Cybersecurity training for ISACA CPE self-reporting
Looking for CISA, CISM or CRISC CPE? Complete qualifying CFISA self-paced cybersecurity training, receive a Certificate of Completion documenting CPE hours, and self-report those hours toward applicable ISACA credentials.
ISACA recognizes qualifying non-ISACA professional education and structured self-study as potential Continuing Professional Education (CPE). For structured self-study, ISACA states that the course provider must issue a Certificate of Completion that includes the number of CPE hours earned.
CFISA calculates CPE from instructional time using ISACA’s published 50-minute CPE standard and quarter-hour reporting increments. Certification holders remain responsible for determining whether an activity applies to their certification and for self-reporting eligible hours.
Reviewed September 2026 Based on current ISACA CPE guidance and Exam Content Outlines Mapping review scheduled after the CISM outline update effective November 3, 2026
CPE hours by course.
CPE values are calculated from the instructional runtime of the current 2026 course versions using ISACA’s published 50-minute standard and nearest-quarter-hour reporting method.
CPE hours
13 lessons · Approximately 1 hour 12 minutes of instructional content.
CPE hours
18 lessons · Approximately 1 hour 37 minutes of instructional content.
CPE hours
15 lessons · Approximately 1 hour 28 minutes of instructional content, including Texas-specific requirements.
CPE hours
14 lessons · Approximately 1 hour 22 minutes of instructional content.
CPE hours
19 lessons · Approximately 1 hour 48 minutes of instructional content.
Compare the training.
Review Security Awareness Training curriculum, course options, completion records, reporting, and delivery.
Explore Security Awareness Training →Strong alignment with CISA, CISM and CRISC.
CFISA maps its cybersecurity curriculum to the publicly available ISACA Exam Content Outlines. The mapping helps certification holders evaluate whether completed coursework is relevant to the certification they maintain.
CISA
Primary alignment is concentrated in Domain 5, Protection of Information Assets, including Security Awareness Training and Programs, information-system attack methods, physical controls, identity and access management, network and endpoint security, mobile and IoT security, data protection, and security incident response.
CISM
CFISA content aligns principally with Domain 2, Information Security Risk Management; Domain 3, Information Security Program, including Information Security Awareness and Training; and Domain 4, Incident Management.
CRISC
Primary alignment includes threat and vulnerability concepts plus Domain 4, Technology and Security, where ISACA specifically includes Security/Risk Awareness and Training, data protection, data lifecycle management, incidents, and emerging technologies.
Security Awareness Training – Essentials.
The current Essentials course contains 13 lessons and approximately 1 hour 12 minutes of instructional content. The mapping below identifies the strongest CISA, CISM and CRISC domain relationships for each lesson.
CFISA’s mapping is an instructional-content crosswalk based on ISACA’s published Exam Content Outlines. It does not represent ISACA approval or a guarantee that ISACA will accept a specific activity for a particular credential.
Why Security Awareness Matters to You
CISA: Domain 5, Security Awareness Training and Programs · CISM: Domain 3, Information Security Program · CRISC: Domain 4, Security/Risk Awareness and Training
Threats, Threat Actors, and Their Motivations
CISA: Domain 5, Information System Attack Methods and Techniques · CISM: Domain 2, Emerging Risk and Threat Landscape · CRISC: Risk assessment plus Domain 4 technology and security
Classifying and Locating the Information You Protect
CISA: Domain 5, protection of information assets and data-loss prevention · CISM: Domain 3, Information Asset Identification and Classification · CRISC: Domain 4, Data Lifecycle Management and data protection
Social Engineering: Manipulation Tactics and Red Flags
CISA: Domain 5, attack methods and security awareness · CISM: Domains 2 and 3, threat landscape and security awareness · CRISC: threats and vulnerabilities plus security/risk awareness
Phishing, Spear Phishing, and Quishing Attacks
CISA: Domain 5, attack methods and awareness · CISM: Domains 2 and 3, emerging threats and awareness training · CRISC: threat identification and security/risk awareness
Business Email Compromise: Recognizing and Stopping BEC
CISA: Domain 5, attack methods and security awareness · CISM: Domains 2 and 3, threat landscape and awareness · CRISC: threats, vulnerabilities, and risk-aware behavior
Passwords, Passphrases, and Multi-Factor Authentication
CISA: Domain 5, Identity and Access Management · CISM: Domain 3, information-security controls and awareness · CRISC: Domain 4, information-security principles and controls
Protecting Your Workspace and Securing Physical Access
CISA: Domain 5, Physical and Environmental Controls · CISM: Domain 3, security-control implementation and awareness · CRISC: Domain 4, information-security principles
Secure Storage, Disposal, Sanitization, and Record Retention
CISA: Domain 5, information-asset protection and data-loss prevention · CISM: Domain 3, asset classification and controls · CRISC: Domain 4, Data Lifecycle Management and data protection
Remote Work, Travel Security, and Public Wi-Fi Risk
CISA: Domain 5, network, endpoint, mobile, and wireless security · CISM: Domains 2 and 3, threat landscape and security controls · CRISC: Domain 4, technology and security
Safe Internet Use, Acceptable Use Policy, and Generative AI
CISA: Domain 5 and emerging-technology risk · CISM: governance, risk management, policies, and awareness · CRISC: Domain 4, Emerging Technologies and security/risk awareness
Responsible AI Awareness: Using AI Safely, Ethically, and Within Policy
CISA: Domain 5 and emerging-technology risk · CISM: governance, risk management, information-security policies, and awareness · CRISC: Domain 4, Emerging Technologies and security/risk awareness
Stop, Verify, Preserve, Report: Your Security Response Model
CISA: Domain 5, Security Incident Response Management and Evidence Collection · CISM: Domain 4, Incident Management · CRISC: Domain 4, operations, incidents, and information-security principles
ISACA is putting more emphasis on domain-aligned CPE.
