Shop Cart
Get support

Credentialing
Membership
Enterprise
Partnerships
Training and Events
Resources

Need help?Get support

©2026 ISACA. All rights reserved.

Certifications
Certificates

How can we help?

Find the right certification
Navigate Career Journey
Maintain or renew a certification
Verify a certification

Find the right certification
Navigate Career Journey
Maintain or renew a certification
Verify a certification

Trusted Partner for the DoW's CMMC ProgramISACA now serves as the official CAICO.

About Membership
Get Involved

Maximize Your Membership
Engage Online Community

What would you like to do?

Join today
Earn free CPE
Browse chapters
Volunteer

Join today
Earn free CPE
Browse chapters
Volunteer

Personalize your ExperienceUpdate your ISACA profile today.

AI Solution
- CMMI Artificial Intelligence Maturity (AIM)
Performance Improvement Solutions
CMMI Appraisal Results

Team Training
- Skills and Credentials
- CMMI Training and Certification
License Enterprise Training
Enterprise Support
Contact Us

Empower Your Team to Empower Business GrowthCustomize your IT team training with ISACA.

Become a Partner

Become an Enterprise Practitioner

Need to find a training partner

Certification Training Partners
COBIT Training Partners
Academic & Workforce Partners
CMMI Performance Improvement Partners

Certification Training Partners
COBIT Training Partners
Academic & Workforce Partners
CMMI Performance Improvement Partners

Over 100,000 People Were Trained By ISACA in 2022Become a Partner to capitalize on this demand.

Conferences
Training Week
Virtual Workshops

Training by Type
Training from an Accredited Partner
Training by Topic

What would you like to do?

Earn CPE
Find Team Training
Explore Virtual Workshops
Find Chapter Events

Earn CPE
Find Team Training
Explore Virtual Workshops
Find Chapter Events

Featured Training15% Off AI Fundamentals Online Review Course

ISACA Resources
Engage Online Communities
COBIT

Resources by Topic
Glossary

What can we help you find?

ISACA Now Blog
White Papers
Audit Programs

ISACA Now Blog
White Papers
Audit Programs

ISACA's IT Audit FrameworkThe newest edition is now available.

1700 E. Golf Road, Suite 400, Schaumburg, Illinois 60173, USA | +1-847-660-5505

LinkedIn
Facebook
Instagram
YouTube

Support

Careers

About Us

Join / Renew

Credentialing

Membership

Enterprise

Partnerships

Training & Events

Resources

Bug Reporting
Contact Us
Terms
Privacy
Cookie Notice
Fraud Reporting

©2026 ISACA. All rights reserved.

Harmonizing Risk and Compliance: Unifying Infosec Programs Through Automation

Harmonizing Risk and Compliance: Unifying Infosec Programs Through Automation

1 CPE

Access until 13 Nov 2026

Online•English

Description: As regulations grow more complex, organizations often face fragmented compliance across frameworks like ISO 27001, GDPR, NIST CSF, and PCI DSS—wasting resources and increasing risk. Join OneTrust experts to discover how automation can unify risk and compliance, streamline processes, and provide real-time visibility. Key takeaways: -Identify risk across systems and data -Reduce manual workloads and redundancy -Optimize compliance processes to improve efficiency -Leverage OneTrust Tech Risk & Compliance to simplify audits and enhance oversight -Ideal for InfoSec leaders, GRC professionals, and audit partners seeking a streamlined, risk-aware compliance strategy. Speaker: Jaymin Desai, Technical Product Marketing Director, OneTrust Access until: 12:00pm CT on 13 November 2026

No image available

About this Webinar

Description: As regulations grow more complex, organizations often face fragmented compliance across frameworks like ISO 27001, GDPR, NIST CSF, and PCI DSS—wasting resources and increasing risk. Join OneTrust experts to discover how automation can unify risk and compliance, streamline processes, and provide real-time visibility.

Key takeaways:

Identify risk across systems and data
Reduce manual workloads and redundancy
Optimize compliance processes to improve efficiency
Leverage OneTrust Tech Risk & Compliance to simplify audits and enhance oversight
Ideal for InfoSec leaders, GRC professionals, and audit partners seeking a streamlined, risk-aware compliance strategy.

