial reporting period.

2. How many CPE hours are required for CISA renewal?

For CISA renewal, the two numbers to remember are 20 CPE each year and 120 CPE over three years. Meeting the three-year total is not enough on its own: you still need to meet the 20-CPE minimum in every year, so the entire requirement cannot simply be left until the final year.

The annual maintenance fee is also part of renewal. ISACA currently lists the fee as US$45 for members and US$85 for non-members; when payment is due, check the current details shown in MyISACA.

3. What activities can count toward CISA CPE?

CPE does not have to come only from ISACA activities. If an activity is relevant to CISA job practice areas and professional competence, qualifying third-party training, university courses, conferences, internal company training and some structured self-study courses may count.

• ISACA conferences, seminars, workshops, chapter activities and online training
• Non-ISACA professional training, internal company training, university courses and professional conferences
• Structured self-study courses with a formal completion certificate
• Teaching, lecturing, professional articles or publication work
• Exam question development or review
• Qualifying mentoring and volunteer activities

By contrast, basic office software training with no direct relevance to CISA professional practice does not qualify for CPE.

4. How should you choose a CPE course?

If you plan to build up your hours through a CPE course, check before registering whether the content is relevant to the CISA domains and whether the provider will issue formal proof of attendance or completion.

Courses do not have to be delivered by ISACA to qualify. The current policy accepts eligible non-ISACA professional education. For structured self-study, the course provider should issue a completion certificate showing the CPE hours earned.

When an activity does not specify its CPE value, ISACA calculates 1 CPE for every 50 minutes of active professional education, excluding lunch and breaks. CPE can be reported in 0.25-hour increments.

5. How do you report ISACA CPE in MyISACA?

Some ISACA activities are pre-loaded into your account as Unapplied CPE Hours, but you still need to apply them to the relevant certification. CPE earned through chapters or other sponsoring organizations generally needs to be self-reported.

1. Log in to MyISACA.
2. Go to Certifications & CPE Management.
3. Select Report and Manage CPE.
4. Click Add New CPE Record.
5. Enter the activity title or description, sponsoring organization, dates and qualifying activity.
6. Enter the CPE hours you want to apply to CISA, then save the record.

If you hold more than one ISACA certification and the same activity satisfies the relevant knowledge requirements for more than one credential, ISACA allows the same CPE hours to be applied to multiple certifications.

6. How long should you keep CPE supporting documents?

ISACA randomly selects certification holders for CPE audits. If selected, you need to provide supporting documentation for reported activities from the specified year. Failure to comply with an audit can result in revocation of the CISA certification.

Under the current requirement, supporting documents should be retained for 12 months after the end of each three-year reporting cycle. Records should clearly show the attendee name, sponsoring organization, activity title and description, date and CPE hours, such as a completion certificate, attendance record or other independent proof of completion.

7. What changes to CISA CPE take effect in 2027?

From 1 January 2027, ISACA will revise how CPE activities are categorised, while the core hours remain unchanged: at least 20 CPE per year and 120 CPE over three years.

• At least 90 CPE over the three-year cycle must align with the certification exam content outline or relevant domains.
• Up to 30 CPE may come from broader professional development, such as leadership, communication, mentoring or certain volunteer activities.
• Vendor sales or marketing demonstrations will no longer qualify for CPE; genuine case-study presentations may still count depending on the content.

ISACA has also stated that no system changes will happen in the 2026 cycle. If your three-year cycle continues into 2027, it is worth checking whether future learning activities are domain-aligned when planning your CPE.

8. CISA renewal FAQs

8.1 Does CISA renewal require you to retake the exam?

No, not when you maintain Active Status as required. You need to complete the CPE, annual maintenance fee and other certification requirements. If a certification is revoked for non-compliance with the CPE Policy, you may submit a reinstatement appeal. If the appeal is not approved, returning to Active Status requires retaking and passing the exam and reapplying for certification.

8.2 If I have 120 CPE over three years, can one year be below 20 CPE?

No. CISA has both an annual minimum and a three-year total requirement. You still need at least 20 CPE in each year.

8.3 Can a non-ISACA CPE course count?

Yes, provided the activity meets CISA-related professional education requirements. Eligible third-party training, university courses, conferences and some structured self-study courses can count. Before registering, check the course content and the proof of completion you will receive.

8.4 Can the same CPE hours count toward CISA and another ISACA certification?

Yes, as long as the activity satisfies the relevant knowledge requirements for each certification.

8.5 Where can I check my CISA certification status or expiration date?

ISACA provides a Certification Verification tool where you can check the current certification status and related expiration information. The expiration date on the certificate reflects the three-year CPE cycle, while annual maintenance requirements still need to be completed separately.

9. Plan your CISA CPE across the year

Rather than waiting until year-end to catch up on CPE, a more practical approach is to check your three-year certification period and current total first, then spread webinars, professional training and other qualifying activities across the year.

If you plan to earn CPE through training, first check how the course content relates to the CISA domains and what CPE record you will receive on completion. KORNERSTONE’s current CISA course is a 29-hour workshop, and the course page states that it is eligible for 29 PDU/CPE units. If you would like to understand the course content, schedule or CPE arrangements, you can contact KORNERSTONE through Course Enquiry.