You should have five years of work experience in information systems auditing, control, assurance, or security within the last ten years of the application submission date to be eligible for CISA.