There are different certifications issued by the professional association ISACA. These certifications have a limited validity period that, nevertheless, can be extended. This post summarizes ways to maintain and renew ISACA certifications.
The post tries to generalize the common validity requirements of these ISACA certifications:
Frequently Asked Questions
What is the validity period of an ISACA Certification?
Continuing Professional Education (CPE) policy determines that certain CPE hours must be completed and reported in a periodical basis to keep an ISACA Certification.
An ISACA Certification is revoked if:
- Required CPE’s are not completed or reported annually
- ISACA’s IT audit Standards or Code of Professional Ethics are not followed.
- Annual membership fee is not paid
- If selected for the annual audit, required documentation of CPE activities are not submitted
Requirements regarding CPE hours:
- Earn and report an annual minimum of CPE hours. These hours must be appropriate to the currency or advancement of the ISACA certificate’s knowledge or ability to perform certificate-related tasks.
- Earn and report a minimum of CPE hours for a three-year reporting cycle period.
- Some ISACA certifications (like CSX-P or CET) restrict the type of theoretical/practical content of the CPE hours
Requirements per ISACA Certification:
|ISACA Cert.||Annual CPE hours||3-year CPE hours||Comments|
|5||CSX-P||20||120||Of the 20 annually required CPE hours, a minimum of 10 hours must be attained by participating in skills-based training/labsOf the 120 3-year required CPE hours, a minimum of 30 CPEs must be skills-based training/lab activities|
|8||CET||20||120||Of the 20 annually required CPE hours, a minimum of 10 hours must be attained by participating in skills-based training/labsOf the 120 3-year required CPE hours, a minimum of 30 CPEs must be skills-based training/lab activities|
CPE reporting is due by the end of each calendar year (i.e., 31 December of each year).
Do I need to apply CPE hours the first year I get a certification?
No, you do not need to apply CPE hours on the first year you get a certification. The CPE requirements and the 3-year period will start the following year.
If you earn ISACA CPE hours on a year you do not need to use them, you can keep them and apply them the year you need them.
How do I earn CPE hours?
Ways to get CPE hours:
- Getting free CPE available to ISACA members. Some “free” CPE implies working for ISACA.
- Attending ISACA’s webinars and virtual conferences
- Attending ISACA’s training courses
- Participate and volunteer with ISACA, what may include becoming an Exam Item Writer
- Attend a conference
- Complete Journal Quizzes
- Perform online training
- Pass ISACA’s certificate or certifications exams
You can find more information in the official web about how to earn CPE hours.
Examples of CPE hours
CISM exam pass: 8 CPE hours
CISA exam pass: 8 CPE hours
CSX-F exam pass: 4 CPE hours
Attending a 3-hour ISACA local chapter webinar: 3 CPE hours
I have many ISACA Certifications. Do I need to get CPEs separately for each of them?
As stated in the CPE Policies, the use of CPE hours towards meeting the CPE requirements for multiple ISACA certifications is permissible when the professional activity is applicable to satisfying the job-related knowledge of each certification.
The best approach would be to find CPE that apply to all or most certificates; in this case, you will not need an extra effort to maintain your certificates.
When you submit a CPE, you do not choose to which certificate it goes, so it will go to your membership. So in case you have more that an ISACA Certfication (e.g., CISA, CISM, CRISP, etc.), a CPE is applied to your certificate, it means, to all the certificates at the same time.
How do I check CPE hours?
There are different on MyISACA where you can check CPE hours:
- Log in on isaca.org > Got to “MyISACA”> Click on “Certifications“
- Log in on isaca.org > Go to “MyISACA” > “Report and Manage CPE“
“Certifications & CPE Management” screen has a breakdown of all certificates you have, CPE’s applied for the current year and CPE’s applying for the 3-year. It will confirm also the year range spanning the 3-year period.
I prefer to use this screen to check my current CPE status, as it is the most clear. Unfortunately, you cannot use this screen to report CPE, as it is just a report.
