CISA vs CompTIA Security+: Which Certification First? (2026)

The answer to "CISA vs Security+" isn't which one to choose — it's that these certifications live in different stages of a career, not different lanes of the same stage. CompTIA Security+ (SY0-701) is an entry-to-mid-level technical credential that proves you understand cybersecurity concepts. CISA (Certified Information Systems Auditor, from ISACA) is a senior-level audit credential that requires five years of verified IS audit or control experience before you can hold the designation.

One common mix-up: CISA is not a CompTIA certification. It is issued by ISACA, a separate professional association, so you will not find it on CompTIA's certification roadmap (and it is unrelated to CISA the US Cybersecurity and Infrastructure Security Agency). Most professionals asking "which should I get first?" should get Security+ now — and revisit CISA several years down the road if their career moves into audit, risk, or governance.

That said, the comparison is worth understanding in full: the two certifications do overlap in some job descriptions, they both appear in cybersecurity career roadmaps, and their exam content touches some of the same domains. This guide covers exactly what each exam tests, what experience each requires, where each leads, and — critically — who should be thinking about CISA at all versus who should stay on the technical track. If you're working toward Security+ right now, our free SY0-701 practice test covers all five domains with full explanations — no account required.

CISA vs Security+: Side-by-Side Comparison

Feature	CompTIA Security+ (SY0-701)	ISACA CISA
Issuing Body	CompTIA	ISACA
Level	Entry / Intermediate	Advanced / Professional
Exam Cost	Varies by region; see the current price on CompTIA	$575 (member) / $760 (non-member) (ISACA, 2026)
Questions	Up to 90 (MCQ + PBQ)	150 (multiple-choice)
Duration	90 minutes	240 minutes (4 hours)
Passing Score	750 / 900 (CompTIA)	450 (scale: 200–800) (ISACA)
Experience Required	Recommended: 2 yrs IT experience (not enforced)	Required: 5 yrs IS audit/control/security (max 3 yr waiver)
Primary Focus	Threat identification, security controls, network security, cryptography, compliance basics	IS audit process, IT governance, information systems operations, information asset protection
Renewal	Every 3 years (50 CEUs or exam retake)	Annual: 20 CPE hrs/yr (120 per 3 years) + annual maintenance fee
DoD 8140 Role	IAT Level II (DoD Cyber Exchange, 2024)	Approved for DoD 8140 cyberspace workforce qualification (audit/compliance work roles) (ISACA, 2024)
Typical Career Stage	Entry to mid-career technical roles	Senior audit / GRC roles (manager and above)
Best For	Security analyst, sysadmin, network engineer, SOC Tier 1/2, DoD contractor	IT auditor, IS audit manager, GRC manager, compliance director, internal audit lead

What CompTIA Security+ (SY0-701) Actually Tests

CompTIA Security+ is an entry-to-intermediate certification covering the foundational knowledge required for cybersecurity roles. SY0-701 is the current version; it replaced SY0-601 in November 2023. CompTIA expects its successor, SY0-801, around November 17, 2026, and English SY0-701 retires June 11, 2027. The exam has a maximum of 90 questions in 90 minutes, with a passing score of 750 on a 100–900 scale (CompTIA, 2026). Performance-based questions (PBQs) appear first in the exam sequence and test hands-on application: configuring firewalls, interpreting log snippets, ordering incident response steps.

The exam covers five domains:

Domain	Name	Weight
1	General Security Concepts	12%
2	Threats, Vulnerabilities & Mitigations	22%
3	Security Architecture	18%
4	Security Operations	28%
5	Security Program Management & Oversight	20%

Domain 4 (Security Operations) is the largest at 28% of exam weight and is the most scenario-driven. The exam tests application, not recall: many questions present a scenario with an attack vector and ask what the security analyst should do first, next, or most effectively — not which concept matches a definition.

Security+ satisfies the DoD 8570/8140 IAT Level II baseline, which makes it a requirement for a wide range of federal IT and contractor roles. CompTIA recommends two years of general IT experience before attempting SY0-701, but this is advisory — there's no formal enforcement gate. Candidates who've studied Security+ and are looking to benchmark their readiness can take the free SY0-701 practice test to identify domain-level gaps before their exam date.

