CISA Certification Course
In this course, you will perform evaluations of organizational policies, procedures, and processes to ensure that an organization's information systems align with overall business goals and objectives. You will evaluate the security and controls of business structure and governance methods; the policies, procedures, and guidelines used; and the overall security of the business environment. Also, this course will help you prepare for the ISACA CISA certification exam.
CISA Certification acts as a career differentiator for security professionals or IT managers who wish to enhance their marketability and credibility. This is an ideal path for those looking at a long term career in Information Systems Auditing. This course is highly recommended for IS/IT auditors, IT managers, Audit Managers, Security Managers, System Analysts, Consultants, and even CIOs and CTOs.
- » IS audit, control, assurance, and security professionals, including IT consultants, auditors, managers, security policy writers, privacy officers, information security officers, network administrators, security device administrators, and security engineers, who have five years of experience with audit, IT systems, and security of information systems.
Back to Top
- » A minimum of 5 years of professional information systems auditing, control or security work experience (as described in the CISA job practice areas) is required for certification.
Back to Top
- » Entire Process of Auditing Information Systems
- » Management and Governance of IT
- » Acquisition, Implementation and Development of Business Information Systems
- » Managing Operations, Support and Maintenance of IS
- » Securing Information Assets
Back to Top
- The Process of Auditing Information Systems
- Knowledge of ISACA IT Audit and Assurance Standards, Guidelines and Tools and Techniques, Code of Professional Ethics and other applicable standards
- Knowledge of the risk assessment concepts and tools and techniques used in planning, examination, reporting and follow-up
- Knowledge of fundamental business processes (e.g., purchasing, payroll, accounts payable, accounts receivable) and the role of IS in these processes
- Knowledge of the control principles related to controls in information systems
- Knowledge of risk-based audit planning and audit project management techniques, including follow-up
- Knowledge of the applicable laws and regulations that affect the scope, evidence collection and preservation, and frequency of audits
- Knowledge of the evidence collection techniques (e.g., observation, inquiry, inspection, interview, data analysis, forensic investigation techniques, computer-assisted audit techniques [CAATs]) used to gather, protect and preserve audit evidence
- Knowledge of different sampling methodologies and other substantive/data analytical procedures
- Knowledge of reporting and communication techniques (e.g., facilitation, negotiation, conflict resolution, audit report structure, issue writing, management summary, result verification)
- Knowledge of audit quality assurance (QA) systems and frameworks
- Knowledge of various types of audits (e.g., internal, external, financial) and methods for assessing and placing reliance on the work of other auditors or control entities
- Governance and Management of IT
- Knowledge of the purpose of IT strategy, policies, standards and procedures for an organization and the essential elements of each
- Knowledge of IT governance, management, security and control frameworks, and related standards, guidelines and practices
- Knowledge of the organizational structure, roles and responsibilities related to IT, including segregation of duties (SoD)
- Knowledge of the relevant laws, regulations and industry standards affecting the organization
- Knowledge of the organizations technology direction and IT architecture and their implications for setting long-term strategic directions
- Knowledge of the processes for the development, implementation and maintenance of IT strategy, policies, standards and procedures
- Knowledge of the use of capability and maturity models
- Knowledge of process optimization techniques
- Knowledge of IT resource investment and allocation practices, including prioritization criteria (e.g., portfolio management, value management, personnel management)
- Knowledge of IT supplier selection, contract management, relationship management and performance monitoring processes, including third-party outsourcing relationships
- Knowledge of enterprise risk management (ERM)
- Knowledge of the practices for monitoring and reporting of controls performance (e.g., continuous monitoring, quality assurance [QA])
- Knowledge of quality management and quality assurance (QA) systems
- Knowledge of the practices for monitoring and reporting of IT performance (e.g., balanced scorecard [BSC], key performance indicators [KPIs])
- Knowledge of business impact analysis (BIA)
- Knowledge of the standards and procedures for the development, maintenance and testing of the business continuity plan (BCP)
- Knowledge of the procedures used to invoke and execute the business continuity plan (BCP) and return to normal operations
- Information Systems Acquisition, Development and Implementation
- Knowledge of benefits realization practices, (e.g., feasibility studies, business cases, total cost of ownership [TCO], return on investment [ROI])
- Knowledge of IT acquisition and vendor management practices (e.g., evaluation and selection process, contract management, vendor risk and relationship management, escrow, software licensing), including third-party outsourcing relationships, IT suppliers and service providers.
