Leanpub Header

Skip to main content
Go to Leanpub.com

CISA: The Last Mile

Your guide to the finish line

Pete Zerger

This book covers every topic in the latest CISA exam syllabus, approaching topics from the ISACA perspective. It's 400+ pages, organized in a format following the syllabus that makes it easy to drill down on specific exam domains and concepts at-a-glance, making it an essential exam resource for anyone who aims to prepare for the CISA exam without wasting time or money.

Minimum price

$9.99

$14.99

You pay

$14.99

Author earns

$11.99
$

...Or Buy With Credits!

You can get credits with a paid monthly or annual Reader Membership, or you can buy them here.
PDF
EPUB
About

About

About the Book

This book covers every topic in the latest CISA exam syllabus, approaching topics from the ISACA perspective. It's 400+ pages, organized in a format following the syllabus that makes it easy to drill down on specific exam domains and concepts at-a-glance, making it an essential exam resource for anyone who aims to prepare for the CISA exam without wasting time or money.

Share this book

Categories

Computer Security

Feedback

Email the Author

Author

About the Author

Pete Zerger
Leanpub Podcast

Episode 305

An Interview with Pete Zerger

Contents

Table of Contents

Preface

  1. Legend
  2. The CISA Mindset
  3. Think the “ISACA Way“

Domain 1A: IS Auditing Process - Planning

  1. 1A1. IS Audit Standards, Guidelines, and Codes of Ethics
  2. ISACA IS Audit and Assurance Standards
  3. ISACA IS Audit and Assurance Guidelines
  4. ISACA Code of Professional Ethics
  5. ITAF (IT Audit Framework)
  6. IS Internal Audit Function
  7. 1A2. Types of Audits, Assessments, and Reviews
  8. Control Self-Assessment (CSA)
  9. Integrated Auditing
  10. 1A3. Risk-Based Audit Planning
  11. Individual Audit Assignments
  12. Effect of Laws and Regulations on IS Audit Planning
  13. Audit Risk and Materiality
  14. Risk Assessment
  15. IS Audit Risk Assessment Techniques
  16. Risk Analysis
  17. 1A4. Types of Controls and Considerations
  18. Internal Controls
  19. Control Objectives and Control Measures
  20. Control Classifications
  21. Control Relationship to Risk
  22. Prescriptive Controls and Frameworks
  23. Evaluation of the Control Environment

Domain 1B: IS Auditing Process - Execution

  1. 1B1. Audit Project Management
  2. Audit Objectives
  3. Audit Phases
  4. Audit Programs
  5. Audit Work Papers
  6. Fraud, Irregularities, and Illegal Acts
  7. Agile Auditing
  8. 1B2. Audit Testing and Sampling Methodology
  9. Compliance Versus Substantive Testing
  10. Sampling
  11. 1B3. Audit Evidence Collection Techniques
  12. Interviewing and Observing Personnel in Performance of Their Duties
  13. 1B4. Audit Data Analytics
  14. Computer-Assisted Audit Techniques
  15. Continuous Auditing and Monitoring
  16. Continuous Auditing Techniques
  17. Artificial Intelligence in IS Audit
  18. 1B5. Reporting and Communication Techniques
  19. Communicating Audit Results
  20. Audit Report Objectives
  21. Audit Report Structure and Contents
  22. Audit Documentation
  23. Follow-Up Activities
  24. Types of IS Audit Reports
  25. 1B6. Quality Assurance and Improvement of Audit Process
  26. Audit Committee Oversight
  27. Audit Quality Assurance
  28. Audit Team Training and Development
  29. Monitoring

Domain 2A: IT Governance

  1. 2A1. Laws, Regulations, and Industry Standards
  2. Impact of Laws, Regulations, and Industry Standards on IS Audit
  3. Governance, Risk, and Compliance (GRC)
  4. 2A2. Organizational Structure, IT Governance, and IT Strategy
  5. Enterprise Governance of Information and Technology (EGIT)
  6. Good Practices for EGIT
  7. Audit’s Role in EGIT
  8. Information Security Governance
  9. Information Systems Strategy
  10. Strategic Planning
  11. Business Intelligence
  12. Organizational Structure
  13. Auditing IT Governance Structure and Implementation
  14. 2A3. IT Policies, Standards, Procedures, and Guidelines
  15. Policies
  16. Standards
  17. Procedures
  18. Guidelines
  19. 2A4. Enterprise Architecture and Considerations
  20. IT Sourcing Practices
  21. 2A5. Enterprise Risk Management (ERM)
  22. Developing a Risk Management Program
  23. Risk Management Life Cycle
  24. Risk Analysis Methods
  25. 2A6. Data Privacy Program and Principles
  26. Privacy Documentation
  27. Audit Process
  28. 2A7. Data Governance and Classification
  29. Data Classification
  30. Legal Purpose, Consent, and Legitimate Interest
  31. Data Subject Rights and Transborder Data Flow

