CISA Domain 5, Protection of Information Assets, is the biggest single block of content on the exam, tied with Domain 4. It carries 26% of the blueprint, roughly 39 of the 150 questions. Put the two heavy domains together and 52% of your exam sits in technical territory: operations and resilience on one side, protection of assets on the other.
Domain 5 splits into two halves. The protective side covers security policy and frameworks, physical and environmental controls, identity and access management, network and endpoint security, data loss prevention, encryption, public key infrastructure, cloud, and mobile and wireless devices. The detection side covers awareness training, attack methods, security testing, monitoring, incident response, and forensic readiness. All of it is tested from the auditor's chair rather than the engineer's, and that single distinction is worth more marks than any single fact in the domain. For how the weights sit across all five, see CISA domains explained.
What does Domain 5 cover on the protective side?
Start with the policy foundation, because it is the criterion for everything else. Without a documented policy there is nothing to audit against, and a gap you find is not formally a finding, because no requirement has been violated. The hierarchy runs policy, standards, procedures, guidelines, each layer approved, communicated and reviewed on a cycle. ISO/IEC 27001 and the NIST Cybersecurity Framework are the two frameworks to know by name and by what they demand: a documented scope, risk assessments that are updated, controls that are implemented, and a management review that runs.
Physical and environmental controls matter more than technical candidates expect, because if someone can reach the server, most logical controls stop mattering. Badge readers, visitor logs, mantraps, CCTV retained for as long as policy says, power redundancy, clean-agent fire suppression, HVAC and water monitoring. The auditor's question is always the same shape: does the control exist, is it documented, has it been tested, can you show me evidence.
Identity and access management carries the most questions, because it is where auditors find the most weaknesses in practice. Four terms anchor it. Identification is the claim, authentication is the proof, authorization is what you may do once proven, accountability is the log tying actions back to a person. Provisioning is usually fine, because someone wants their access and chases it. Deprovisioning is the chronic failure, because nobody chases access removal for a person who has already left. Periodic access reviews stop rights accumulating through years of role changes.
Network security, data loss prevention, cloud, and mobile round out the first half. Know what a default-deny firewall posture is, why segmentation limits lateral movement, what an IDS does that an IPS does not, and why data loss prevention is useless without a classification scheme behind it. In cloud, the shared responsibility model shifts responsibility as you move from IaaS to PaaS to SaaS, but accountability never shifts. The organization answers to regulators no matter who hosts its data.
Symmetric versus asymmetric encryption, and what PKI actually gives you
This is the most-missed technical area for non-technical auditors, so work it through rather than memorizing a table.
Your organization sends a large encrypted file to a business partner every night. Symmetric encryption, AES being the standard, uses one key for both encryption and decryption. It is fast, which is what you want for bulk data. The problem is distribution: both ends need the same key, and getting that key to the partner securely is a separate problem you have not solved. Emailing it defeats the point.
Asymmetric encryption solves distribution. It uses a mathematically linked pair: a public key anyone can hold, and a private key the owner never shares. Anything encrypted with the public key can only be opened with the private key, so your partner publishes their public key freely and you use it without any prior secret. The catch is speed. RSA and elliptic curve cryptography are far slower than symmetric algorithms, so encrypting a large nightly file that way is impractical.
So real systems use both. Asymmetric encryption carries a small payload, the symmetric session key, and symmetric encryption does the heavy lifting on the actual data. That hybrid is what TLS does every time a browser loads a secure page. If you remember one sentence for the exam, make it this one: asymmetric for key exchange and signatures, symmetric for bulk data.
Now the gap in the story. If your partner publishes a public key, how do you know it is really theirs and not an impostor's? Nothing in the mathematics answers that, and this is the part candidates skip. PKI is not encryption. PKI is the trust machinery around it: a certificate authority that verifies an identity and signs a certificate binding it to a public key, a registration authority doing the verification legwork, X.509 certificates with a validity period, chains linking a server certificate through intermediates to a trusted root, and revocation through CRL or OCSP. PKI answers the question "whose key is this," which encryption alone cannot.
Digital signatures run the same keys in the other direction. The signer hashes the document and encrypts the hash with their private key, and anyone with the public key can verify it. That gives authenticity, integrity and non-repudiation. It does not give confidentiality, and questions test that.
Here is the auditor's turn, which is what the exam rewards. You are not asked to evaluate the mathematics. You are asked whether encryption is applied to classified data at rest and in transit, whether algorithms and key lengths are current, whether deprecated protocols such as TLS 1.0 and 1.1 have been retired, and above all how keys are managed. Strong encryption with weak key management is not strong encryption. Where are keys generated and stored, who can reach them, how often are they rotated and revoked, and can one administrator recover them alone. The classic finding is keys stored alongside the data they protect, which is a lock with the key taped to the door.
What does Domain 5 cover on the detection and response side?
The second half asks how the organization notices when those controls are tested, and what happens next.
Security awareness training is assessed on measurable outcomes rather than completion percentages. The auditor wants phishing click rates trended over time, because a flat rate after four campaigns means the program is not working, whatever the completion report says. Attack methods are covered at recognition level: malware families, the social engineering vocabulary from spear phishing to tailgating, denial of service, and injection attacks.
Security testing carries a distinction the exam returns to repeatedly. A vulnerability assessment enumerates known weaknesses without exploiting them, broad and fast. A penetration test exploits them to prove what an attacker could reach. When a question asks which technique confirms a vulnerability is genuinely exploitable, the answer is penetration testing. The auditor runs neither, and instead checks frequency, scope, tester independence, and whether findings were tracked to remediation. A report filed and forgotten is not evidence of a working control.
