CISA Study Guide 2026

The ERM framework and IT risk register document the organization's identified risks, their likelihood and impact, and existing mitigations — making them the primary source for risk-based audit planning.

Data sovereignty means that data stored in a particular country is governed by that country's laws and regulations.

Key Risk Indicators (KRIs) are metrics used to provide an early warning of increasing risk exposures in various areas of the enterprise. They are forward-looking and designed to alert management before a risk materializes into a loss event, allowing for proactive risk mitigation.

Row-count limits on query results and DLP controls detect and restrict bulk data extraction, targeting the exfiltration method directly.

The ISACA Code of Professional Ethics outlines the mandatory standards of professional conduct for all ISACA members and certification holders. A violation of this code can lead to disciplinary actions, with the most severe consequence for certified individuals being the suspension or revocation of their ISACA certifications, such as CISA. This ensures the integrity and credibility of the ISACA professional community.

Just-in-time (JIT) privileged access minimizes the attack surface by granting elevated rights only when needed and for a limited time, with full audit logging.