What CISA Actually Tests

CISA (Certified Information Systems Auditor) has been issued by ISACA since 1978 and is the most widely recognized credential for IT audit professionals globally. Where Security+ tests whether you can operate security controls, CISA tests whether you can audit them — evaluating adequacy, documenting findings, and reporting to audit committees and executive leadership. The 150-question, 4-hour exam tests five job practice domains (ISACA CISA official page):

Domain	Weight	Focus
Information Systems Auditing Process	18%	Audit standards (ISACA IS Audit Standards), risk-based audit planning, evidence collection, audit reporting to management and audit committees
Governance and Management of IT	18%	IT governance frameworks (COBIT, ITIL), IT strategy alignment, enterprise architecture review
IS Acquisition, Development, and Implementation	12%	Project management controls, SDLC, change management, acceptance testing
IS Operations and Business Resilience	26%	IT service management, incident management, business continuity, disaster recovery
Protection of Information Assets	26%	Information security management, access control, encryption, network security — assessed from an auditor's perspective

Domain weights updated August 1, 2024 per ISACA's official CISA exam content update.

Notice how Domains 4 and 5 (IS Operations and Protection of Information Assets) collectively account for 52% of the exam — and cover material that overlaps with Security+ conceptually. The critical difference is framing: CISA questions ask whether the controls are adequate and documented, not whether you can configure them. "Which access control framework should an IS auditor recommend for a healthcare organization managing PHI?" is a CISA question. "Which protocol encrypts data in transit for a web application?" is a Security+ question.

The Experience Requirement: Where CISA and Security+ Diverge Most

CISA's verified experience requirement is the most misunderstood aspect of the credential — and the most important factor in deciding whether to pursue it now or later.

Security+ experience: CompTIA recommends two years of general IT experience before sitting SY0-701. This is explicitly advisory. CompTIA does not verify experience before registering or sitting the exam. Fresh IT graduates and career changers with intensive study regularly pass Security+ on their first attempt.

CISA experience: You can sit the CISA exam at any career stage — ISACA doesn't require experience verification before the exam. To earn the CISA designation, you must document five years of verified work experience in IS auditing, control, security, or assurance. That experience must fall within the 10 years before your application (ISACA, 2026). ISACA grants waivers — reducing the requirement to a minimum of two years — under specific conditions:

• Bachelor's degree (any field) — waives two years
• Master's degree in information systems or a related field — waives three years
• Associate's degree — waives one year

In practice, this means most CISA candidates already work in IS audit, IT risk management, or GRC roles before they sit the exam. The designation is designed to validate experienced practitioners, not accelerate entry-level professionals into audit roles. Taking the CISA exam without the experience foundation is possible — but you won't earn the credential until the experience is there, which can be years away.

There's a practical nuance worth flagging: some candidates pass the CISA exam years before they meet the experience requirement, treating the pass as a long-term credential investment. If you're on a technical track today but expect to move into governance or internal audit leadership in 3–5 years, passing the exam now and completing the experience requirement later is a legitimate strategy. It is not the default advice for most Security+ candidates, who are usually early or mid-way through a technical career.

Career Paths: Where Each Certification Leads

After Security+	After CISA
SOC Analyst (Tier 1/2)	IT Auditor / IS Audit Manager
Security Analyst	IT Risk Manager / GRC Manager
Network Security Engineer	Internal Audit Lead
Systems Administrator (hardening focus)	Compliance Director
Penetration Tester (entry)	CISO (in audit-focused organizations)
DoD / Federal Contractor (IAT Level II)	IT Audit Partner (Big 4 consulting)

Security+ roles are operational: you're working inside security tooling, configuring controls, triaging alerts, and hardening systems. CISA roles are assurance-oriented: you're planning and executing audits, evaluating control adequacy, and reporting findings to executive leadership and audit committees. These paths rarely converge at the junior level — they meet at senior management and CISO tier, where practitioners who've done both technical and governance work have an edge over pure-track colleagues.

