CySA+ vs CISA: Key Differences and Which to Get (2026)

Quick answer if you searched "CompTIA CISA" to get here: there's no such certification. CompTIA owns CySA+. ISACA owns CISA. Two different organizations, two different exams, no shared prerequisites — the only thing they really have in common is three letters and a spot on the same "advanced security cert" lists. (If what you meant was CISA versus Security+, that comparison lives in our CISA vs Security+ guide.) Here's what each one is and which one you need.

The CySA+ vs CISA decision is simpler than it looks: these are not competing credentials — they prepare you for opposite careers. CySA+ (CompTIA Cybersecurity Analyst) is a technical credential for security analysts doing threat detection, vulnerability management, and incident response inside a SOC. CompTIA released CySA+ V4 (CS0-004) on June 23, 2026 — it's now the current version. CISA (Certified Information Systems Auditor, from ISACA) is a management-level credential for IT auditors who independently assess whether an organization's controls, governance, and risk management programs are working.

Both certifications show up in senior security job descriptions and both live in the "intermediate-to-advanced" tier — which is exactly why people mix them up. But the candidates who benefit from each are fundamentally different, and getting this decision wrong wastes months of study time. Already working toward Security+? Try our free SY0-701 practice test to check your readiness — no account required.

Independent study resource. Not affiliated with or endorsed by CompTIA or ISACA. Exam codes, prices, and objectives are set by the respective vendors — always confirm current details on official exam pages before booking.

CySA+ vs CISA: Side-by-Side Comparison

Feature	CompTIA CySA+ (CS0-004)	ISACA CISA
Issuing Body	CompTIA	ISACA
Level	Intermediate	Advanced / Professional
Current Version	CS0-004 (launched June 23, 2026); CS0-003 (English) retires December 22, 2026	Current (2024 domain update)
Exam Cost	See comptia.org	$575 (member) / $760 (non-member) (ISACA, 2026)
Questions	Up to 85	150
Duration	165 minutes	240 minutes (4 hours)
Passing Score	750 / 900 (CompTIA)	450 (scale: 200–800) (ISACA)
Experience Required	Recommended: ~4 yrs SOC / vulnerability-analyst experience (Security+ or equivalent knowledge)	Required: 5 yrs IS audit/control/security (max 3 yr waiver)
Primary Focus	Threat analysis, SOC operations, vulnerability management, AI-assisted security (CS0-004)	IS audit, IT governance, risk management, compliance
Renewal	Every 3 years (60 CEUs)	Annual: 20 CPE hrs/yr + annual fee
DoD 8140 (DCWF) Work Roles	Cyber Defense Analyst (511), Cyber Defense Incident Responder (531), Vulnerability Assessment Analyst (541), Security Control Assessor (612) and others (CompTIA)	Security Control Assessor (612), Intermediate / Advanced (ISACA)
Salary Range (US, Robert Half 2027)	$105K–$152K/yr (Cybersecurity Analyst); $121K–$195K/yr (Cybersecurity Engineer)	$111K–$155K/yr (IT Auditor, Technology)
Best For	SOC analyst, threat hunter, vulnerability analyst	IT auditor, IS audit manager, compliance director, CISO support roles

Salary bands are national low–high starting-salary ranges from the Robert Half Technology Salary Guide (2027 edition); see the Salary Comparison section below for the BLS context.

"CompTIA CISA": Does That Certification Exist?

No. CompTIA and ISACA are two separate certifying bodies, and neither licenses or co-brands the other's exams. CompTIA's own catalog (CompTIA certifications) lists A+, Network+, Security+, and CySA+; ISACA's (ISACA credentialing) lists CISA, CISM, and CRISC. Neither list contains the other's credential.

So if a job posting or a study group says "get your CompTIA CISA," they've made that mix-up. What they probably mean is CySA+ (if the role is technical) or the real, ISACA-issued CISA (if the role is audit or governance). The rest of this guide walks through both so you can tell which one the job wants.

What CySA+ (CS0-004) Tests

CySA+ is CompTIA's intermediate cybersecurity analyst credential. It follows Security+ in the CompTIA certification pathway and is explicitly aimed at professionals working in — or moving into — security operations center (SOC) roles. The exam tests your ability to apply security analysis skills, not just define them.

Starting fresh today, build your plan around CS0-004: the core SOC analyst skills (threat hunting, vulnerability management, incident response) carry forward from V3, with new emphasis on AI-assisted detection and deeper cloud coverage. If you're already deep in CS0-003 materials, that exam stays bookable until it retires on December 22, 2026.

