ISACA CISA in 2026: What Changed Since the 2019 Outline

The 2019 CISA job-practice update is now historical context, not the blueprint candidates should use for a current exam. ISACA’s active CISA exam content outline took effect in August 2024 and remains the relevant framework in 2026. It still uses five domains, but the weighting and emphasis have moved with the work of modern information-systems auditors.

The current distribution is 18% Information Systems Auditing Process, 18% Governance and Management of IT, 12% Information Systems Acquisition, Development and Implementation, 26% Information Systems Operations and Business Resilience, and 26% Protection of Information Assets.

If your notes are organized around the 2019 weights of 21%, 17%, 12%, 23%, and 27%, they need to be rebalanced before you use them as a study plan.

The biggest change is how operational assurance is weighted

Operations and business resilience now carry 26% of the exam. That is a meaningful signal about the auditor’s role. It is not enough to understand how a system was approved and implemented; you must also evaluate whether it remains controlled, available, supportable, recoverable, and aligned with service commitments after go-live.

Study operational controls as evidence chains. A change record is useful only if approvals, testing, deployment, validation, and rollback expectations are clear. A backup policy is useful only if restoration is tested. An availability target is useful only if monitoring and incident records show whether the service actually meets it.

Protection of information assets remains a major domain

Domain 5 also carries 26%. The current scope covers security frameworks, physical and environmental controls, identity and access management, network and endpoint security, data-loss prevention, encryption, public-key infrastructure, cloud and virtualized environments, mobile and wireless technology, IoT, security monitoring, incident response, and forensics.

The CISA lens is different from a security-engineering exam. You are rarely being asked to build the most sophisticated technical control. You are being asked whether the control is appropriate, governed, implemented, monitored, and supported by sufficient evidence.

Governance now includes data, privacy, and enterprise architecture

The 18% Governance and Management of IT domain is broader than organization charts and policy documents. The current outline explicitly includes enterprise architecture, enterprise risk management, privacy programs, and data governance and classification.

That means a strong candidate should be able to connect a technical choice to an accountability model. Who owns the data? Which risk has been accepted? Which regulatory obligation changes the control? How does the architecture support the business strategy? These questions are more exam-relevant than memorizing isolated framework definitions.

Audit data analytics is part of the current audit process

Domain 1 still covers planning and execution, but modern execution includes audit data analytics. Candidates should understand when population-level analysis can improve assurance, when sampling is still appropriate, how data quality affects conclusions, and why an automated result is not automatically reliable evidence.

The audit process remains risk based. Technology can expand the amount of evidence you inspect, but it does not replace professional judgment about scope, materiality, control design, or the meaning of an exception.

Acquisition and implementation is smaller but still critical

Domain 3 remains 12%, yet it is where many long-lived control problems begin. Project governance, feasibility, development methods, control design, readiness testing, release management, migration, data conversion, and post-implementation review all sit here.

The important study habit is to ask what evidence should exist before production use begins. Auditors care about approved requirements, testing, segregation of duties, migration reconciliation, rollback planning, data integrity, and whether unresolved risks were accepted by the right people.

What this means for a 2026 study plan

Do not spend study time according to the number of pages in an old manual. Allocate it according to the live outline and your own weakness. The two 26% domains deserve sustained practice, but the smaller domains can still decide the result if your reasoning is weak.

A current CISA study plan for 2026 should repeatedly mix domains rather than studying them as isolated chapters. Real audit scenarios often cross governance, implementation, operations, and security at the same time.

Practice the auditor’s order of operations

Many difficult CISA questions become easier when you use a consistent sequence:

1. Identify the business objective and risk.
2. Determine the control objective.
3. Ask what evidence demonstrates design and operation.
4. Separate a control deficiency from an isolated incident.
5. Escalate through governance rather than jumping directly to a technical fix.
6. Choose the action that preserves auditor independence and supports a defensible conclusion.

This sequence is especially helpful when two answer choices are technically reasonable but only one reflects the auditor’s responsibility.

Retire the 2019 percentages from active memorization

The 2019 outline still matters if you are reviewing older books, courses, or practice questions because it explains why their domain weights and terminology differ. Label those materials clearly as legacy. Do not mix the old percentages into flashcards or readiness scoring.

For a final check, use an ISACA CISA readiness guide organized around the current domains, then use CISA practice questions to test whether you can apply the audit mindset under ambiguity rather than simply recall the new percentages.

The central change from 2019 to 2026 is not a new list to memorize. It is a stronger emphasis on operational resilience, modern technology governance, data and privacy, security assurance, and evidence-driven audit work across the full life cycle of information systems.