Speaker: Jaymin Desai, Technical Product Marketing Director, OneTrust

Access until: 12:00pm CT on 13 November 2026

Product SKU

LMS-SW111325

Non-members

US$75

OR

Members

FREE

+ membership fees

Save US$75

Earn 70+ FREE CPE credits a year
Gain exclusive access to job postings
Access the online ISACA Journal

Description: As regulations grow more complex, organizations often face fragmented compliance across frameworks like ISO 27001, GDPR, NIST CSF, and PCI DSS—wasting resources and increasing risk. Join OneTrust experts to discover how automation can unify risk and compliance, streamline processes, and provide real-time visibility. Key takeaways: -Identify risk across systems and data -Reduce manual workloads and redundancy -Optimize compliance processes to improve efficiency -Leverage OneTrust Tech Risk & Compliance to simplify audits and enhance oversight -Ideal for InfoSec leaders, GRC professionals, and audit partners seeking a streamlined, risk-aware compliance strategy. Speaker: Jaymin Desai, Technical Product Marketing Director, OneTrust Access until: 12:00pm CT on 13 November 2026

You might also like

No image available

Reducing the Evidence Collection Tax Through Agentic Audit Automation

Description: Audit and compliance teams spend too much time manually collecting evidence. This session examines how agentic AI is shifting the balance of where we spend our time by transforming evidence collection, and what we must understand before trusting it. We explore three critical dimensions: hallucination risk that can make AI-collected evidence unreliable; cryptographic chain of custody as an architecture for defensible evidence integrity; and continuous controls monitoring as the shift from point-in-time snapshots to real-time assurance. Attendees leave with a practical framework for governing AI evidence collection and five diagnostic questions to apply immediately in their organizations. Speaker: Sandy Buchanan, P.Eng, CISSP, CISM, CISA, Lead Product Manager, Wolters Kluwer Access until: 12 pm CT on 16 July 2027

No image available

Maturing Insider Risk Through Intent-Driven Insight

Description: Why do insider incidents surprise organizations that monitor user activity? Traditional controls focus on what happened, not why, leaving insider risk teams to be reactive. Leading organizations strengthen insider risk by incorporating behavioral context and indicators of intent into their oversight models. By correlating motive, behavioral patterns, and technical signals, teams prioritize risk earlier, reduce investigations, and improve defensibility. Join our live 60-minute webinar with Proofpoint experts to learn how to operationalize intent-driven risk insight while balancing privacy and security. You'll gain insight into: • How AI expands the insider threat surface • The need for visibilty beyond active monitoring • How behavioral context strengthens detection • Aligning programs with privacy and compliance Speakers: Eric Franzen, VP, Capture and Digital Risk, Proofpoint and Kasey Olbrych, Enterprise Security Advisor, Proofpoint, Inc. Access until: 12 pm CT on 28 May 2027

No image available

Harnessing AI to Achieve Compliance at the Digital User Experience Layer

Description: In this ISACA webinar, attendees will learn how GRC, Privacy, and Security teams can harness a single AI-powered platform to safeguard digital experiences and achieve sustained compliance with any regulation or security standard, in any jurisdiction, across any business unit. The webinar examines how AI agents continuously inventory and monitor script behavior across the entire digital portfolio, detect drift from policy in real time, enforce compliance requirements across jurisdictions and business units, and create and preserve the timestamped, auditable evidence that organizations need to demonstrate compliance not just to regulators and assessors, but in the event of litigation. The ability to prove what was happening on your digital properties at a specific point in time is a legal necessity. AI agents change the equation. By operating continuously across the full digital portfolio, mapping script behavior against applicable requirements in real time, and generating defensible evidence at scale, they allow organizations to move at the speed of innovation without sacrificing compliance. New digital experiences can be launched, iterated, and scaled with the confidence that security and privacy obligations are being enforced every step of the way. Attendees will leave with a practical framework for moving from fragmented, point-in-time compliance efforts to a scalable, defensible program that enables innovation and keeps pace with both the digital environment and regulations. Learning Objectives: Describe the compliance challenges GRC, Privacy, and Security teams face when jointly governing websites and mobile applications across multiple regulations, standards, jurisdictions, and business units simultaneously Explain why continuous script inventory, behavioral monitoring, and drift detection are foundational requirements for compliance at the digital experience layer Articulate why the creation and preservation of timestamped compliance evidence is essential for regulatory defense and litigation preparedness Identify how a single AI platform can align GRC, Privacy, and Security functions around a shared, real-time view of compliance posture across hundreds of global digital properties Apply a framework for evaluating whether their organization's current digital compliance posture is scalable, defensible, and adaptable to an evolving regulatory landscape Speaker: Ivan Tsarynny, CEO and Co-Founder, Feroot Access until: 12 pm CT on 19 May 2027