- Knowledge of project governance mechanisms (e.g., steering committee, project oversight board, project management office)
- Knowledge of project management control frameworks, practices and tools
- Knowledge of the risk management practices applied to projects
- Knowledge of requirements analysis and management practices (e.g., requirements verification, traceability, gap analysis, vulnerability management, security requirements)
- Knowledge of the enterprise architecture (EA) related to data, applications and technology (e.g., web-based applications, web services, n-tier applications, cloud services, virtualization)
- Knowledge of system development methodologies and tools, including their strengths and weaknesses (e.g., agile development practices, prototyping, rapid application development [RAD], object-oriented design techniques, secure coding practices, system version control)
- Knowledge of the control objectives and techniques that ensure the completeness, accuracy, validity and authorization of transactions and data
- Knowledge of the testing methodologies and practices related to the information system development life cycle (SDLC)
- Knowledge of the configuration and release management relating to the development of information systems
- Knowledge of system migration and infrastructure deployment practices and data conversion tools, techniques and procedures
- Knowledge of project success criteria and project risk
- Knowledge of post-implementation review objectives and practices (e.g., project closure, control implementation, benefits realization, performance measurement)
- Information Systems Operations, Maintenance and Support
- Knowledge of service management frameworks
- Knowledge of service management practices and service level management
- Knowledge of the techniques for monitoring third-party performance and compliance with service agreements and regulatory requirements
- Knowledge of enterprise architecture (EA)
- Knowledge of the functionality of fundamental technology (e.g., hardware and network components, system software, middleware, database management systems)
- Knowledge of system resiliency tools and techniques (e.g., fault-tolerant hardware, elimination of single point of failure, clustering)
- Knowledge of IT asset management, software licensing, source code management and inventory practices
- Knowledge of job scheduling practices, including exception handling
- Knowledge of the control techniques that ensure the integrity of system interfaces
- Knowledge of capacity planning and related monitoring tools and techniques
- Knowledge of systems performance monitoring processes, tools and techniques (e.g., network analyzers, system utilization reports, load balancing)
- Knowledge of data backup, storage, maintenance and restoration practices
- Knowledge of database management and optimization practices
- Knowledge of data quality (completeness, accuracy, integrity) and life cycle management (aging, retention)
- Knowledge of problem and incident management practices
- Knowledge of change management, configuration management, release management and patch management practices
- Knowledge of the operational risk and controls related to end-user computing
- Knowledge of the regulatory, legal, contractual and insurance issues related to disaster recovery
- Knowledge of business impact analysis (BIA) related to disaster recovery planning
- Knowledge of the development and maintenance of disaster recovery plans (DRPs)
- Knowledge of the benefits and drawbacks of alternate processing sites (e.g., hot sites, warm sites, cold sites)
- Knowledge of disaster recovery testing methods
- Knowledge of the processes used to invoke the disaster recovery plans (DRPs)
- Protection of Information Assets
- Knowledge of the generally accepted practices and applicable external requirements (e.g., laws, regulations) related to the protection of information assets
- Knowledge of privacy principles
- Knowledge of the techniques for the design, implementation, maintenance, monitoring and reporting of security controls
- Knowledge of the physical and environmental controls and supporting practices related to the protection of information assets
- Knowledge of the physical access controls for the identification, authentication and restriction of users to authorized facilities and hardware
- Knowledge of the logical access controls for the identification, authentication and restriction of users to authorized functions and data
- Knowledge of the security controls related to hardware, system software (e.g., applications, operating systems) and database management systems.
- Knowledge of the risk and controls associated with virtualization of systems
- Knowledge of the risk and controls associated with the use of mobile and wireless devices, including personally owned devices (bring your own device [BYOD])
- Knowledge of voice communications security (e.g., PBX, Voice-over Internet Protocol [VoIP])
- Knowledge of network and Internet security devices, protocols and techniques
- Knowledge of the configuration, implementation, operation and maintenance of network security controls
- Knowledge of encryption-related techniques and their uses
- Knowledge of public key infrastructure (PKI) components and digital signature techniques
- Knowledge of the risk and controls associated with peer-to-peer computing, instant messaging, and web-based technologies (e.g., social networking, message boards, blogs, cloud computing)
- Knowledge of the data classification standards related to the protection of information assets
- Knowledge of the processes and procedures used to store, retrieve, transport and dispose of confidential information assets
- Knowledge of the risk and controls associated with data leakage
- Knowledge of the security risk and controls related to end-user computing
- Knowledge of methods for implementing a security awareness program
- Knowledge of information system attack methods and techniques
- Knowledge of prevention and detection tools and control techniques
- Knowledge of security testing techniques (e.g., penetration testing, vulnerability scanning)
- Knowledge of the processes related to monitoring and responding to security incidents (e.g., escalation procedures, emergency incident response team)
- Knowledge of the processes followed in forensics investigation and procedures in collection and preservation of the data and evidence (i.e., chain of custody)
- Knowledge of the fraud risk factors related to the protection of information assets
Back to Top
- » CISA 2016 : Certified Information Systems Auditor exam 2016
Back to Top
We ensure your success by asking all
students to take a FREE Skill Assessment test.