Salary Comparison: Security+ vs CISA in 2026

CISA roles tend to pay more mainly because they sit at a higher seniority level. The roles each certification leads to sit at different seniority levels:

Role	Primary Cert	Typical Seniority
SOC Analyst (Tier 1)	Security+	Entry level
Security Analyst (2–4 yrs)	Security+	Mid-career
Senior Security Analyst	Security+ / CySA+	Senior individual contributor
IT Auditor (3–5 yrs)	CISA	Mid-career
IS Audit Manager	CISA	Manager
IT Audit Director / Partner	CISA	Director / executive

The BLS reports a median salary of $129,180 for all information security analysts (May 2025). That figure spans entry to senior levels, so entry and mid-career roles typically fall below it. All figures are US-based; actual compensation varies by geography, employer size, and experience.

The salary gap between Security+ and CISA roles at the same experience level isn't as wide as it looks at first. A Security+ holder with 5 years of hands-on experience in a senior analyst or engineering role often earns as much as an early-career CISA holder in a staff IT auditor position. The CISA premium shows up most at manager and director level. There, CISA is often a prerequisite for advancement in IS audit firms, Big 4 advisory practices, and regulated industries like financial services and healthcare.

Who Should Get Security+ (Not CISA) Right Now

Get Security+ now — and stay on the technical track — if you match this profile:

• You're early-to-mid career in IT or cybersecurity. Security+ is the industry's baseline technical credential. It signals to employers that you understand the foundational concepts required for any security-adjacent role. Without it (or an equivalent like SSCP), most technical security roles are inaccessible.
• Your day-to-day work is hands-on technical. You configure firewalls, manage endpoints, respond to alerts, or administer systems. CISA doesn't validate those skills — it validates the ability to audit whether someone else is doing them correctly.
• You're targeting DoD or federal contractor roles. Security+ satisfies the DoD 8570/8140 IAT Level II baseline requirement. It's effectively a licensing threshold for many federal IT positions. CISA qualifies for different DoD 8140 work roles (audit and compliance) and doesn't substitute for Security+ in technical roles.
• You have fewer than 3 years of IS audit or GRC experience. Below that threshold, you don't meet the CISA experience requirement (3 years with a bachelor's-degree waiver). Pursuing CISA now means passing an exam but waiting years to use the credential.
• You want to move toward CySA+ or SecurityX next. The CompTIA technical track — Security+ → CySA+ → SecurityX (formerly CASP+) — is the established path for technical security practitioners. See our Security+ vs CySA+ guide for a full breakdown of the transition.

Who Should Actually Consider CISA

CISA makes sense for your certification roadmap if you match this profile:

• You already work in IS audit, IT risk, or GRC. CISA validates skills you're applying daily in those roles. Audit clients and regulators recognize it as proof of professional competency.
• You have 3–5 years of relevant audit or IT control experience. Below that threshold, you can sit the exam, but you won't meet ISACA's experience requirement to earn the designation — making the effort premature unless you're deliberately building toward it.
• You're in a regulated industry. Financial services, healthcare, and government contractors frequently require CISA for internal audit, IT risk, and compliance roles — sometimes as a hiring prerequisite above a certain seniority level.
• Your trajectory is toward audit leadership or governance. CISA carries credibility at the executive level that technical certifications generally don't. If you expect to present to audit committees, manage third-party risk programs, or move into a CISO role via the governance track, CISA is the credential that unlocks those conversations.
• You're targeting Big 4 or advisory work. Deloitte, PwC, EY, and KPMG's IT advisory and risk assurance practices treat CISA as a standard qualification for senior associates and managers in IS audit service lines.

The Standard Path: Security+ Comes Before CISA

For the large majority of professionals asking "CISA vs Security+", the answer is sequential, not comparative: Security+ first, then CISA years later — if your career moves into audit or governance. The CompTIA pathway most technical security professionals follow is Security+ → CySA+ → SecurityX (formerly CASP+), with CISSP (ISC²) as the senior cross-domain credential for security leadership. CISA enters the picture for professionals who, after several years on the technical track, move laterally into IS audit or GRC functions and need the audit community's gold-standard credential.

