CISA Information Systems Acquisition & Development: Agile and DevOps — Complete Study Guide

You’re confident with traditional SDLC models, then a question on "immutable infrastructure" or "container orchestration" appears. This is a common stumbling block. Many CISA candidates apply an outdated audit lens to modern development, focusing on waterfall-era controls that don't fit rapid, automated environments. The exam doesn't just ask what Agile and DevOps are; it tests if you can audit them effectively.

Why Agile and DevOps Matter for the CISA Exam

The CISA exam tests your judgment, not just your memory. Agile and DevOps are now the standard for developing critical systems, and your role as an IS auditor has evolved. You're no longer just reviewing documentation after a phase; you are providing assurance that effective controls are embedded within the continuous development and deployment process itself.

Agile is a mindset guided by the values and principles of the Agile Manifesto, emphasizing iterative delivery, collaboration, and responding to change. Frameworks like Scrum and Kanban implement these principles. You'll see practices like short "sprints" (common in Scrum) and a focus on working software over exhaustive documentation. DevOps extends the Agile mindset by integrating development (Dev) and IT operations (Ops) teams. It's a culture built on automation, lean principles, measurement, and sharing (CALMS). This enables continuous integration (CI), continuous delivery (CD), and continuous deployment, where code can move from a developer's keyboard to production multiple times a day.

Your primary goal isn't to slow down development. It's to ensure governance, security, and compliance objectives are met while also adding value and providing assurance to management that risks are being managed effectively within these fast-paced environments.

How are Agile and DevOps Tested on the CISA Exam?

In Domain 3 (Information Systems Acquisition, Development, and Implementation), which makes up 19% of the CISA exam, expect scenario-based questions that test your ability to:

• Identify new risks: What governance, operational, or security risks arise from rapid deployment, automated infrastructure, and distributed architectures?
• Assess modern controls: How do you evaluate the effectiveness of controls in a CI/CD pipeline? What controls are necessary for IaC or containerized applications?
• Recommend audit procedures: What specific steps should an auditor take to gain assurance in an Agile/DevOps environment?

What are the Most Common Candidate Mistakes?

The number one reason candidates stumble is failing to adapt their audit mindset. They are tempted to:

1. Apply traditional waterfall controls directly: Insisting on a formal sign-off document when the equivalent control is an approved pull request with automated security scan results.
2. Focus on tools over principles: Knowing what Kubernetes is is less important than understanding the audit implications of container orchestration—like the need for image security and network segmentation.
3. Overlook the "continuous" aspect: Controls in DevOps are not point-in-time. They are continuous processes like automated monitoring, integrated security checks, and real-time compliance validation.
4. Ignore governance: Assuming that speed eliminates the need for clear decision-making, product ownership, and business requirement validation.

To avoid these traps, shift your focus from manual, periodic checks to automated, continuous assurance. If you're struggling with this mindset shift, VoraPrep's AI tutor, Vory, can provide 24/7 guidance on these complex scenarios. Try VoraPrep's free CISA practice questions to see how you stack up.

Traditional vs. Agile/DevOps Auditing: A Quick Comparison

To succeed, you must understand how the auditor's approach changes. This table highlights the key differences.

Audit Area	Traditional (Waterfall) Approach	Agile/DevOps Approach
Change Management	Formal, manual change approval board (CAB) meetings.	Automated pipeline with integrated peer reviews (pull requests) and pre-approved, low-risk changes.
Testing	Performed in a distinct, late-stage phase (e.g., UAT).	Continuous, automated testing integrated throughout the pipeline ("shift left").
Documentation	Comprehensive, upfront design documents.	"Just enough" documentation; working software and user stories are primary. The system itself (e.g., IaC scripts) is a form of documentation.
Auditor Involvement	Point-in-time audits at phase gates.	Continuous auditing; auditor acts as a consultant, reviewing the pipeline and controls, not just the final product.
Security	Often a separate, late-stage security review or penetration test.	Security is integrated into the entire lifecycle (DevSecOps), with automated security scanning (SAST, DAST, IAST) in the pipeline.

Key Concepts and Rules You Must Know

Grasping the terminology is the first step. The CISA exam demands you understand the governance, risk, and compliance (GRC) implications of each concept.

How to Audit Infrastructure as Code (IaC)

Infrastructure as Code (IaC) is the practice of managing infrastructure (servers, networks, databases) through machine-readable definition files (e.g., Terraform, CloudFormation). Audit & GRC Implications:

• Version Control: IaC scripts must be in a version control system (like Git) to provide a complete audit trail of all infrastructure changes.
• Change Management: Changes to IaC must follow a defined review and approval process, such as a mandatory peer review on a pull request, to enforce segregation of duties.
• Automated Security Scanning: Use static analysis tools to scan IaC templates for security vulnerabilities, misconfigurations (e.g., public S3 buckets), and compliance deviations before deployment.
• Secrets Management: Sensitive data (API keys, passwords) must never be hardcoded in IaC files. Audit for the use of a secure secrets management solution (e.g., HashiCorp Vault, AWS Secrets Manager).
• Drift Detection: Implement tools to detect "configuration drift"—manual changes made to infrastructure outside of the IaC process—which undermines control and consistency.