These short, instructor-written tests are an objective measure of your current skills that help us determine whether or not you will be able to meet your goals by attending this course at your current skill level. If we determine that you need additional preparation or training in order to gain the most value from this course, we will recommend cost-effective solutions that you can use to get ready for the course.
Our required skill-assessments ensure that:
- All students in the class are at a comparable skill level, so the class can run smoothly without beginners slowing down the class for everyone else.
- NetCom students enjoy one of the industry's highest success rates, and pass rates when a certification exam is involved.
- We stay committed to providing you real value. Again, your success is paramount; we will register you only if you have the skills to succeed.
This assessment is for your benefit and best taken without any preparation or reference materials, so your skills can be objectively measured.
Take your FREE Skill Assessment test »
Back to Top
- Academic and corporate trainer with over 2000 hours of instruction delivered on security awareness, CISSP, Security+, Safety, core Microsoft courses, MS Exchange and MS ISA server.
- Conducted over 200 security reviews in support of financial audits, policy reviews and network vulnerability assessments.
- Bachelors Degree in Security Management with a Concentration in Information Security from American Military University along with CISSP, CAP and several CompTIA, Microsoft, ISACA certifications.
Donald is a security professional with a wide range of experience from physical security to a concentration in information security. He is the Information Systems & Security Director for a consulting firm. His clients include local municipalities, non-profits, corporations and federal government agencies, specializing in a wide array of compliance programs and security assessments such as PCI DSS, FISMA, COBIT and ISO17799.
Donald is also a trainer and speaker on security topics and has served on various advisory committees and as a subject matter expert in information technology and security. He has over 15 years of experience in the security field as well as more than 2000 hours of instruction delivered on security awareness, CISSP, Security+, Safety, core Microsoft courses and MS ISA server. In addition to that, Donald is the President and Chairmen for the Brentwood Veterans Memorial Building and Commandant for the Delta Diablo Det. 1155 Marine Corps League.
- Over 32 years of experience as well as 18 certifications, including Cisco, CompTIA, and Microsoft.
- Strong background, with web development & design of infrastructure for companies such as AT&T, Sports Illustrated, and Toys R Us.
- Specialist in applying process and finding solutions to solve them in addition to training people in the skills to manage the process and meet goals.
Jayson is a talented and valued Microsoft Certified Trainer (MCT) with over 32 years of IT experience. Along with web development & design of infrastructure for companies such as AT&T, Sports Illustrated, and Toys R Us, he holds several IT certifications. He is a CCDA, CCNA, Security+ certified, MCDBA, and MCSE to name a few.
Jayson's focus is on finding solutions to problems and applying process to solve them. He instructs professionals in the skills to manage the process and meet goals, which makes him a respected trainer at NetCom Learning.
- More than 14 years of experience as a Security Subject Matter Expert as well as black belt in a variety of martial arts.
- Numerous Challenge Coins from the US Government including the US Army, and the Criminal Investigation Command.
- Much acclaimed instructor at NetCom Learning, with evaluation scores of 8.8 out of 9.
Larry is a unique instructor and IT security expert. If you sit in one of his classes you might get the feeling of being in a martial arts class - That's exactly how Larry wants it! "The principles behind IT security are the same as those in a variety of martial arts," Larry says. In addition to teaching IT security for over 14 years, he has practiced martial arts since he was 13 years old and holds black belts in multiple disciplines including Tai Chi, Kung Fu, and Kick Boxing. "All of these techniques are like tools for different types of attacks," Larry explains.
Larry's excellence in certification training and passion for IT security has earned him numerous Challenge Coins from the US Government including the US Army, and the Criminal Investigation Command. He is also a much acclaimed instructor at NetCom Learning, with evaluation scores of 8.8 out of 9.
Back to Top