CISA renewal: a practical CPE and evidence tracker

Understand the two time horizons

ISACA’s CISA maintenance page currently specifies a minimum of 20 continuing professional education hours annually and 120 over a three-year reporting period. Meeting the three-year total does not remove the annual requirement. Record both in your tracker rather than monitoring only one combined number.

Also check the other maintenance obligations, including applicable fees, professional conduct and audit requirements. A membership payment, training purchase or event registration should not be assumed to complete certification maintenance. Your account and the current policy determine the actions you must take.

Keep an activity-level evidence register

Use one row for each completed activity. Record the date, organiser, title, description, hours claimed, relevant certification and evidence location. Add a reporting status such as evidence collected, submitted or applied to certification. This separates your private notes from the issuer’s official record.

Keep attendance or completion evidence when it is supplied. An invoice proves a purchase, not necessarily participation or completion. If a course contains material only partly relevant to your certification, check the policy rather than automatically reporting its whole advertised duration.

A small reconciliation example

Illustrative situation: your tracker shows four completed activities worth 8,6,5 and 4 hours. The total is 23, but the official account shows only 17 applied hours because the 6-hour activity remains unapplied. Comparing the two records reveals a reporting task rather than a learning shortfall. Check the evidence and apply the record through the official process if it is eligible.

A second check compares annual and cycle totals. Earning a large total in one year does not remove the minimum required in another year. Keep a row for each calendar year and a separate view of the three-year cycle, and distinguish credits earned from credits accepted for the credential.

Confirm that recorded hours are applied

ISACA’s maintenance page explains that some activities can appear in an account as unapplied hours. Verify their application to the relevant credential rather than assuming that a visible event has already satisfied the requirement. Other activities may need to be reported manually.

For multiple credentials, assess relevance to each separately. The same professional activity may be usable for more than one ISACA credential when it meets the applicable requirements. That is different from duplicating a single activity within the same credential’s record.

What changes in January2027

The announced policy keeps a 120-CPE three-year requirement, while requiring at least 90 CPE aligned to the credential’s outline or domains and allowing up to 30 for other professional development. Category limits still matter. ISACA states that no system changes occur in the 2026 cycle.

For a learning plan spanning the transition, label activities by completion and reporting year, direct domain relevance and category. Do not count an unrelated activity as credential-aligned simply because it was professionally useful. Review the published transition guidance when planning volunteering, mentoring or other activities whose treatment can differ.

Prepare for a policy transition

ISACA has announced CPE policy changes effective 1 January 2027. Keep activities associated with the correct reporting year and read the updated policy before planning a later cycle. Do not retroactively interpret every earlier activity using a summary of future rules.

A useful review asks whether the activity relates directly to the certification domains, whether a category limit applies and which evidence supports the claim. If the transition affects a planned activity, resolve the question before paying for it solely for renewal purposes.

CISA renewal questions

Does an ISACA event appear automatically in my final total? Some hours can appear as unapplied records. Confirm application to the relevant credential. Do I need evidence for a free activity? The cost does not determine whether evidence is needed; retain the completion or participation record.

Does paying membership renew CISA? Membership and certification maintenance are separate. Follow the certification account’s actions, including applicable maintenance fees. Can the same activity count toward another ISACA credential? Only when it satisfies the relevance and policy requirements for that credential too.

Keep enough evidence to identify the participant, organiser, activity, date, description and hours. Store it securely and follow ISACA’s retention requirements. A well-kept record helps you answer an audit accurately; it is not permission to report estimated attendance or duplicate activity.