CRISC (Certified in Risk and Information Systems Control)
Demonstrate expertise in enterprise IT risk governance, risk assessment, risk response and reporting, information technology and security controls, and business resilience.
Official Exam Specification & Quick Facts
Question Difficulty Breakdown
Exam Guidelines & Simulation Rules
Frequently Asked Questions (FAQ)
CRISC is an enterprise risk management credential offered by ISACA validating expertise in identifying, evaluating, responding to, and monitoring information technology and enterprise business risks.
The CRISC exam consists of 150 multiple-choice questions to be completed within 4 hours (240 minutes) administered online or at PSI testing centers.
The passing score is 450 on a scaled score range of 200 to 800 (approximately 75%).
Domains include: (1) Governance (26%), (2) IT Risk Assessment (20%), (3) Risk Response and Reporting (32%), and (4) Information Technology and Security (22%).
CISM focuses on managing the entire information security program. CRISC focuses specifically on identifying, evaluating, and mitigating risk across all enterprise information systems and business processes.
Inherent Risk is the risk level that exists before any controls or countermeasures are applied. Residual Risk is the remaining risk that exists after management has implemented internal controls.
KRIs are forward-looking metrics providing early warning signals that an organization's risk exposure is increasing or approaching its defined risk tolerance boundaries.
Risk Mitigation (applying controls), Risk Transfer (purchasing cyber insurance or outsourcing), Risk Avoidance (stopping the risky activity), and Risk Acceptance (consciously tolerating residual risk).
Risk Appetite is the broad level of risk executive leadership is willing to accept in pursuit of enterprise value. Risk Tolerance is the acceptable deviation from that target level for specific initiatives.
A centralized repository cataloging identified IT risks, their root causes, potential impacts, current controls, risk owners, and assigned remediation response plans.
Candidates must have a minimum of 3 years of cumulative work experience across at least two CRISC domains, with at least one in Governance or IT Risk Assessment.
Risk managers, compliance professionals, security managers, IT auditors, operations managers, and business analysts responsible for enterprise risk management.