ISACA-accredited CISA and CISM training for the leaders who carry cyber risk.
Built for
Official ISACA courseware, an APMG-accredited instructor and live evening cohorts. Follow the study plan, and if you don't pass on your first attempt, we pay your ISACA retake fee.
CISA and CISM are approved DoD 8140 qualifications. See the work roles.
Credentialed people are a cyber risk control
An understaffed security team or a missing skill is a risk, the same as a missing patch. CISA builds the audit judgment that tests whether controls really work. CISM builds the management discipline that runs the security program and the incident response.
of cybersecurity teams are understaffed.
of organizations have unfilled cybersecurity positions.
of enterprises train non-security staff into security roles, down from 41% a year earlier.
Source: ISACA, State of Cybersecurity 2025 press release, 29 September 2025. Read how leaders use training to cut cyber risk.
Two ISACA certifications, front and center
Both courses run as small live cohorts in the evening, Eastern time, with every session recorded. One price list for both.
CISA training
For IT auditors, internal audit, compliance staff and control assessors who sign off on evidence.
- All five CISA domains, weighted to ISACA's exam content outline
- Qualifies for DCWF work role 612, Security Control Assessor
- Official ISACA Training Kit with every seat
- Next cohort
- Dates announced soon
- Sessions
- 5:00–7:30 PM Eastern, live online, recorded
- Price
- $1,199 training, or $1,749 with the ISACA exam voucher
CISM training
For security managers, ISSMs, CISOs and vCISOs who run the program and answer for incidents.
- All four CISM domains, weighted to ISACA's exam content outline
- Qualifies for DCWF work role 722, Information Systems Security Manager
- Official ISACA Training Kit with every seat
- Next cohort
- Dates announced soon
- Sessions
- 5:00–7:30 PM Eastern, live online, recorded
- Price
- $1,199 training, or $1,749 with the ISACA exam voucher
Not sure which comes first? Read CISA vs CISM, or see the full cohort schedule and prices.
Do the work. If you don't pass, we pay the retake fee.
Pass Assurance is our share of the risk. It is not a promise that you will pass: it is a promise that if you follow the study plan and the exam still goes against you, the retake costs you nothing.
- Attend at least 90% of live sessions, or watch any missed session's recording within 7 days.
- Complete every assignment and both full-length practice exams.
- Score at least 75% on the final practice exam before you book.
- Sit the exam within 90 days of the last session, and send us your score report within 14 days of the result.
What we pay
Your ISACA exam registration fee for one retake of the course's own exam: currently US$575 for ISACA members and US$760 for non-members.
One funded retake per student. ISACA sets its fees and retake rules; figures checked 4 November 2026.
CISA and CISM qualify your people for DoD 8140 work roles
ISACA's CISA and CISM became approved DoD 8140 qualifications in May 2024. Under DoD Manual 8140.03 each cyber position is coded to a DCWF work role and proficiency level, and CISA and CISM are listed options for roles such as 612 and 722.
| DCWF work role | CISA | CISM |
|---|---|---|
| 722 Information Systems Security Manager | — | IntermediateAdvanced |
| 612 Security Control Assessor | IntermediateAdvanced | Advanced |
CISM is also listed for six more work roles. Your contract and position coding decide what applies; see the full table and sources.
CISA & CISM for DoD 8140 Workforce Readiness Assessment
Train your team, fast
Private CISA and CISM cohorts for one organization, on your schedule, with purchase-order invoicing and the completion and CPE records your contracting officer or prime will ask for.
- RequestTell us the certification, headcount and dates.
- Scoping callWithin 2 business days.
- Syllabus & scheduleWithin 5 business days.
- KickoffWithin 15 business days.
Other ISACA certifications, when you need them
CISA and CISM run on a public schedule. Every other ISACA credential is delivered on request: as a private cohort for your team, or as a public cohort once enough people sign up.
See the on-request catalog- CRISC: risk and information systems control
- CGEIT: governance of enterprise IT
- CDPSE: data privacy solutions engineering
- CCOA: cybersecurity operations analyst
- CCAK: cloud auditing knowledge
- COBIT 2019
- AAIA: advanced in AI audit
- AAISM: advanced in AI security management
VIS also runs its own career-track exam prep for CompTIA and ISC2 certifications. That prep is built by VIS; it is not official courseware from those organizations.
Readiness services for defense contractors
CMMC readiness
NIST SP 800-171 gap analysis, SPRS scores, CUI enclaves and C3PAO preparation. CMMC Phase 2 is suspended; see what still applies.
CMMC status tracker →Peripolos
Brilliant at the Basics for defense suppliers, starting with a free First Article Check against CISA's Known Exploited Vulnerabilities catalog.
Peripolos packages →FedRAMP 20x
Readiness and Key Security Indicator engineering for cloud service providers, with VIS as an advisor, not an assessor.
FedRAMP 20x readiness →VinfraSec Ephor
DPDP Act and CERT-In compliance operations software from VinfraSec, VIS's subsidiary in Hyderabad.
VinfraSec Ephor →CISA, CISM, DoD 8140 & VIS Questions
Is VIS an ISACA Accredited Training Organization?
Yes. Virtual Infrastructure Services LLC (VIS) is an ISACA Accredited Training Organization in Kendall Park, New Jersey. Its CISA and CISM courses are taught live online and built on ISACA's official training materials.
Should I take CISA or CISM first?
Take CISA first if your work is auditing or assessing controls and evidence. Take CISM first if you manage a security program, a team or incident response. Many security leaders hold both; the order follows the job you do now.
Is CISM approved for DoD 8140?
Yes. ISACA announced in May 2024 that CISA and CISM are approved DoD 8140 qualifications. CISM is listed for work role 722, Information Systems Security Manager, at the Intermediate and Advanced levels, and CISA for work role 612, Security Control Assessor, at the Intermediate and Advanced levels.
How much does CISA or CISM training cost at VIS?
A seat costs $1,199 for live training with the official ISACA Training Kit, or $1,749 with the ISACA exam voucher included. Teams of three or more can ask for group pricing and a purchase-order invoice.
What happens if I fail the CISA or CISM exam?
ISACA lets you retake the exam, and each attempt costs the full registration fee. With Pass Assurance, if you met the study-plan conditions and did not pass on your first attempt, VIS pays the fee for one retake.
How fast can you train our team?
For a private cohort we aim to hold a scoping call within 2 business days, send a syllabus and schedule within 5 business days, and start within 15 business days of your request.
Does VIS still help with CMMC?
Yes. VIS provides CMMC and NIST SP 800-171 readiness, SPRS assessments, CUI enclave design and C3PAO preparation. CMMC Phase 2 was suspended on 13 July 2026, but NIST SP 800-171 under DFARS 252.204-7012 and SPRS reporting still apply.
What are Peripolos and VinfraSec Ephor?
Peripolos is VIS's product and service line for the Brilliant at the Basics practices, starting with a free First Article Check against CISA's Known Exploited Vulnerabilities catalog. VinfraSec Ephor is a DPDP Act and CERT-In compliance operations platform from VinfraSec, VIS's subsidiary in Hyderabad, India.