CISA CPE Requirements 2027: The New 90/30 Rule Explained

The CISA CPE requirements 2027 change how your continuing education hours are counted, not how many you need. ISACA has published the revised policy on its CPE 2027 page: from January 1, 2027, at least 90 of the 120 CPE hours in your three-year cycle must align with the CISA exam content outline and domains, and no more than 30 hours may come from wider professional development. Vendor sales and marketing demos stop counting altogether. If you hold CISA, or any other ISACA certification, this explainer sets out the new split, the new volunteering caps, and what to plan during 2026. Candidates still studying for the exam will find the topic notes in our CISA Domain 1 notes and CISA Domain 5 notes.

CISA CPE requirements 2027 at a glance

From January 1, 2027, CISA holders still need 120 CPE hours per three-year cycle, but at least 90 must align with the CISA exam domains. Up to 30 hours can be wider professional development, and vendor sales demos stop counting as CPE.

ISACA calls the two buckets certification-aligned and professional-aligned. Certification-aligned activities map directly to the exam content outline and domains of the certification you are renewing, and they must supply between 90 and 120 of your cycle hours. Professional-aligned activities build wider career skills, and they are capped at 30 hours per cycle. The three-year total of 120 hours does not change, and ISACA chapter guidance confirms the existing minimum of 20 hours per year stays in place. The policy applies across ISACA certifications, so CISM, CRISC and CDPSE holders face the same restructure; our CISM exam changes guide covers the current CISM outline if you hold both credentials.

Certification-aligned CPE: the 90-hour floor

At least 90 of your 120 hours must be certification-aligned. ISACA lists the qualifying activity types on the CPE 2027 page:

• Classes and training on topics inside the certification domains, such as cybersecurity or IT audit courses for CISA holders.
• ISACA conferences and virtual summits, which ISACA will award as domain-aligned.
• Volunteering for a certification working group, such as the CISA Working Group, and exam item writing for ISACA certifications.
• Developing or teaching content that is aligned to your certification, and assisting with review manual development.
• Publishing an article on emerging technologies, and serving on advisory groups such as the Emerging Tech Advisory Group.
• Governance-focused events from bodies such as the IOD and NACD.

Technical chapter events and other qualifying technical education keep counting as they do today. From 2027, the ISACA website will start marking whether a CPE opportunity is exam content-aligned or professional skill-aligned, which removes most of the guesswork at the point of booking.

CISA CPE requirements 2027: the professional-aligned 30

The genuinely new flexibility sits in the second bucket. Up to 30 hours per three-year cycle may be professional-aligned: learning that supports your career but does not map to the exam domains. ISACA names communication skills classes, mentoring a young professional, leadership conferences, the Member Experience Leadership Series webinars, chapter presentations that are not exam content-related, and service roles such as ISACA chapter officer or board member, including volunteering for SheLeadsTech.

Before 2027, hours outside the certification job practice areas were hard to claim at all. From 2027 they have a formal home, with a hard ceiling. Plan the mix deliberately: a holder who books 40 hours of leadership training in one cycle can only count 30 of them, and the remaining 10 do not convert into aligned hours.

Old rules and new rules, side by side

Rule	Until December 31, 2026	From January 1, 2027
Total CPE per three-year cycle	120 hours	120 hours (unchanged)
Alignment split	No formal two-category split	At least 90 certification-aligned; at most 30 professional-aligned
Vendor sales or marketing demos	Could qualify as CPE	No longer qualify; vendor case-study presentations still count
Volunteering, aligned to exam domains	Counted under the general rules	Maximum 20 per year and 60 per cycle
Volunteering, not aligned to exam domains	Counted under the general rules	Maximum 20 per year and 30 per cycle
Reporting system and CPE audit	Current process	No system changes in the 2026 cycle; audit process unchanged

CISA CPE requirements 2027: two changes that catch people out

Vendor demos stop counting

The clearest exclusion in the new policy is vendor sales and marketing demo presentations: from January 1, 2027, they no longer qualify for CPE. The line ISACA draws is content, not the presenter. A vendor presentation that is a case study rather than a demo still counts. If your cycle plan leans on vendor webinar hours, check which side of that line each session falls on before you rely on it.

Volunteering caps now split by alignment

Volunteer work can earn more CPE than before when it is aligned with the exam domains: advisory groups for emerging tech, IT risk or governance, and certification working groups allow 20 CPE per year and 60 across the cycle. Volunteer work that is not aligned, such as SheLeadsTech or awards working groups, chapter leadership and reviewer roles, is capped at 20 per year and 30 across the whole cycle. Heavy volunteers should map their roles against both caps before the 2027 cycle starts.

What CISA holders should do now

• Nothing changes for the 2026 cycle. ISACA states there will be no system changes in 2026, and the audit process remains unchanged with no additional audits planned. Report 2026 hours exactly as you do today.
• Audit your planned 2027 activities against the 90/30 split. Tag each planned course, conference and volunteer role as aligned or professional now, while substitution is still cheap.
• Replace demo-based hours early. If vendor demos supply a large share of your hours, line up aligned training or case-study sessions for 2027 instead.
• One pool of hours still serves multiple certifications. Holding more than one ISACA certification does not increase the total hours you need, and activities can still count toward multiple certifications as they do today. The update clarifies how hours apply across domains; it does not create a separate set per credential.
• Watch for the new labels. ISACA will mark CPE opportunities on its website as exam content-aligned or professional skill-aligned, and all CPE from ISACA conferences will count as aligned.

Frequently Asked Questions

Does the new CPE policy apply to CISM and other ISACA certifications?

Yes. ISACA states the updated policy applies across its certifications and does not require a separate set of CPE hours for each certification you hold. The alignment test is applied against the domains of the certification being renewed.

Do chapter events still count toward CISA CPE?

Yes. ISACA confirms that technical chapter events and other qualifying technical education activities continue to count just as they do today, and chapters do not need to change how they plan programs. Chapter presentations that are not exam content-related fall into the professional-aligned bucket, capped at 30 hours per cycle.

What happens to hours I earn in 2026?

They are reported under the current policy. ISACA is giving a year of advance notice, states that no system changes will happen in the 2026 cycle, and the new split applies from January 1, 2027.

Will the CPE audit get stricter?

No. ISACA states the audit process will remain unchanged and no additional audits are planned. The change is about which activities qualify and how they are categorized, not about enforcement volume.

Sources

Every rule in this explainer comes from the official ISACA page, CPE Policy Changes for 2027, including the 90/30 split, the volunteering caps, the vendor demo exclusion and the transition notes. Confirm your own cycle position in your ISACA CPE record before you act, because ISACA is the final authority on CPE compliance.