The exam covers four domains; both versions' weights are below (CompTIA CySA+ official page):

Domain	CS0-003 Weight	CS0-004 Weight	What It Tests
Security Operations	33%	34%	Log analysis, SIEM correlation, AI-assisted threat detection, threat hunting, behavioral analytics, identity and access management in operational context
Vulnerability Management	30%	26%	Scanning and prioritization (CVSS, CVE), remediation workflows, software bill of materials, patch management, reporting
Incident Response and Management	20%	24%	Detection, containment, eradication, recovery, post-incident analysis, digital forensics fundamentals, SOAR automation
Reporting and Communication	17%	16%	Metrics, KPIs, dashboards, threat intelligence sharing, communicating risk to stakeholders

CS0-003 weights per CompTIA CySA+ (CS0-003) official page. CS0-004 weights per CompTIA CySA+ V4 (CS0-004) official page. Verify current objectives on the official pages before studying.

The 165-minute exam window is among the longest of any CompTIA certification (tied with SecurityX, formerly CASP+, at 165 minutes), reflecting the scenario complexity. Many questions present log snippets, SIEM alerts, or vulnerability scan outputs and ask you to interpret them — this is applied analysis, not definition recall. If you're studying for Security+ right now and want to understand where CySA+ fits next, our Security+ vs CySA+ comparison breaks down the full progression.

What CISA Tests

CISA (Certified Information Systems Auditor) is issued by ISACA — not CompTIA — and is ISACA's credential for IT auditing professionals. It is not a hands-on security analysis credential. CISA proves you can independently assess whether an organization's information systems, controls, and IT governance structures are effective, compliant, and aligned with business objectives.

The CISA exam covers five job practice domains (ISACA CISA official page):

Domain	Weight	What It Tests
Information Systems Auditing Process	18%	Audit standards, planning, risk-based auditing, evidence collection, reporting to management and audit committees
Governance and Management of IT	18%	IT governance frameworks (COBIT, ITIL), IT strategy, organizational structure, enterprise architecture review
Information Systems Acquisition, Development, and Implementation	12%	Project management controls, system development lifecycle, change management, testing and acceptance
Information Systems Operations and Business Resilience	26%	IT service management, incident management, business continuity, disaster recovery
Protection of Information Assets	26%	Information security management, access control, encryption, network and endpoint security controls from an audit perspective

Domain weights updated August 1, 2024 per ISACA's official CISA exam content update.

Notice the framing: CISA covers many of the same topics as Security+ and CySA+ — access control, encryption, incident management, business continuity — but tests them from an auditor's perspective. You're not configuring the SIEM or running the vulnerability scan; you're evaluating whether the organization's controls around those activities are adequate and documented.

Take privileged access as an illustration (our example, not exam content). A CySA+-style prompt hands you an authentication log excerpt and asks which account's behavior is anomalous. A CISA-style prompt tells you the quarterly access review was signed off with 12% of privileged accounts unreviewed and asks what the finding is and who owns the control. Same topic, opposite job.

The 150-question, 4-hour exam is one of the longer standardized certification tests in IT. What makes the exam demanding is not that the technical content is deeper than CySA+; it's that the audit and governance reasoning requires a different mental model than most technical professionals are used to. The mandatory five-year experience requirement further filters the candidate pool toward practitioners who already possess a mature understanding of enterprise risk and control environments.

CySA+ vs CISA: Experience Requirements Compared

This is where CySA+ and CISA diverge most sharply in practice.

CySA+ recommends about four years in a SOC or vulnerability-analyst role (Security+ or equivalent knowledge), but CompTIA does not verify this before you sit the exam. The recommendation is about readiness, not eligibility: candidates with less experience can and do register, they just have more ground to cover in the scenario questions.

CISA has a verified experience gate. You can sit the CISA exam at any point. To earn and use the designation, you must submit verified documentation of five years of work experience in IS auditing, control, security, or assurance. That experience must fall within the 10 years before your application (ISACA experience requirements). ISACA grants waivers of up to three years in total (CISA application form, V5-0723):

• An associate degree — waives one year
• A bachelor's, master's or doctorate degree in any field — waives two years
• A master's degree in Information Systems or a related field — waives three years
• One year of general information-systems or general-audit work — waives one year

Because ISACA requires five verified years, the candidate pool is mid-career by construction: people who have been in IS audit, IT compliance, or IT risk roles for several years before they sit the exam. The credential is designed to validate experienced practitioners — not accelerate entry-level career changers.

