CIA Domain 10: Information Security Study Guide 2026

What Is CIA Domain 10: Information Security?

CIA Domain 10: Information Security is one of three domains that make up CIA Part 3 of the Certified Internal Auditor exam, administered by The Institute of Internal Auditors (IIA). The full Part 3 syllabus also includes Domain 9: Business Acumen and Domain 11: Information Technology. Together, these three domains test a candidate's ability to audit in an increasingly digital, data-driven business environment.

Domain 10 focuses specifically on the principles, frameworks, and audit techniques that internal auditors apply when evaluating an organization's information security posture. This is not a surface-level overview of cybersecurity buzzwords. The IIA expects candidates to understand how information security governance is structured, what controls are relevant, how risks are identified and treated, and-critically-how an internal auditor independently assesses all of it.

The 2025 syllabus update, aligned with the new Global Internal Audit Standards that went live in May 2025, deliberately increased the emphasis on information security and technology in Part 3. If you studied for the CIA under an older syllabus, do not assume your preparation is sufficient. This domain has grown in scope and sophistication.

Where Domain 10 Lives Within the CIA Exam

Understanding where Domain 10 sits structurally helps you allocate preparation time intelligently. The CIA is a three-part exam, and the parts can be taken in any order-though most candidates attempt Part 1 first to build the foundational internal audit knowledge that informs everything else.

• Part 1 covers Domains 1-4: Internal Audit Fundamentals, Ethics and Professionalism, Governance, Risk Management, and Control, and the newly distinct Fraud Risks domain. It contains 125 multiple-choice questions in 2.5 hours.
• Part 2 covers Domains 5-8: Managing the Internal Audit Function, Planning the Internal Audit Engagement, Performing the Internal Audit Engagement, and Communicating Internal Audit Results and Monitoring Progress. It contains 100 questions in 2 hours.
• Part 3 covers Domains 9-11: Business Acumen, Information Security, and Information Technology. It also contains 100 questions in 2 hours.

Domain 10 shares Part 3 with two other demanding domains, which means your study time for this section must be disciplined. You cannot over-invest in Domain 9's business acumen content at the expense of Domains 10 and 11, both of which require technical grounding.

Core Topics You Must Master

Information Security Governance

Governance is the starting point for any audit of an information security program. CIA candidates must understand how boards and senior management set tone and accountability for information security, how policies and standards cascade from governance structures, and how internal audit evaluates the adequacy of that governance. Questions in this area often test whether the candidate can distinguish between management's role in running the security program and internal audit's role in independently assessing it.

Risk Assessment in an Information Security Context

Part 3 questions on information security risk are not abstract. They ask candidates to apply risk assessment methodologies to specific scenarios: a healthcare organization storing patient records, a financial services firm with third-party data processors, a retailer running e-commerce platforms. You need to understand threat identification, vulnerability assessment, likelihood and impact estimation, and how residual risk is communicated to management and the audit committee.

Access Controls

Access control is one of the highest-yield topic areas within Domain 10. Expect questions on the principle of least privilege, segregation of duties in IT environments, privileged access management, user provisioning and de-provisioning processes, and how internal audit tests whether access controls are operating as designed versus as documented. The distinction between detective, preventive, and corrective controls in an access control context is frequently tested.

Incident Response and Business Continuity

Internal auditors do not manage incident response-they audit it. Domain 10 requires candidates to understand how an auditor would assess whether an organization's incident response plan is adequate, tested, and likely to function under actual breach conditions. Related topics include business continuity planning, disaster recovery, and the audit of backup and recovery procedures.

Emerging Technology and Cloud Security

The 2025 syllabus update reflects the reality that most organizations now operate in hybrid or fully cloud-based environments. Candidates should understand shared responsibility models in cloud computing, the audit implications of SaaS, PaaS, and IaaS environments, and how vendor contracts and service-level agreements factor into information security assurance. This is an area where candidates with a purely traditional IT audit background may encounter unfamiliar material.

How Domain 10 Questions Are Written

Every question on the CIA exam is multiple choice. There are no simulations, no essays, and no drag-and-drop items. All 100 questions in Part 3 are four-option multiple-choice questions, delivered via Pearson VUE testing centers available year-round worldwide.