ISACA’s updated policy keeps the 120-CPE three-year requirement while requiring at least 90 CPE to align directly with the Exam Content Outline or domains of the certification being renewed.
Minimum domain-aligned CPE
At least 90 CPE during the three-year cycle must align with the certification’s Exam Content Outline or domains.
Maximum broader development CPE
Up to 30 CPE may come from professional development that is not directly aligned to certification exam content.
Total three-year requirement
The overall three-year CPE requirement remains 120 for the certifications covered by ISACA’s updated policy.
Review ISACA’s current explanation of the 2027 CPE policy changes at ISACA CPE 2027 .
How to self-report your CFISA CPE.
CPE earned through outside sponsoring organizations is self-reported by the certification holder. Keep your CFISA Certificate of Completion with your professional-development records.
Sign in to MyISACA.
Go to your MyISACA account using the same account associated with your certification.
Open Certifications & CPE Management.
Locate the certification for which you want to report the professional-education activity.
Choose Report and Manage CPE.
ISACA provides reporting controls for each certification held.
Select Add New CPE Record.
Create a new record for the completed CFISA course.
Enter the activity information.
Use the exact course title shown on your certificate. Enter Center for Information Security Awareness (CFISA) as the sponsoring organization, the completion date as the activity date, and choose the qualifying activity that best describes the completed training.
Enter the CPE hours.
Use the CPE amount documented for the course and apply the activity only to certifications for which the subject matter is relevant.
Save the record and keep your documentation.
Retain your Certificate of Completion and this domain-alignment page with your CPE records in case documentation is requested.
Keep the records behind the CPE.
CFISA’s CPE documentation is designed to make the activity easy to identify and support if a certification holder is asked to document the training.
Certificate of Completion
Learner name, completed course, completion date, provider information, instructional duration, and CPE hours.
Course description
A clear description of the cybersecurity topics covered by the completed course.
Domain alignment
A public curriculum crosswalk showing how CFISA training relates to applicable CISA, CISM, and CRISC exam-content areas.
Straight answers about CFISA and CPE.
These answers explain the third-party CPE pathway, what CFISA documents, and what the certification holder is responsible for reporting.
Can CFISA cybersecurity training count toward ISACA CPE?
Qualifying CFISA coursework may be self-reported as non-ISACA professional education when the activity is applicable to the job-practice areas or domains of the certification being maintained.
Is CFISA an ISACA Accredited Training Organization?
No. CFISA provides its own cybersecurity training and is not an ISACA Accredited Training Organization. The CPE pathway described here is ISACA’s pathway for qualifying non-ISACA professional education and structured self-study.
Does CFISA report my CPE directly to ISACA?
No. CPE earned through CFISA is self-reported by the certification holder in MyISACA. CFISA provides the course and completion documentation needed to support the record.
Can one CFISA course apply to more than one ISACA certification?
ISACA permits an activity to be applied across certifications when the professional activity is applicable to the job-related knowledge of each certification. The holder determines the number of hours applied to each credential.
How does CFISA calculate CPE hours?
CFISA uses ISACA’s published calculation of one CPE for each 50 minutes of active professional education, with quarter-hour reporting increments rounded to the nearest quarter hour.
Will CFISA training still be useful under the 2027 CPE rules?
ISACA’s 2027 policy requires at least 90 of the 120 CPE in a three-year cycle to align with the certification’s Exam Content Outline or domains. CFISA publishes its domain mapping so holders can evaluate that alignment.
Verify the requirements with ISACA.
ISACA controls its certification-maintenance requirements and determines whether reported activities satisfy its CPE policies. CFISA maintains this page against publicly available ISACA guidance.
How to Earn CPE
Qualifying activities, non-ISACA professional education, and structured self-study requirements.
View ISACA guidance →How to Report CPE
Self-reporting steps, required activity information, and ISACA’s CPE calculation method.
View reporting guidance →2027 CPE Policy Changes
Updated certification-aligned requirements effective January 1, 2027.
View 2027 changes →CFISA is not affiliated with, endorsed by, sponsored by, or accredited by ISACA. ISACA, CISA, CISM, CRISC, CDPSE, CCOA, CGEIT, and AAISM are names or marks associated with ISACA. Certification holders should review current ISACA requirements when reporting CPE.
Build cybersecurity awareness while supporting professional development.
Start CFISA Security Awareness Training online or talk with us about larger workforce deployments, LMS delivery, SCORM licensing, and enterprise training.