Career Paths: Where Each Cert Takes You

After CySA+	After CISA
SOC Analyst (Tier 2/3)	IT Auditor / IS Audit Manager
Threat Intelligence Analyst	IT Risk Manager / GRC Manager
Incident Responder	Internal Audit Lead
Vulnerability Analyst	Compliance Director
Threat Hunter	CISO (in audit-focused organizations)
Security Operations Manager	IT Audit Partner (Big 4 consulting)

CySA+ roles are operational: you're working inside security products, writing detection rules, triaging alerts, and managing vulnerability remediation queues. CISA roles are assurance-oriented: you're planning and executing audits, interviewing control owners, reviewing documentation, and reporting findings to executive leadership and audit committees.

The career paths don't often converge at the junior level. They intersect at the senior management tier — where a CISO, for example, may need both the operational background CySA+ signals and the governance credibility CISA provides.

Salary Comparison (2026–27)

Both certifications sit in well-paid roles. In Robert Half's 2027 guide the IT Auditor band starts about $6,500 above the Cybersecurity Analyst band, a gap consistent with CISA's five-year experience requirement.

Role (Robert Half 2027)	Track	National Starting-Salary Range (US)
Cybersecurity Analyst	CySA+	$104,750–$151,500/yr
Cybersecurity Engineer	CySA+ → SecurityX	$120,750–$194,750/yr
Systems Security Manager	Either, at manager level	$144,500–$209,750/yr
IT Auditor (Technology)	CISA	$111,250–$155,250/yr

Role-level ranges are the national low–high starting-salary bands in the Robert Half Technology Salary Guide (2027 edition). The BLS reports a median of $129,180/yr for information security analysts (May 2025 OEWS, SOC 15-1212; mean $132,510), which aggregates all experience levels. All figures are US-based; actual compensation varies by geography, employer size, and experience level.

One important nuance: CISA's value comes from the roles it unlocks in audit firms, Big 4 advisory practices, financial institutions, and regulated industries. In pure technical security roles, CISA may carry less value than additional technical credentials like SecurityX (formerly CASP+) or CISSP.

Above analyst level the bands converge — Systems Security Manager ($144,500–$209,750) sits on either track — so the choice is about the work, not the paycheck.

Who Should Get CySA+

Get CySA+ next if you match this profile:

• You hold Security+ and work in an IT or security role. CySA+ is the most natural and recognized next step on the CompTIA certification ladder. It deepens your technical credibility and qualifies you for roles that require demonstrated ability to analyze threats, not just understand them conceptually.
• You work in or aspire to a SOC analyst role. CySA+ covers the exact skillset — SIEM analysis, vulnerability prioritization, incident response — that SOC Tier 2 and Tier 3 jobs require daily. CS0-004 adds AI-assisted operations, which is increasingly what modern SOC tooling looks like.
• You're targeting DoD or federal contractor roles. CySA+ is an approved DoD 8140 qualification for analyst work roles such as Cyber Defense Analyst (511) and Cyber Defense Incident Responder (531).
• You have 2–4 years of hands-on security or IT experience. You don't need the 4 years CompTIA recommends to prepare successfully, but the scenario-heavy CS0-004 questions are far easier to read if you've worked a queue of alerts or scan results.
• You want to stay on the technical track. If your goal is threat hunting, red/blue team work, or security engineering — not audit and compliance — CySA+ keeps you on the right path.

CySA+ is the right cert if you want to get better at doing security analysis. Our CompTIA Security+ study guide covers the prerequisite foundation; our Security+ vs CySA+ guide goes deeper on the transition between the two.

Security+ is the technical baseline most people hold before either of these certs. The standard CompTIA progression is Security+ → CySA+ → SecurityX, with CISA added years later only if you move into a risk, audit, or governance function. If you're weighing CISA directly against Security+ — experience requirements, cost, renewal — that side-by-side lives in our CISA vs CompTIA Security+ guide.

Who Should Get CISA

Get CISA if you match this profile:

• You already work in IT audit, GRC, or IT risk management. CISA validates skills you're using daily in those roles. It's the credential your employer's audit clients and regulators recognize as proof of professional competency.
• You have 3–5 years of relevant IS audit or IT control experience. Below that threshold, you can study for and pass the exam, but you won't meet ISACA's experience requirement to earn the designation — which makes the effort premature unless you're building toward it deliberately.
• You're in a regulated industry or federal work. CISA is an approved DoD 8140 qualification for the Security Control Assessor work role (612) under DoDM 8140.03, and the same assessor function sits inside financial-services and healthcare compliance programs.
• You're moving toward audit leadership or a CISO path. If your trajectory involves presenting to audit committees or managing third-party risk programs, CISA is the credential built for that work.
• You're pursuing Big 4 or management consulting advisory work. Those practices do IT audit and risk assurance for a living, which is exactly the work CISA's five domains describe.