If you're working in a SOC, as a sysadmin, or in a security engineering role — Security+ is the right credential now. Our CompTIA Security+ (SY0-701) study guide covers a 30-day free study plan built around the actual exam objectives. If you're weighing whether to add CySA+ after Security+, the CySA+ vs CISA comparison covers that specific decision in full, including who CISA is actually for.

Frequently Asked Questions

Is CISA a CompTIA certification?

No. CISA (Certified Information Systems Auditor) is issued by ISACA, not CompTIA. Security+, CySA+ and SecurityX (formerly CASP+) are CompTIA certifications; CISA, CISM and CRISC are ISACA certifications. Searches for "CompTIA CISA" usually come from people comparing the two vendors' paths: start with CompTIA Security+ for technical security work, and add ISACA's CISA later if you move into IT audit or governance. The name is also shared with the US Cybersecurity and Infrastructure Security Agency, a federal agency that is not a certification body.

Is CISA harder than Security+?

They're hard in different ways. Security+ demands applied technical scenario reasoning — firewall rules, log analysis, incident response sequencing — in a 90-minute sprint. CISA tests governance and audit reasoning across 150 questions in four hours, requiring a different mental model than most technical practitioners are used to. Most technical professionals find CISA's audit framing more conceptually foreign than its technical difficulty; most IT auditors find Security+'s operational scenario questions unfamiliar. Neither is objectively harder — they test different skill sets against different experience baselines.

Can I take CISA right after Security+?

You can sit the CISA exam at any time — ISACA doesn't check experience before exam registration. But earning the CISA designation requires 5 years of verified IS audit or control experience (3 years with a bachelor's-degree waiver; as little as 2 years with the maximum 3-year waiver). Passing the exam immediately after Security+ means waiting years before you can claim the credential. If you want CISA eventually, the practical path is: get Security+, build IS audit or GRC experience, then sit the CISA exam when your experience requirements are nearly met (ISACA experience requirements, 2026).

Does Security+ count toward CISA experience requirements?

The CISA experience requirement is measured in years of work experience in IS auditing, control, security, or assurance — not in certifications held. Security+ itself doesn't substitute for or waive any portion of the required work experience. What it does is demonstrate technical competency that complements the audit skills CISA tests. A candidate who holds Security+ and works in IT security operations for 5 years would satisfy CISA's experience requirement through the work experience, not through the cert.

Which pays more: Security+ or CISA?

CISA usually pays more, mainly because CISA holders are more senior: the credential needs five years of experience and leads to audit-manager and director roles. For reference, the BLS median for all information security analysts was $129,180 in May 2025 (BLS). The premium reflects CISA's seniority requirement and its role as a prerequisite for senior positions in IS audit firms and regulated industries. However, the comparison is misleading at the entry level: a new Security+ holder and a new CISA holder who's cleared the experience requirement are not comparable candidates.

What's the difference between CISA and CISSP?

CISA (ISACA) focuses specifically on IS auditing, IT governance, and assurance — it's the credential for audit professionals. CISSP (ISC²) is a broad security leadership credential covering 8 domains from security architecture to software development security; it's designed for security managers and CISOs. Both require significant experience (CISA: 5 years IS audit; CISSP: 5 years security experience across 2 domains). Many senior security professionals hold both — CISSP for broad security leadership credibility and CISA if their role includes significant governance or audit responsibilities. See our Security+ vs CySA+ guide for more on the CompTIA progression that leads toward CISSP.

Start Where You Are

If Security+ is your current target, the most efficient preparation is mixed-domain practice testing plus spaced review of your weak domains. Our free SY0-701 practice test gives you 50+ questions across all five domains with full explanations for every answer — including why each wrong option is wrong. No account, no credit card, no time limit in study mode.

For a structured study plan, the Security+ (SY0-701) study guide covers a 30-day schedule built around free resources. Once you've passed Security+ and are thinking about what comes next, the Security+ vs CySA+ comparison and CySA+ vs CISA guide cover the full progression in detail.

Related reading

• Security+ vs CySA+: Which to Take First? (2026)
• CySA+ vs CISA: Key Differences and Which to Get (2026)
• CompTIA Security+ (SY0-701) Study Guide 2026: Pass Your Exam For Free
• 7 Proven Security+ Exam Tips to Pass on Your First Try