Security monitoring means log coverage, SIEM correlation, retention, alert triage, and metrics such as mean time to detect. Logs collected but never correlated or triaged are a monitoring capability in name only. Incident response follows the NIST SP 800-61 lifecycle: preparation, detection and analysis, containment, eradication, recovery, lessons learned. Learn the order. Containment comes before eradication, and sequence questions are common.
Chain of custody, and why the auditor preserves rather than investigates
Chain of custody is the documented record of who collected a piece of evidence, when, from where, how it was handled, where it was stored, and who has touched it since. Every link must be documented, because a gap can persuade a court or a disciplinary panel to exclude the evidence. Digital evidence also needs proof of integrity: a forensic hash computed at acquisition, recorded on the custody form, recomputed at every handling step. A match proves nothing changed. A mismatch invalidates the copy.
Work through the scenario the exam likes. A departing employee is suspected of copying customer records to a personal drive. An operations manager, trying to help, powers the laptop off and puts it in a drawer. That single act destroyed everything in volatile memory: running processes, live network connections, possibly encryption keys held in RAM. Order of volatility says collect from the most perishable outward, memory before disk, disk before archived logs. Once the machine is off, that tier is gone.
Now the part that decides your answer on exam day. The IS auditor is not the investigator. The auditor does not image the drive, analyze the artifacts, or interview the suspect. The auditor evaluates whether forensic readiness existed before the incident: an approved plan, trained personnel or a retained third party, validated tools and write blockers, chain-of-custody forms that exist as forms rather than intentions, secure evidence storage, and first-responder guidance telling staff to document the live state before containment. Afterward, the auditor evaluates whether that process was followed, and preserves independence by staying out of the investigation. An option that has the auditor collecting or examining evidence is almost always the trap.
The trap: engineers over-answer and auditors under-answer
Domain 5 punishes two opposite reflexes, and knowing which is yours is half the fix.
Technical candidates over-answer. Asked what to do about a weak firewall rule base, they reach for the configuration change, the tuning, the fix. The exam wants the control question: is the rule set documented, reviewed on a cycle, consistent with default deny, and was the deviation reported to the accountable owner. Deep knowledge becomes a liability when it pulls you toward the option a good engineer would pick.
Audit-background candidates under-answer. Faced with hashing, key exchange, hypervisor escape or WPA3, they retreat to generic control language and pick whichever option sounds most procedural, because they lack the technical grip to rank the specifics. That works until a question turns on knowing that a digital signature does not provide confidentiality, or that a vulnerability scan cannot prove exploitability.
The cure is one habit, and it works for both groups: read every technical topic here twice. Once for what the thing is, and once for what the auditor asks about it, which is always some version of what could go wrong, which control addresses it, and how would I verify it is operating. Our CISA study guide is built on that structure, with every Domain 5 topic followed by the evaluation questions an auditor puts to it.
How should you sequence CISA Domain 5 in your study plan?
Here is an opinion that goes against the way most people study. Do not start with Domain 5. Start with Domain 1, the auditing process, even though it is only 18%. Domain 1 teaches the lens: evidence, criteria, testing, independence, reporting. Every Domain 5 question is a Domain 1 question wearing technical clothes. Study encryption and forensics before you have internalized how an auditor thinks and you will learn the technology, then answer like a practitioner, which is the exact failure mode this domain is built to catch.
Take Domain 5 second, before Domain 4, and give it more calendar time than any other domain. It is tied for the heaviest weight, it has the widest technical surface, and it is where your background is most likely to mislead you. Split it the way the material splits: protective controls in one block, detection and response in the next. Revisit encryption and PKI a week later, because that material fades faster than the rest.
Leave Domain 3 for last. At 12% it is the smallest weight and the worst place to spend early energy. For the other half of the heavy pair, read Domain 4 on operations and resilience. The 12-week CISA study plan puts this sequence on a calendar, and what the CISA exam is covers the format, scoring and eligibility rules behind it.
FAQ
How many questions is CISA Domain 5 on the real exam?
Domain 5 carries 26% of the blueprint. With 150 scored and unscored questions on the exam, that works out to roughly 39 questions, tied with Domain 4 as the largest block. ISACA weights the exam to the published outline, so the proportion is stable across forms even though the exact items differ.
Do I need to understand encryption math for CISA Domain 5?
No. You need to understand what each type of encryption is for, not how the algorithms work internally. Know that symmetric encryption uses one shared key and is fast, that asymmetric encryption uses a public and private pair and solves key distribution, that real systems combine both, and that PKI supplies the identity binding neither one provides on its own. The questions are about applying and managing encryption, especially key management.
Is the auditor supposed to conduct a forensic investigation?
No, and answer options suggesting otherwise are usually distractors. The IS auditor evaluates forensic readiness before an incident and evaluates whether procedures were followed after one. Performing the collection or analysis compromises the independence that makes the auditor's opinion worth anything.
Which parts of Domain 5 do candidates find hardest?
Encryption, PKI and forensics for candidates from an audit or compliance background, because the technical vocabulary is new. For candidates from an engineering background the hardest part is not the technology at all but the answer pattern, because the exam rewards assessing and reporting over fixing. Both groups tend to miss questions in this domain for opposite reasons.
Should I study Domain 4 or Domain 5 first?
Either works, but study Domain 1 before both. Our preference is Domain 5 ahead of Domain 4, because it has the widest technical surface and benefits most from a second pass later in your schedule. The two together are 52% of the exam, so whichever order you choose, they should get the largest share of your study weeks.
Looking for a plain-English CISA guide? ISACA CISA: Certified Information Systems Auditor Study Guide covers all five domains with four full-length practice exams, every answer explained.
Simply Certified is an independent publisher. CISA and ISACA are trademarks of ISACA. Our books are independent study material and are not affiliated with, endorsed by, or sponsored by ISACA.