Cost Comparison

Factor	CySA+ CS0-004	CISA
Exam Fee	See comptia.org (verify current price)	$575–$760 USD (ISACA, 2026)
ISACA membership (optional)	N/A	$145/yr base dues (ISACA); saves $185 on the exam fee
Study materials	Professor Messer (free), CompTIA study guide	ISACA CISA Review Manual ($109 member / $139 non-member; ISACA Store)
Renewal cost	$150 CE fee per 3-year cycle (not billed annually) + 60 CEUs, or CertMaster CE (CompTIA CE fees)	$45/yr maintenance fee (ISACA member) + 20 CPE hrs/yr (ISACA)

CISA is the bigger financial commitment up front: a $575–$760 exam fee, then $45–$85 a year in maintenance plus optional membership dues for as long as you hold it. That said, if audit and risk is the career you want, CISA is the credential those roles ask for, and the cost is small against a starting band that begins above $111K.

FAQ

Is CISA a CompTIA certification?

No. CISA is issued by ISACA, not CompTIA; CompTIA's similar-sounding credential is CySA+ — see the section right after the comparison table above.

Is CISA harder than CySA+?

They're hard in different ways, which is why the CISA vs CySA+ question has no single answer. CySA+ requires applied technical analysis — interpreting logs, correlating SIEM data, responding to scenarios that require operational knowledge. CISA requires governance and audit reasoning — thinking like an auditor who evaluates control adequacy, not an analyst who runs the controls. Neither is objectively harder — they test different skill sets.

Does CISA expire?

CISA requires ongoing annual maintenance: 20 Continuing Professional Education (CPE) hours per year (120 CPE over each three-year reporting period), plus an annual maintenance fee ($45 for ISACA members, $85 for non-members as of 2026). Source: ISACA. Failure to maintain CPE hours results in suspension of the certification. This contrasts with CySA+, which renews every three years with 60 CEUs and a single $150 CE fee per cycle.

Should I get CySA+ before CISA?

Not necessarily — and for many CISA candidates, CySA+ is irrelevant to their career path. If you're in IT audit or risk management, CySA+ doesn't directly validate audit skills; it validates threat analysis skills. If you're in a technical security role and considering CISA later as you move toward a governance or CISO track, then yes — Security+ → CySA+ is the right technical foundation to build first. Add CISA when your role demands audit credibility. The reverse holds too: you don't need Security+ to sit CISA — the two are independent certifications from different vendors with no prerequisite link (see our Security+ vs CySA+ guide for the technical track).

Which is better for DoD or federal contracting?

It depends on the specific work role. DoDM 8140.03 replaced DoD 8570.01-M in February 2023, so qualifications are now mapped to DCWF work roles rather than IAT levels. CySA+ is approved for analyst roles such as Cyber Defense Analyst (511), Cyber Defense Incident Responder (531) and Vulnerability Assessment Analyst (541) — the SOC positions on federal contracts. CISA is approved for Security Control Assessor (612), an audit and assessment function. Always verify the exact work-role requirement in the position description before choosing.

What comes after CySA+ on the technical path?

CompTIA SecurityX (formerly CASP+) is the next step for experienced technical professionals. Above SecurityX, many professionals pursue CISSP (ISC²) for broader security leadership credibility. See our IT certification study guide for a framework on building a multi-certification study plan efficiently.

Start Practicing Today — Free

If the CySA+ vs CISA decision has led you toward the technical track, building a strong Security+ foundation is the first step. Our free SY0-701 practice test covers all five Security+ domains with detailed explanations for every answer. No account required, no credit card, results stay in your browser.

If CISA is the right path for you, your first step is verifying you meet ISACA's experience requirements — then registering for the exam through ISACA's official CISA certification page. ISACA membership ($145/yr standard professional rate) saves $185 on the exam fee and provides access to their study resources.

Browse our full certification guide library for exam-specific prep resources across CompTIA, AWS, Azure, and Cisco paths. Our guide to active recall and spaced repetition covers how to structure a multi-certification study schedule for both the CySA+ and the CISA exam.

Related reading

• CySA+ vs Security+: Which CompTIA Cert to Take First? (2026)
• CISA vs CompTIA Security+: Which Certification First? (2026)
• CompTIA Security+ SY0-701 Study Guide (2026)
• How to Study for IT Certification Exams (Active Recall + Spaced Repetition)