How to Audit Container Orchestration

Containers (e.g., Docker) package an application and its dependencies into an isolated unit. Container Orchestration systems (e.g., Kubernetes) automate the deployment, scaling, and management of these containers. Audit & GRC Implications:

• Image Security: The audit process must verify the container image lifecycle. Are base images from trusted, hardened sources? Are images scanned for known vulnerabilities (CVEs) in the CI/CD pipeline? Is there a policy to prevent the deployment of images with critical vulnerabilities?
• Network Segmentation: Review network policies within the orchestrator to ensure proper segmentation (e.g., using Kubernetes Network Policies) to limit the blast radius of a compromise.
• Access Control: Audit role-based access control (RBAC) for the orchestration platform itself. Who can deploy containers? Who can alter network policies? Ensure the principle of least privilege is enforced.
• Compliance: For regulations like PCI DSS, ensure the container environment meets specific requirements for network segmentation, logging, and access control.
• Logging and Monitoring: Verify that container logs are aggregated in a central system for security monitoring, analysis, and incident response.

How to Audit Microservices

Microservices is an architecture where an application is composed of small, independently deployable services that communicate via APIs. Audit & GRC Implications:

• API Security: APIs are the primary attack surface. The audit must focus on API security controls: strong authentication, authorization, rate limiting, and input validation, often managed by a central API Gateway.
• Data Governance & Privacy: In a distributed system, how is sensitive data protected? How is compliance with regulations like GDPR (e.g., right to be forgotten) managed when data is spread across multiple services and databases?
• Distributed Monitoring: Centralized logging, monitoring, and distributed tracing are critical for observability. Without them, it's nearly impossible to perform forensic analysis or troubleshoot issues across services.
• Service Mesh: A service mesh (e.g., Istio) can enforce security policies like mutual TLS (mTLS) for all service-to-service communication. Auditors should review its configuration to ensure security is enforced consistently.
• Operational Risk: Assess how the organization manages dependencies between services to prevent cascading failures.

What is a Spike and Why Does it Matter to Auditors?

In Agile, a spike is a short, time-boxed research activity to reduce uncertainty or a technical risk. For example, a team might run a "security spike" to evaluate a new encryption library.

Audit Implications:

• Risk Management: Spikes are a key control for proactive risk management. An auditor reviews spikes as evidence that the team is identifying and addressing technical uncertainties or potential security flaws before they become major problems or technical debt.
• Documentation: While informal, the outcomes of a spike should be documented and used to inform the product backlog, demonstrating a structured approach to problem-solving.

CISA Worked Example: Auditing a DevOps Environment

Let's walk through a realistic scenario to show you how to think like the examiner.

Scenario: Horizon Bank is developing a new mobile banking app using microservices on a public cloud. They use a full DevOps CI/CD pipeline, with Infrastructure as Code (IaC) and Kubernetes. The IS auditor, Sarah, is reviewing security controls before the Q4 2026 launch.

Sarah discovers:

1. IaC templates in Git are reviewed by only one developer before being automatically deployed.
2. Container images are pulled from public registries and scanned for vulnerabilities only once a month.
3. Microservices communicate via APIs, but there is no central API gateway; individual teams handle their own API security.
4. Container logs are stored locally and are not aggregated.

Question: What is the most critical security concern Sarah should prioritize, and what is the most appropriate recommendation? Step-by-Step Reasoning Process:

1. Understand the Auditor's Objective: Sarah must identify the highest-impact vulnerability for a mobile banking application before it goes live. The key is to prioritize based on potential business impact (financial loss, data breach, reputational damage).
2. Analyze Each Finding:

• Finding 1 (IaC Review): Lack of segregation of duties. Risk: A malicious or erroneous infrastructure change could be deployed, creating a foundational vulnerability. This is a significant control gap.
• Finding 2 (Container Scanning): Infrequent vulnerability scanning. Risk: A critical remote code execution (RCE) vulnerability in a base image could be deployed and remain undetected for weeks, allowing a complete system compromise. This is a very high risk.
• Finding 3 (API Security): Decentralized, inconsistent API security. Risk: With no central gateway, dozens of APIs could have weak or misconfigured authentication/authorization, creating a direct path for attackers to access sensitive customer data and financial transactions. This is also a very high risk.
• Finding 4 (Logging): No central logging. Risk: In the event of a breach, there would be no effective way to conduct forensic analysis or even detect the incident in a timely manner. This is a critical detective control gap.

1. Prioritize the Most Critical Concern: This is where CISA judgment comes in. Both Finding 2 and Finding 3 represent critical, preventative control weaknesses.

