Who should do CISA certification

From an IT audit perspective, CISA certification is designed for professionals who focus on auditing, controlling, and evaluating information systems.

• I'd recommend it to IT auditors first and foremost, as it's the gold standard in this field.
• Compliance officers managing regulatory requirements definitely benefit from the credential, showing they understand IT controls in depth. 
• Risk managers overseeing organizational security frameworks find tremendous value in CISA knowledge.
• Internal control professionals responsible for assessing IT system controls should seriously consider it.
• Information security professionals transitioning toward audit and governance roles use CISA to formalize their expertise.
• Government employees working in audit departments often pursue this certification.
• System administrators moving into audit roles find CISA relevant.

The certification isn't ideal for pure technical security roles like penetration testers unless they're moving into audit. You need five years of IT audit, control, or security experience to qualify. Anyone interested in governance positions or management-level roles in IT security should consider CISA as a valuable stepping stone for their career progression.