No image available

Risk-Enabled Innovation: Uniting AI Governance and Risk Management to Accelerate Responsible Growth

Description: In this hands-on discussion, OneTrust’s Chief Information Security Officer and Head of AI Governance & Privacy come together to explore the two sides of AI management—AI Risk and AI Governance—and how to build programs that are both actionable and resilient. Using a Third-Party Risk onboarding workflow as a guide our speakers will dive into how to: Build an AI foundation: How to identify, catalog, and manage AI systems and models Enable your organization: Update policies, training, and risk processes to reflect AI use How to proactively govern: Establish oversight through committees, architecture reviews, and transparency reporting Aligning AI governance with AI security and risk: Addressing emerging areas such as AI TRiSM, API protection, model control points, and securing AI agents Speaker: Tim Mullen, CISO, OneTrust Access until: 12 pm CT on 1 May 2027

No image available

Follow the Data: A Risk-Based Approach to Auditing Governance and AI

Description: Organizations increasingly depend on data to support business decisions, regulatory compliance, cybersecurity, privacy, and AI initiatives. Yet data related audits remain underrepresented in audit plans until significant issues occur. This session provides auditors with a practical, risk-based approach to evaluate data governance and management practices across the data lifecycle. Participants will learn how to identify key risks, align audit efforts with leading frameworks, assess critical control domains, and understand how AI is impacting the data lifecycle. Attendees will be equipped with actionable strategies for incorporating data into your audit plan and delivering impactful assurance. Learning Objectives: Differentiate data governance from data management and evaluate accountability structures that influence organizational risk and audit coverage. Apply a risk-based methodology to scope and plan audits across the data lifecycle, including regulatory, operational, technology, and AI-related considerations. Assess the effectiveness of key controls supporting data quality, classification, privacy, security, retention, and regulatory compliance. Identify emerging risks associated with AI and evaluate how data governance practices influence the reliability, security, and ethical use of AI technologies. Speaker: Terry Waters, CISSP, CISA, AAIA, CDPSE, Audit Advisor, Cybersecurity and IT Risk Access until: 12 pm CT on 14 January 2027

No image available

Hyper TPRM: Rethinking Third-Party Risk for Scale, Speed, and Confidence

Description: Third-party risk management is reaching a breaking point. Vendor ecosystems are expanding faster than risk teams can keep up, risk signals are fragmented, and traditional approaches struggle to deliver the speed, coverage, and defensibility organizations now require. In this session, we introduce Hyper TPRM—a modern approach to third-party risk management built for scale. Hyper TPRM moves beyond questionnaire-driven processes by combining data-first intelligence, workflow, community-powered exchange models, and AI acceleration, with human confirmation where it matters most. Join us to learn how organizations are evolving their TPRM programs to: Prioritize vendors using dynamic, explainable risk insights Leverage shared, validated assessment data to reduce friction for vendors and internal teams Apply AI to accelerate assessments, validate evidence, and expand portfolio coverage Shift from point-in-time reviews to continuous, risk-based monitoring If you’re looking to modernize your TPRM program without compromising rigor, this session will show how Hyper TPRM enables faster decisions, broader coverage, and greater confidence across the entire third-party lifecycle. Speaker: Ed Thomas, Senior Vice President, ProcessUnity Access until: 12 pm CT on 7 July 2027