• The Case for API Security (Finding 3): APIs are the front door to the application's business logic and data. For a banking app, the direct exposure of transaction and data functions makes API security paramount. Inconsistent security here creates a wide and unpredictable attack surface.
• The Case for Container Scanning (Finding 2): A severe vulnerability in a container's underlying software (e.g., Log4Shell) could allow an attacker to bypass application-level controls entirely, including any API gateway. This is a foundational, systemic risk.

The CISA exam often asks you to choose the most critical issue. While both are severe, the decentralized API security (Finding 3) is arguably more critical in this context. Why? Because it represents a failure in securing the application's core business functions directly. Even with secure containers, poorly secured APIs will lead to a breach of confidentiality and integrity. An API gateway is a fundamental architectural control for a microservices application.

1. Formulate the Recommendation: The recommendation must directly address the prioritized finding.

Conclusion:

The most critical security concern is the lack of a centralized API gateway and inconsistent API security policies across microservices (Finding 3).

The most appropriate recommendation is for Horizon Bank to implement a centralized API gateway to enforce consistent security policies—including authentication, authorization, and input validation—across all microservices APIs.

The Tempting Wrong Answer and Why It's Wrong

A very tempting wrong answer is to prioritize the infrequent container scanning (Finding 2). It's a severe risk, and in some scenarios, it could be the top priority. However, for a mobile banking application built on microservices, the API layer is the direct interface to sensitive data and financial functions. Securing this layer with a consistent, centrally managed control (an API gateway) addresses the most immediate and probable threat vector related to the application's purpose. The exam expects you to connect the risk to the business context.

Study Tips and Exam-Day Strategy

• Time Allocation: Expect 5-8 questions on these topics. Don't rush them. Identify the practice (IaC, CI/CD), the auditor's goal, and the control principle being tested (e.g., segregation of duties, continuous monitoring).
• Connect to Other Domains: These concepts link across the CISA blueprint. The security controls relate directly to the CISA Protection of Information Assets Cheat Sheet (2026), and the audit process itself is grounded in Domain 1.
• Final Week Review: Don't re-read textbooks. Focus on the "why." Review your incorrect practice questions on VoraPrep to understand your judgment gaps. Use our CISA IS Acquisition, Development & Implementation Cheat Sheet (2026) for a rapid review of key terms and their audit implications.

Frequently asked questions

How many questions on Agile and DevOps appear on the CISA exam?

While ISACA does not release exact numbers, these concepts are a core part of Domain 3 (19% of the exam). You should be prepared for approximately 5-8 scenario-based questions that directly or indirectly test your understanding of auditing modern development environments.

What's the best way to study Agile and DevOps for CISA?

Adopt a judgment-first approach. Instead of just memorizing what Kubernetes is, focus on the audit implications—the risks it introduces and the controls needed to mitigate them. Applying your knowledge through realistic practice questions, like those on the VoraPrep CISA platform, is the most effective method.

Is Agile and DevOps tested in simulations or only multiple-choice questions?

The CISA exam consists entirely of multiple-choice questions (MCQs). There are no simulations or task-based questions. All questions on Agile and DevOps will be presented as MCQs, typically within a detailed scenario that requires you to select the best auditor action, risk, or control.

How long should I spend studying Agile and DevOps?

Given its importance in modern IT, dedicate at least 15-20 hours of your Domain 3 study time to these topics. This should include learning the concepts, understanding the GRC implications, and practicing numerous scenario questions. To fit this into a busy schedule, check out our guide on how to pass the CISA while working full time.

--- Ready to Pass Your CISA Exam? Don't let modern development practices catch you off guard. VoraPrep provides 2,300+ practice questions with AI-written explanations, an adaptive learning engine that targets your weak areas, and a 24/7 AI tutor (Vory) to ensure you're fully prepared.

Visit voraprep.com to get started.

Start Your Free 7-Day Trial at voraprep.com →

---

Related Resources

• CISA Salary Guide 2026: How Much Do CISAs Earn? — Same-exam deep-dive from the VoraPrep library.
• CISA Pass Rates 2026: What to Expect — Same-exam deep-dive from the VoraPrep library.
• 15 Tips to Pass the CISA Exam in 2026 — Same-exam deep-dive from the VoraPrep library.
• CISA Exam Changes 2026: What Candidates Need to Know — cisa exam changes 2026
• 90-Day CISA Study Plan (2026): Daily Schedule for Busy Candidates — cisa study schedule
• CISA CISA1 Risk-Based Audit Planning: Common Mistakes and How to Avoid Them (2026) — Same-exam deep-dive from the VoraPrep library.

Official resources and references

• ISACA CISA Certification Page: The official source for CISA exam details, candidate guide, and blueprint.
• U.S. Bureau of Labor Statistics - Information Security Analysts: Provides salary and job outlook information for roles related to CISA.