Domain 2B: IT Management

  1. 2B1. IT Resource Management
  2. Value of IT
  3. IT Portfolio Management
  4. IT Management Practices
  5. Human Resource Management
  6. Enterprise Change Management
  7. Financial Management Practices
  8. Information Security Management
  9. 2B2. IT Vendor Management
  10. Sourcing Practices
  11. Outsourcing Practices and Strategies
  12. Cloud Governance
  13. Governance in Outsourcing
  14. Capacity and Growth Planning
  15. Third-Party Service Delivery Management
  16. 2B3. IT Performance Monitoring and Reporting
  17. Key Performance Indicators (KPIs)
  18. Key Risk Indicators (KRIs)
  19. Key Control Indicators (KCIs)
  20. Performance Optimization
  21. Approaches and Techniques
  22. 2B4. Quality Assurance and Quality Management of IT
  23. Quality Assurance
  24. Quality Management
  25. Operational Excellence

Domain 3A: Information Systems Acquisition and Development

  1. 3A1. Project Governance and Management
  2. Project Management Practices
  3. Project Management Organizational Structures
  4. Project Management Roles and Responsibilities
  5. Project Management Techniques
  6. Portfolio and Program Management
  7. Project Management Office (PMO)
  8. Project Benefits Realization
  9. Project Initiation
  10. Project Objectives
  11. Project Planning
  12. Project Execution
  13. Project Monitoring and Controlling
  14. Project Closing
  15. IS Auditor’s Role in Project Management
  16. 3A2. Business Case and Feasibility Analysis
  17. Components of Feasibility Analysis
  18. IS Auditor’s Role in Business Case Development
  19. 3A3. System Development Methodologies
  20. Business Application Development
  21. SDLC Models
  22. SDLC Phases
  23. IS Auditor’s Role in SDLC Project Management
  24. Software Development Methods
  25. System Development Tools and Productivity Aids
  26. Infrastructure Development and Acquisition
  27. Hardware and Software Acquisition
  28. System Software Acquisition
  29. 3A4. Control Identification and Design
  30. Application Controls
  31. Output Controls

Domain 3B: Information Systems Implementation

  1. 3B1. System Readiness and Implementation Testing
  2. Testing Classifications
  3. Software Testing
  4. Data Integrity Testing
  5. Application System Testing
  6. System Implementation
  7. 3B2. Implementation Configuration and Release Management
  8. Configuration Management Systems
  9. 3B3. System Migration, Infrastructure Deployment, and Data Conversion
  10. Data Migration
  11. Changeover (Go-Live or Cutover) Techniques
  12. System Change Procedures and the Program Maintenance Phase
  13. System Software Implementation
  14. Certification and Accreditation
  15. 3B4. Post-Implementation Review
  16. IS Auditor’s Role in Post-Implementation Review

Domain 4A: Information Systems Operations

  1. 4A1. IT Components
  2. Networking
  3. Computer Hardware Components and Architectures
  4. Common Enterprise Back-End Devices
  5. USB Mass Storage Devices
  6. Wireless Communication Technologies
  7. Hardware Maintenance Program
  8. Hardware Failures
  9. 4A2. IT Asset Management
  10. 4A3. Job Scheduling and Production Process Automation
  11. Job Scheduling Software
  12. Scheduling Reviews
  13. 4A4. System Interfaces
  14. Risks Associated With System Interfaces
  15. Controls Associated With System Interfaces
  16. 4A5. End-User Computing and Shadow IT
  17. End-User Computing
  18. Shadow IT
  19. 4A6. Systems Availability and Capacity Management
  20. IS Architecture and Software
  21. Operating System Features and Integrity
  22. Access Control Software
  23. Data Communications Software
  24. Utility Programs
  25. Software Licensing
  26. Source Code Management
  27. Capacity Management
  28. Resilience Metrics: RTO and RPO
  29. 4A7. Problem and Incident Management
  30. Problem Management
  31. Incident Management
  32. Detection, Documentation and Resolution of Abnormal Conditions
  33. Help Desk
  34. Network Management Tools
  35. Problem Management Reporting Reviews
  36. 4A8. IT Change, Configuration and Patch Management
  37. Configuration Management
  38. Change Management Process
  39. Patch and Release Management
  40. 4A9. Operational Log Management
  41. Types of Logs
  42. Log Management
  43. 4A10. IT Service Level Management
  44. Service Level Agreements
  45. Monitoring of Service Levels
  46. Service Levels and Enterprise Architecture
  47. 4A11. Database Management
  48. DBMS Architecture
  49. Database Structure Models
  50. Database Controls
  51. Database Reviews