No image available

Official RIMS–ISACA Risk & AI Dual Certification Bundle October 13

Gain the knowledge to lead risk management in today’s rapidly evolving business environment in this intensive four-day Virtual Bootcamp combining RIMS-CRMP and ISACA Advanced in AI Risk™ (AAIR™) training. Participants will strengthen their enterprise risk management expertise, prepare for the RIMS-CRMP credential, and learn practical approaches for identifying, assessing, governing, and mitigating AI-related risks. -Complete two high-value professional development programs in a single week -Build expertise in both enterprise risk management and AI risk governance -Earn valuable CPE credits -Learn practical frameworks you can immediately apply -Prepare for the growing demand for AI risk management skills -Enhance your professional credibility with globally recognized training Join a community of forward-thinking professionals and gain the skills and confidence to manage today’s risks—and prepare for tomorrow’s opportunities. Includes: Exam registration for RIMS-CRMP + Registration Fee, Review Manual, QAE, Exam Fee for AAIR Days 1–2 RIMS-Certified Risk Management Professional (RIMS-CRMP) Days 3–4 ISACA Advanced in AI Risk (AAIR) Date: October 13-16, 2026 Time: 8:30-5:00 CT (GMT -6) Last date to register: Tuesday, 6 October 2026

No image available

Using AI to Tame the AI Vendor Risk Explosion

Description: Organizations are hiring more "builders," flooding vendor pipelines faster than traditional reviews can handle. The culprit: AI tools, the riskiest cohort in your stack. AI vendor adoption is rising, and more than 1 in 3 are flagged as high or critical risk. This session shows security and GRC leaders how to use AI-powered TPRM to match the pace of adoption, turning a program that's always behind into one that keeps up. What you'll learn: How the builder boom creates a new class of third-party risk How to redesign vendor review with risk tiers and automation What continuous, AI-powered monitoring looks like in practice Speaker: Ethan Heller, GTM GRC Subject Matter Expert, Vanta Access until: 12pm CT on 6 August 2027

No image available

Everything’s a P0...and That’s the Problem

Description: Security teams have more data and visibility than ever - the challenge is turning that information into confident, timely decisions. When asset context is clear, Continuous Threat Exposure Management (CTEM) becomes actionable, prioritization makes sense, and resilience follows. This session explores how asset intelligence strengthens CTEM by adding the context that security teams rely on every day: what exists, what matters, and what’s actually protected. We’ll discuss how better asset context leads to smarter prioritization, faster remediation, and measurable risk reduction. The takeaway: when you know your environment, resilience becomes achievable - and sustainable. Speaker: Teju Shyamsundar, Principal Manager, Product Marketing, Axonius Access until: 12:00pm CT on 1 April 2027

No image available

From Cybersecurity to Digital Confidence

Description: Cybersecurity is evolving from a technical control function into a strategic enabler of business resilience, trust, and long-term value. Yet organizations often struggle to translate this shift into actionable practice. This presentation introduces the Digital Confidence Framework (DCF), an integrated model that aligns cybersecurity with governance, resilience engineering, adaptive intelligence, and ecosystem risk management. The DCF provides measurable metrics, phased implementation guidance, and board-level oversight mechanisms to operationalize digital risk as a strategic capability. By connecting security investments to business outcomes such as recovery, trust, and continuity, the framework enables organizations to move beyond compliance toward sustained digital confidence and competitive advantage. After this session, attendees will be able to: Explain the shift from traditional cybersecurity to a strategic digital risk and resilience model Describe the core pillars and maturity phases of the Digital Confidence Framework (DCF) Apply DCF metrics and scorecards to assess organizational cybersecurity maturity and gaps Identify governance and board-level actions needed to align cybersecurity with business outcomes and trust. Speaker: Robert Putrus, CISM, PMP, PE, Cyber Security, Compliance, and Program Management Access until: 12 pm CT on 30 December 2026