“Report and Manage CPE” screen do not contain a breakdown of the certificates you own, so it is more difficult to understand. However, it provides a clearer view of ISACA CPE that has not been yet applied and it is the only one where you can report or apply CPE hours.
How do I register/report CPE hours?
The only screen where you can register/report CPE hours is:
- Log in on isaca.org > Go to “MyISACA” > “Report and Manage CPE“
There are two types of CPE:
- CPE Earned through ISACA
- CPE Earned through other vendors
CPE hours earned through ISACA (e.g., local chapter webinars, ISACA certifications, etc.) are usually registered automatically on your profile with the status “Unapplied CPE Earned through ISACA” and listed in this category in “Report and Manage CPE”. Click on “Apply” to apply them to the current year. Then enter the hours of CPE hours (usually, it would be the maximum hours allowed).
In case it is not automatically registered, you may add it manually in the same way as a CPE from a non-ISACA vendor, selecting as Activity “ISACA professional education activities” or “ISACA professional education skill-based activities (Must Contain Lab Exercises)”.
The ISACA CPE records you obtained can be found and their certificates downloaded in “MyISACA”> “CPE Certifcates“.
If the ISACA event was organized by your local chapters, CPE certificate may have been received by e-mail.
CPE earned through non-ISACA vendors require a different process. On the “Report and Manage CPE” screen, click on “Add new CPE record to current cycle”.
Then you need to complete:
- Sponsoring Organization
- Start Date
- End Date
- Qualifying Activity: there is a dropdown list with possible values
- Method of Delivery: in person, by mail or online.
In case of audit, ISACA will ask you to provide a prove that you got a CPE; be sure you keep a copy of diplomas that give evidence of the earned CPE hours. Non-ISACA vendors sometimes give diplomas where the CPE hours are stated. In case of ISACA CPE, they can be downloaded from “MyISACA” > “CPE Certifcates“, as informed before.
You can find more information in the official web about how to report CPE hours.
There are CPE hours from previous years that I have not applied. It I apply them during the current year, on which year will it be applied?
When an ISACA CPE is applied, it will be applied to the current year, regardless of when the CPE was obtained.
This is why it is advisable to apply first non-ISACA CPE hours and keep unused ISACA CPE hours for next years.
How do I know if a non-ISACA education can be posted as CPE, and to how many hours correspond?
Check section “Calculating CPE Hours” in CPE Policies.
What is the cost of maintaining an ISACA certification?
If you are a student and get all CPEs for free (what is quite unexpected), you could maintain an ISACA certification with $25/year; that would be the minimum fee. But in most cases, maintaining an ISACA certification will probably cost you hundreds of dollars per year.
The costs of maintaining an ISACA certification depends on the following concepts:
- ISACA membership annual fee
- Cost of CPE obtained
As owning an ISACA certification requires to be an ISACA member, you need to pay an annual membership fee. The standard annual fee was of $135 in 2021, though there were reduced rates for recent graduates ($68) and students ($25). You may need to apply an additional fee for your local chapter; for example, standard Madrid chapter renewal fee was $70 in 2021.
CPE costs are variable. Take into account that you need to pay to get some CPEs (in the concept course fees, etc.), while others are for free (free webinars imparted by local chapters, ISACA voluteering, etc.). So the final cost of each CPE depends on how did you get CPE hours.
This ISACA post details much of the related costs.
What if I no longer work on the certification field?
It may happen that you no longer work on the certification field either because you changed your career path, stopped working or retired. In these cases, if you want to avoid revocation you can apply for the corresponding special status for each ISACA certification you won:
- Retired Status
- Nonpracticing Status
Nevertheless, you need to keep paying the annual membership fee to keep this status.
You need to submit the corresponding retired or nonpracticing form before 15 January.
What can I do if my certification has been revoked and I want to recover it?
If your certification has been revoked, there is a certification reinstatement process. The reinstatement fee is US$50.
For additional details, check this link and go to section “Revoked status”.