Domain 4B: Business Resilience

  1. 4B1. Business Impact Analysis (BIA)
  2. Classification of Operations and Criticality Analysis
  3. 4B2. System and Operational Resilience
  4. Application Resiliency and Disaster Recovery Methods
  5. Telecommunication Network Resiliency and Disaster Recovery Methods
  6. 4B3. Data Backup, Storage and Restoration
  7. Data Storage Resiliency and Disaster Recovery Methods
  8. Backup and Restoration
  9. Backup Schemes
  10. 4B4. Business Continuity Plan (BCP)
  11. IT Business Continuity Planning
  12. Disasters and Disruptive Events
  13. Business Continuity Planning Process
  14. Business Continuity Policy
  15. Incident Management
  16. Development of Business Continuity Plans
  17. Plan Development Issues
  18. Components of a Business Continuity Plan
  19. Plan Testing
  20. Business Continuity Maintenance
  21. Auditing Business Continuity
  22. 4B5. Disaster Recovery Plans (DRP)
  23. Recovery Objectives and Metrics
  24. Recovery Strategies
  25. Recovery Site Alternatives
  26. DRP Development
  27. DRP Testing

Domain 5A: Protection of Information Assets

  1. 5A1. Information Asset Security Policies, Frameworks, Standards and Guidelines
  2. Information Asset Security Policies, Procedures and Guidelines
  3. Information Security Frameworks and Standards
  4. Information Security Baselines
  5. 5A2. Physical and Environmental Controls
  6. Environmental Exposures and Controls
  7. IS Auditor Focus
  8. Physical Access Exposures and Controls
  9. Industrial Control Systems Security
  10. 5A3. Identity and Access Management
  11. Identity and Access Management
  12. Authentication, Authorization and Accountability
  13. Zero-Trust Architecture
  14. Privileged Access Management
  15. Directory Services
  16. Identity Governance and Administration
  17. Identity as a Service
  18. System Access Permission
  19. Types of Access Controls
  20. Information Security and External Parties
  21. Digital Rights Management
  22. Logical Access
  23. Access Control Software
  24. Logon IDs and Passwords
  25. Remote Access Security
  26. Biometrics
  27. Naming Conventions for Logical Access Controls
  28. Federated Identity Management
  29. Auditing Logical Access
  30. 5A4. Network and Endpoint Security
  31. IS Network Infrastructure
  32. Enterprise Network Architectures
  33. Types of Networks
  34. Common Network Types
  35. Network Services
  36. Network Standards and Protocols
  37. Virtual Private Networks
  38. Network Attached Storage
  39. Content Delivery Networks
  40. Network Time Protocol
  41. Applications in a Networked Environment
  42. Network Infrastructure Security
  43. Firewalls
  44. Unified Threat Management
  45. Network Segmentation
  46. Endpoint Security
  47. 5A5. Data Loss Prevention
  48. Types of DLP
  49. Data Loss Risk
  50. DLP Solutions and Data States
  51. DLP Controls
  52. DLP Content Analysis Methods
  53. DLP Deployment Best Practices
  54. DLP Risk, Limitations and Considerations
  55. 5A6. Data Encryption
  56. Elements of Encryption Systems
  57. Link Encryption and End-to-End Encryption
  58. Symmetric Key Cryptographic Systems
  59. Public (Asymmetric) Key Cryptographic Systems
  60. Hash Functions
  61. Elliptic Curve Cryptography
  62. Quantum Cryptography
  63. Homomorphic Encryption
  64. Digital Signatures
  65. Digital Envelope
  66. Applications of Cryptographic Systems
  67. Kerberos
  68. Secure Shell
  69. Domain Name System Security Extensions
  70. Email Security
  71. Encryption Audit Procedures
  72. 5A7. Public Key Infrastructure
  73. Digital Certificates
  74. Key Management
  75. Certificate Revocation
  76. Certificate Revocation List
  77. PKI Infrastructure Risk
  78. Audit Procedures for PKI
  79. 5A8. Cloud and Virtualized Environments
  80. Virtualization
  81. Virtual Circuits
  82. Virtual Local Area Network
  83. Virtual Storage Area Networks (VSANs)
  84. Software-Defined Networking
  85. Containerization
  86. Secure Cloud Migration
  87. The Shared Responsibility Model
  88. Key Risk in Cloud Environments
  89. DevSecOps
  90. 5A9. Mobile, Wireless, and Internet of Things Devices
  91. Mobile Computing
  92. Mobile Device Threats
  93. Mobile Device Controls
  94. Mobile Device Management
  95. Bring Your Own Device
  96. Internet Access on Mobile Devices
  97. Audit Procedures for Mobile Devices
  98. Mobile Payment Systems
  99. Wireless Networks
  100. Internet of Things (IoT)