No image available

ITAF 5: The Evolving Role of Audit in the Digital Enterprise

Description: It has been six years since the IT Audit Framework (ITAF) was last updated, and the operating environment has changed significantly. Technology now executes transactions, connects organizations through third-party ecosystems, and increasingly makes decisions through automation and AI. As a result, audit teams face new questions: Can automated outcomes be trusted? Who owns third-party risk? Why wasn’t audit involved earlier? ITAF 5 reflects these expectations. This session translates the framework into practice, explaining how assurance expands beyond traditional control testing to evaluating system-driven outcomes. Participants will learn how to adapt audit approaches and provide forward-looking risk insight while maintaining independence. Learning Objectives: Why the Framework Changed: Explain how ITAF 5 reflects the shift to digitally enabled business operations and evolving assurance expectations Where Risk Now Lives: Identify how risk moves from manual processes to system configurations, integrations, third-party platforms, and automated decisions What Auditors Must Learn: Recognize the evolving skills auditors need, including evaluating automated and AI-driven outcomes and collaborating across technical and business teams How Audit Must Adapt: Describe how audit functions should modernize their approach through analytics, continuous assurance, and supporting technology tools Speaker: Mary Carmichael, CPA, CFE, CISA, CRISM, and CISM, Director, Risk Advisory, Momentum Technology Access until: 12 pm CT on 14 October 2026

No image available

Salesloft/Drift Lessons: The 3rd & 4th Party Software Security Problem

Description: The Salesloft/Drift breach is a powerful reminder of the fragility of today’s software supply chains. Securely onboarding 3rd party commercial software and their 4th party components - is a must for today's AppSec and Risk Managers. Most organizations are still maturing their approach to commercial software risk—often relying on outdated processes that don’t scale. This webinar will help you understand your maturity curve and how to move forward with confidence. You’ll hear real-world success stories where enterprises improved efficiency by 500%+ and significantly bolstered compliance. Learning Objectives: -Pinpoint your maturity stage in managing software supply chain risk -Learn from case studies achieving 500%+ efficiency improvements -Strengthen compliance and resilience with modern practices Speakers: Charlie Jones, ChCSP, CISSP, CISA, Director of Product Management, ReversingLabs Access until: 12:00 pm CT on 11 December 2026

No image available

The Agent Economy: Autonomous Transactions & Audit

Description: Autonomous AI agents are already executing contracts, committing spend, and transacting on behalf of enterprises without human review. This session examines the agentic infrastructure now operational across leading technology and payment platforms, the six risk categories no existing audit framework fully addresses, and the governance architecture IT professionals and auditors must build to keep pace. Attendees will leave with a concrete understanding of where control environments fail in agentic systems, what continuous monitoring requires, and how to elevate governance as a strategic oversight capability in the agent economy. Learning Objectives: Identify the key infrastructure developments enabling autonomous agent transactions and explain why existing control frameworks were not designed for this operating environment. Apply the agentic risk taxonomy spanning operational, financial exposure, cyber and identity, model, regulatory, and third-party risk to assess gaps in your organization's current audit universe. Evaluate governance architecture requirements for agentic systems including authority boundaries, bidirectional monitoring, credential scoping, and continuous assurance design. Develop a pre-deployment governance checklist and continuous audit approach for agentic AI systems operating at machine speed. Speaker: Tibyasa Matovu, AAIA, CISA, CCEP, MBA, Chief Audit Executive, Wahoo Audit Access until: 12 pm CT on 19 November 2026

No image available

Official AAIR Bundle Virtual Workshop November 12

Join us for an immersive 2-day virtual training event that explore topics around the ISACA Advanced in AI Risk™ certification (AAIR™). This course builds upon existing IT risk best practices and focuses on validating expertise necessary to identify and evaluate AI risk for responsible enterprise adoption. Enrollment includes the AAIR Review Manual (eBook edition), AAIR Questions, Answers and Explanations Database (QAE) as well as the exam cost. Date: November 12-13, 2026 Time: 8:30-5:00 CT (GMT -6) Transfer Date: Wednesday, 4 November 2026 Cancellation Date: Wednesday, 4 November 2026 Last Date to Register: Wednesday, 4 November 2026

