How to maintain ISACA Certifications

There are different certifications issued by the professional association ISACA. These certifications have a limited validity period that, nevertheless, can be extended. This post summarizes ways to maintain and renew ISACA certifications.

The post tries to generalize the common validity requirements of these ISACA certifications:

CISA
CISM
CRISC
CGEIT
CSX-P
CDPSE
ITCA
CET

Frequently Asked Questions

What is the validity period of an ISACA Certification?

Continuing Professional Education (CPE) policy determines that certain CPE hours must be completed and reported in a periodical basis to keep an ISACA Certification.

An ISACA Certification is revoked if:

Required CPE’s are not completed or reported annually
ISACA’s IT audit Standards or Code of Professional Ethics are not followed.
Annual membership fee is not paid
If selected for the annual audit, required documentation of CPE activities are not submitted

Requirements regarding CPE hours:

Earn and report an annual minimum of CPE hours. These hours must be appropriate to the currency or advancement of the ISACA certificate’s knowledge or ability to perform certificate-related tasks.
Earn and report a minimum of CPE hours for a three-year reporting cycle period.
Some ISACA certifications (like CSX-P or CET) restrict the type of theoretical/practical content of the CPE hours

Requirements per ISACA Certification:

ISACA Cert.		Annual CPE hours	3-year CPE hours	Comments
1	CISA	20	120	–
2	CISM	20	120	–
3	CRISC	20	120	–
4	CGEIT	20	120	–
5	CSX-P	20	120	Of the 20 annually required CPE hours, a minimum of 10 hours must be attained by participating in skills-based training/labsOf the 120 3-year required CPE hours, a minimum of 30 CPEs must be skills-based training/lab activities
6	CDPSE	20	120	–
7	ITCA	20	120	–
8	CET	20	120	Of the 20 annually required CPE hours, a minimum of 10 hours must be attained by participating in skills-based training/labsOf the 120 3-year required CPE hours, a minimum of 30 CPEs must be skills-based training/lab activities

CPE reporting is due by the end of each calendar year (i.e., 31 December of each year).

As a general rule (considering 3-year cycle certifications of 120 CPEs):

The minimum annual CPEs year and certificate is 20.
The recommended annual CPEs is 40
There is no maximum annual CPEs, but it makes no sense registering more than 80

How do I get an invoice for my company?

You may need to have an invoice issued to your company in order to proceed for the payment.

If it is the case, first update business data on ISACA profile. To do so, login at isaca.org > My ISACA Dashboard > My “ISACA Profile” button.

Please ensure this info is updated:

Professional Info > Contact Company Name: Name that will appear in the invoice. You may use this field to inform for both the Company Name and VAT ID.
Contact Information > Business Street: Address that will appear in the invoice.

Then you can download the invoice. To do so, login at isaca.org > Certifications > “View invoice” button.

How do I get the bank details from ISACA to pay an invoice by wire transfer?

You can either pay the invoice with credit card or wire transfer.

If you pay by credit card, things will be much easier and not immediate, but sometimes this possibility does not exist, for example when a company is paying the certificate.

To get the bankd details from ISACA to make the wire transfer, you can open a ticket to request it by logging in to ISACA web and then browsing to Support >> Submit a Request > “Submit” button.

When fulfilling the form, select “Type” = “Membership” and “Case Reason” = “Payment, billing”.

How do I claim a renewal already paid but not updated?

It may happen that your company or you make a wire transfer to ISACA for an invoice but the renewal is not updated on your myISACA profile.

If that happens, you can open a ticket by logging in to ISACA web and then browsing to Support >> Submit a Request > “Submit” button.

When fulfilling the form, select “Type” = “Membership” and “Case Reason” = “Payment, billing” or “Renewal”.

Please ensure you attach the proof of payment from the bank and the invoice you have paid.

Do I need to apply CPE hours the first year I get a certification?

No, you do not need to apply CPE hours on the first year you get a certification. The CPE requirements and the 3-year period will start the following year.

If you earn ISACA CPE hours on a year you do not need to use them, you can keep them and apply them the year you need them.

How do I earn CPE hours?

Ways to get CPE hours:

Getting free CPE available to ISACA members. Some “free” CPE implies working for ISACA.
Attending ISACA’s webinars and virtual conferences
Attending ISACA’s training courses
Participate and volunteer with ISACA, what may include becoming an Exam Item Writer
Attend a conference
Complete Journal Quizzes
Mentoring
Perform online training
Pass ISACA’s certificate or certifications exams

You can find more information in the official web about how to earn CPE hours.

Check the ISACA’s “Online training” and “Training and Events” to find opportunities to get CPE.

Examples of CPE hours

CISM exam pass: 8 CPE hours

CISA exam pass: 8 CPE hours

CSX-F exam pass: 4 CPE hours

Attending a 3-hour ISACA local chapter webinar: 3 CPE hours.

I have many ISACA Certifications. Do I need to get CPEs separately for each of them?