Domain 5B: Security Event Management

  1. 5B1. Security Awareness Training and Programs
  2. The Information Security Learning Continuum
  3. Benefits of a Security Awareness, Training and Education Program
  4. Approach to Security Awareness, Training and Education
  5. Conditions for a Successful Security Awareness Training and Education Program
  6. Conducting a Needs Assessment
  7. Implementing an Awareness and Training Program
  8. 5B2. Information System Attack Methods and Techniques
  9. Fraud Risk Factors
  10. Computer Crime Issues and Exposures
  11. Internet Threats and Security
  12. Malware
  13. Ransomware
  14. 5B3. Security Testing Tools and Techniques
  15. Security Testing Objectives
  16. Security Assessments vs Security Audits
  17. Vulnerability Assessments
  18. Penetration Testing
  19. Threat Readiness (Information Security Teams)
  20. Security Testing Techniques
  21. Security Operations Center (SOC)
  22. Full Network Assessment Reviews
  23. Security Testing Audit Procedures
  24. 5B4. Security Monitoring Tools and Techniques
  25. Information Security Monitoring
  26. Intrusion Detection Systems
  27. Intrusion Prevention Systems
  28. Audit Logging in Monitoring System Access
  29. Protecting Log Data
  30. Security Information and Event Management (SIEM)
  31. 5B5. Security Incident Response Management
  32. Incident Response Process
  33. Computer Security Incident Response Team
  34. Incident Response Plan
  35. Security Orchestration, Automation and Response
  36. Types of Investigations
  37. Types of Computer Forensics
  38. Phases of Computer Forensics
  39. Audit Considerations
  40. Computer Forensic Techniques
  41. Computer Forensics Tools
  42. Chain of Custody
  43. Best Practices to Secure Digital Evidence

The Leanpub 60 Day 100% Happiness Guarantee

Within 60 days of purchase you can get a 100% refund on any Leanpub purchase, in two clicks.

Now, this is technically risky for us, since you'll have the book or course files either way. But we're so confident in our products and services, and in our authors and readers, that we're happy to offer a full money back guarantee for everything we sell.

You can only find out how good something is by trying it, and because of our 100% money back guarantee there's literally no risk to do so!

So, there's no reason not to click the Add to Cart button, is there?

See full terms...

Earn $8 on a $10 Purchase, and $16 on a $20 Purchase

We pay 80% royalties on purchases of $7.99 or more, and 80% royalties minus a 50 cent flat fee on purchases between $0.99 and $7.98. You earn $8 on a $10 sale, and $16 on a $20 sale. So, if we sell 5000 non-refunded copies of your book for $20, you'll earn $80,000.

(Yes, some authors have already earned much more than that on Leanpub.)

In fact, authors have earned over $14 million writing, publishing and selling on Leanpub.

Learn more about writing on Leanpub

Free Updates. DRM Free.

If you buy a Leanpub book, you get free updates for as long as the author updates the book! Many authors use Leanpub to publish their books in-progress, while they are writing them. All readers get free updates, regardless of when they bought the book or how much they paid (including free).

Most Leanpub books are available in PDF (for computers) and EPUB (for phones, tablets and Kindle). The formats that a book includes are shown at the top right corner of this page.

Finally, Leanpub books don't have any DRM copy-protection nonsense, so you can easily read them on any supported device.

Learn more about Leanpub's ebook formats and where to read them

Write and Publish on Leanpub

You can use Leanpub to easily write, publish and sell in-progress and completed ebooks and online courses!

Leanpub is a powerful platform for serious authors, combining a simple, elegant writing and publishing workflow with a store focused on selling in-progress ebooks.

Leanpub is a magical typewriter for authors: just write in plain text, and to publish your ebook, just click a button. (Or, if you are producing your ebook your own way, you can even upload your own PDF and/or EPUB files and then publish with one click!) It really is that easy.

Learn more about writing on Leanpub