No image available

The State of Artificial Intelligence

Description: Artificial Intelligence is moving fast and increasingly adopted in businesses, significantly improving efficiency in many industries, including finance, retail, healthcare and manufacturing. What is real and what is just hype? What should business leaders consider as they lead their organizations in the adoption of this technology? Why is AI governance the key to success? This webinar will cover some of the major advancements in artificial intelligence in 2025 and key insights on where AI is headed and recommend both strategic and tactical steps to take as we move into 2026. Learning Objectives: -Gain an understanding of what business decisions are important when implementing an AI solution. -Learn how to adapt your strategy and prepare your teams for the next wave of AI innovation. -Gain a clear understanding of the necessary roles and responsibilities needed to implement a successful AI governance structure. Speakers: Jon Brandt, CISM, CDPSE, CCISO, CISSP, PMP, Director, Professional Practices and Innovation, ISACA Andrew Clark, Co-Founder and Chief Technology Officer, Monitaur Access until: 12:00pm CT on 09 December 2026

No image available

Using CMMI & COBIT to Comply with the New UK Codes of Practices

Description: This webinar will explore how CMMI and COBIT can support compliance with the Cyber Governance and Software Security Codes of Practice (CoPs). Participants will gain practical insights into applying these frameworks to align with evolving cybersecurity expectations. The session will also feature contributions from the UK Department of Science, Innovation and Technology (DSIT), who will provide an overview of the content and intent of the two Codes, and key ISACA contributors to the design process. Speakers will share expert perspectives on implementation challenges and opportunities. Learning Objectives: -Understand the structure and intent of the Cyber Governance and Software Security CoPs. -See how CMMI or COBIT can support compliance with the Codes’ principles, while enabling a single integrated approach to meet multiple standard requirements. -Learn practical steps for applying governance frameworks in cybersecurity programs. -Gain insights from the Code drafting process and expected implementation outcomes. Speakers: Ron Lear, CHMLA, LSSGB, ISO Lead Auditor, Vice President, Models and Frameworks, CMMI Institute Dr. Lorna Kirkby, Senior Policy Advisor on Software Security, UK Department of Science, Innovation and Technology Alessandro Colasanti, Senior Policy Advisor on Software Security, Department for Science, Innovation and Technology Kieran Doyle, CMMI High Maturity Lead Appraiser, Certified CMMI Instructor, Chartered Quality, Professional and Member of the Chartered Quality Institute, Fellow of the Royal Statistical Society Managing Director, Excellence in Measurement Technology Pieter Roos, MCom, CISA, CGEIT, CIA, CMMI Lead Appraiser, COBIT 2019 Foundation Certificate; ITIL 4 Managing Professional, Director, Demix Jack Harrigan, Head of Cyber Governance, Department for Science, Innovation and Technology Access until: 12:00 PM CT 18 November 2026

No image available

Maximize Microsoft 365 Security Outcomes with Core Email Protection

Descriptions: Over 90% of CISOs say they’ve implemented additional security controls beyond Microsoft 365’s native capabilities to protect email and collaboration tools. This reflects a growing recognition that adopting a layered defense-in-depth strategy is critical to defend against advanced threats like business email compromise (BEC), credential phishing, and insider-driven data loss. Watch this 60-minute session and learn how an API-based email security solution can augment native Microsoft threat detection and improve operational workflows without disrupting existing infrastructure. You’ll learn: -How API-based email security integrations can improve threat detection in M365 -What types of advanced threats are increasingly bypassing native defenses -Ways to enhance efficiency and response times through a layered approach Speakers: Monica Gupta, Senior Product Marketing Manager, Proofpoint Andrew Goodman, Director, Product Marketing, Proofpoint Access until: 12:00PM CT on 1 December 2026

No image available

Official AAIR Bundle Virtual Workshop August 26

Join us for an immersive 2-day virtual training event that explore topics around the ISACA Advanced in AI Risk™ certification (AAIR™). This course builds upon existing IT risk best practices and focuses on validating expertise necessary to identify and evaluate AI risk for responsible enterprise adoption. Enrollment includes the AAIR Review Manual (eBook edition), AAIR Questions, Answers and Explanations Database (QAE) as well as the exam cost. Dates: August 26-27, 2026 Time: 8:30-5:00 CT (GMT -6) Transfer Date: Wednesday, 12 August 2026 Cancellation Date: Wednesday, 12 August 2026 Last Date to Register: Wednesday, 19 August 2026

Shop AllEventsHarmonizing Risk and Compliance: Unifying Infosec Programs Through Automation