As stated in the CPE Policies, the use of CPE hours towards meeting the CPE requirements for multiple ISACA certifications is permissible when the professional activity is applicable to satisfying the job-related knowledge of each certification.

The best approach would be to find CPE that apply to all or most certificates; in this case, you will not need an extra effort to maintain your certificates.

When you submit a CPE, you do not choose to which certificate it goes, so it will go to your membership. So in case you have more that an ISACA Certfication (e.g., CISA, CISM, CRISP, etc.), a CPE is applied to your certificate, it means, to all the certificates at the same time.

How do I check CPE hours?

There are different on MyISACA where you can check CPE hours:

“Certifications & CPE Management” screen has a breakdown of all certificates you have, CPE’s applied for the current year and CPE’s applying for the 3-year. It will confirm also the year range spanning the 3-year period.

I prefer to use this screen to check my current CPE status, as it is the most clear. Unfortunately, you cannot use this screen to report CPE, as it is just a report.

“Report and Manage CPE” screen do not contain a breakdown of the certificates you own, so it is more difficult to understand. However, it provides a clearer view of ISACA CPE that has not been yet applied and it is the only one where you can report or apply CPE hours.

How do I register/report CPE hours?

The only screen where you can register/report CPE hours is:

There are two types of CPE:

CPE Earned through ISACA
CPE Earned through other vendors

CPE hours earned through ISACA (e.g., local chapter webinars, ISACA certifications, etc.) are usually registered automatically on your profile with the status “Unapplied CPE Earned through ISACA” and listed in this category in “Report and Manage CPE”. Click on “Apply” to apply them to the current year. Then enter the hours of CPE hours (usually, it would be the maximum hours allowed).

In case it is not automatically registered, you may add it manually in the same way as a CPE from a non-ISACA vendor, selecting as Activity “ISACA professional education activities” or “ISACA professional education skill-based activities (Must Contain Lab Exercises)”.

The ISACA CPE records you obtained can be found and their certificates downloaded in “MyISACA”> “CPE Certifcates“.

If the ISACA event was organized by your local chapters, CPE certificate may have been received by e-mail.

CPE earned through non-ISACA vendors require a different process. On the “Report and Manage CPE” screen, click on “Add new CPE record to current cycle”.

Then you need to complete:

Title/Description
Sponsoring Organization
Start Date
End Date
Qualifying Activity: there is a dropdown list with possible values
Method of Delivery: in person, by mail or online.

In case of audit, ISACA will ask you to provide a prove that you got a CPE; be sure you keep a copy of diplomas that give evidence of the earned CPE hours. Non-ISACA vendors sometimes give diplomas where the CPE hours are stated. In case of ISACA CPE, they can be downloaded from “MyISACA” > “CPE Certifcates“, as informed before.

You can find more information in the official web about how to report CPE hours.

There are CPE hours from previous years that I have not applied. It I apply them during the current year, on which year will it be applied?

When an ISACA CPE is applied, it will be applied to the current year, regardless of when the CPE was obtained.

This is why it is advisable to apply first non-ISACA CPE hours and keep unused ISACA CPE hours for next years.

How do I know if a non-ISACA education can be posted as CPE, and to how many hours correspond?

Check section “Calculating CPE Hours” in CPE Policies.

What is the cost of maintaining an ISACA certification?

If you are a student and get all CPEs for free (what is quite unexpected), you could maintain an ISACA certification with $25/year; that would be the minimum fee. But in most cases, maintaining an ISACA certification will probably cost you hundreds of dollars per year.

The costs of maintaining an ISACA certification depends on the following concepts:

ISACA membership annual fee
Cost of CPE obtained

As owning an ISACA certification requires to be an ISACA member, you need to pay an annual membership fee. The standard annual fee was of $135 in 2021, though there were reduced rates for recent graduates ($68) and students ($25). You may need to apply an additional fee for your local chapter; for example, standard Madrid chapter renewal fee was $70 in 2021.

CPE costs are variable. Take into account that you need to pay to get some CPEs (in the concept course fees, etc.), while others are for free (free webinars imparted by local chapters, ISACA voluteering, etc.). So the final cost of each CPE depends on how did you get CPE hours.

This ISACA post details much of the related costs.

What if I no longer work on the certification field?

It may happen that you no longer work on the certification field either because you changed your career path, stopped working or retired. In these cases, if you want to avoid revocation you can apply for the corresponding special status for each ISACA certification you won:

Retired Status
Nonpracticing Status

Nevertheless, you need to keep paying the annual membership fee to keep this status.

You need to submit the corresponding retired or nonpracticing form before 15 January.

For additional details, check this link, contact the certification department via telephone at +1.847.660.5660, via fax at +1.847.253.1755 or via e-mail at certification@isaca.org.

What can I do if my certification has been revoked and I want to recover it?

If your certification has been revoked, there is a certification reinstatement process. The reinstatement fee is US$50.

For additional details, check this link and go to section “Revoked status”.

External References

“Maintain CISA Certification“; isaca.org
“How to earn CPE“; isaca.org
“Certifications & CPE Management“; isaca.org