Information security questions in Domain 10 tend to follow several recurring structures:

1. Scenario-based judgment questions: A vignette describes an organization's security situation and asks what an internal auditor should do next, what the highest-priority finding is, or what recommendation is most appropriate.
2. Control identification questions: A control is described, and the candidate must identify whether it is preventive, detective, or corrective-and whether it addresses the risk described.
3. Framework application questions: A scenario references a specific governance or compliance framework, and the candidate must apply it correctly.
4. Independence and objectivity questions: These test whether the internal auditor maintains independence when advising on security implementations-a recurring ethics intersection with Domain 10.

Practicing with realistic exam-style questions is essential. Use CIA Exam Prep practice tests to work through Domain 10 scenarios under timed, exam-like conditions. The goal is to train your reasoning process, not just memorize definitions.

Registration, Fees, and Scheduling Context

Before sitting for Part 3, you must have an approved application on file with the IIA. The application fee is approximately $115 for IIA members and $230 for non-members. Per-part registration then costs approximately $215 for IIA members and $340 for non-members. Across all three parts, total costs run approximately $760 for members and $1,250 for non-members.

You have three years from acceptance into the CIA program to complete all three parts and the experience requirement. That deadline should directly inform how aggressively you schedule Part 3-many candidates treat it as the last hurdle and underestimate its technical demands.

Part 3 is available year-round at Pearson VUE centers and can be taken before Parts 1 or 2 if your preparation warrants it. Some candidates with strong IT audit backgrounds choose to sit Part 3 first precisely because Domain 10 and Domain 11 align with their daily work. There is no required sequencing.

A Domain-Anchored Study Schedule for Part 3

Part 3 contains three distinct domains of meaningfully different character. Domain 9 (Business Acumen) draws on economics, finance, and organizational knowledge. Domain 10 (Information Security) requires technical security audit knowledge. Domain 11 (Information Technology) covers IT general controls, systems development, and data analytics. Treat them as three separate study modules.

Who Hires for CIA Information Security Expertise

The CIA credential is the only globally recognized internal audit certification, and employers know what it signals. When the CIA is combined with demonstrated information security audit competence-the kind Domain 10 tests-the career applications span a wide range of industries and organizational types.

Financial services firms-banks, insurance companies, asset managers-are among the most active hirers of internal auditors with information security backgrounds. Regulatory scrutiny in this sector around data security, third-party risk, and cyber resilience is intense, and internal audit functions are expected to provide meaningful assurance over security controls.

Healthcare organizations face overlapping privacy and security obligations. Internal auditors who understand how to evaluate HIPAA-related security controls, audit EHR system access, and assess business associate agreements are in demand at hospital systems, payers, and health technology companies.

Technology and software companies increasingly staff internal audit teams with professionals who can credibly evaluate security engineering practices, cloud infrastructure controls, and software development security. Domain 10 knowledge is table stakes for this work.

Government and public sector entities, consulting firms, and large multinationals also actively seek CIA-holders with information security audit competencies, particularly as regulators worldwide increase expectations around cybersecurity governance disclosures.

Scoring and What It Takes to Pass Part 3

Every part of the CIA exam is scored on a scale of 250 to 750. The passing score is a scaled score of 600. This is not a raw percentage-it is a scaled score derived through IIA psychometric methodology. For a detailed breakdown of how this scale works and what it means for your preparation strategy, see our article on CIA Exam Scoring 2026: How the 600 Passing Score Works.

What this means practically for Domain 10 preparation: you do not need to answer every information security question correctly. You need to demonstrate consistent, reliable competence across all three Part 3 domains. Weak performance in Domain 10 will drag your scaled score down even if you ace Domains 9 and 11.

Effective April 2026, the IIA is updating its scoring process so that candidates receive official results within three weeks of sitting their exam. This change reduces the uncertainty period that many candidates find stressful and allows faster re-registration if a retake is needed.

After earning the CIA, maintaining the credential requires 40 CPE hours annually, with a minimum of 20 hours in internal audit topics. Given the pace of change in information security, many CIA-holders will find that continuing education in this area naturally satisfies a significant portion of that annual requirement. For a broader view of how Domain 10 fits within your overall exam strategy, revisit our complete guide on CIA Domain 10: Information Security Study Guide 2026.

Frequently Asked Questions