ISACACertified in Risk and Information Systems Control
The Certified in Risk and Information Systems Control (CRISC) certification validates your expertise in identifying and managing enterprise IT risk and implementing and maintaining information systems controls. Designed for mid to advanced-career IT professionals focused on IT and cyber risk, CRISC equips you to enhance business resilience, deliver stakeholder value, and address emerging technologies like AI. Earning CRISC demonstrates your ability to optimize risk management across the enterprise and positions you among the top-paying certified professionals worldwide.
608 practice questions · Updated 2026-07-30
4Domains
20Objectives
155Concepts
608Questions
CRISC Curriculum
Every domain, objective, and concept the CRISC exam measures.
- Strategy, Goals, and Objectives
- Organizational Structure
- Roles and Responsibilities
- Organizational Culture and Ethics
- Policies and Standards
- Enterprise Risk Management (ERM)
- Lines of Defense
- Risk Profile
- Risk Appetite and Risk Tolerance
- Risk Frameworks
- Legal, Regulatory, and Contractual Requirements
- Business Continuity Planning (BCP)
- Disaster Recovery Planning (DRP)
- Business Impact Analysis (BIA)
- Recovery Time Objective (RTO) and Recovery Point Objective (RPO)
- BCP/DRP Testing and Maintenance
- Organizational Asset Management
- Asset Inventory and Ownership
- Asset Classification and Criticality
- Asset Lifecycle Management
- Definition of Risk Events
- Types of Risk Events
- Risk Event Identification
- Risk Event Analysis
- Risk Event Documentation
- Risk Event Monitoring
- Risk Event Response
- Threat Modeling Fundamentals
- Threat Modeling Methodologies
- Threat Modeling Process
- Threat Landscape Analysis
- Threat Intelligence Sources
- Integrating Threat Modeling with Risk Assessment
- Vulnerability Identification
- Vulnerability Analysis
- Vulnerability Prioritization
- Vulnerability Remediation
- Vulnerability Reporting
- Vulnerability Management Lifecycle
- Risk Scenario Definition
- Risk Scenario Components
- Risk Scenario Development Process
- Risk Scenario Evaluation Criteria
- Risk Scenario Prioritization
- Risk Scenario Documentation
- Risk Scenario Use in Risk Assessment
- Risk Scenario Limitations
- Risk Assessment Concepts
- Risk Assessment Standards
- BIA Purpose and Objectives
- BIA Process Steps
- Identifying Critical Business Functions
- Dependency Analysis
- Impact Assessment
- Recovery Time Objective (RTO)
- Recovery Point Objective (RPO)
- BIA Data Collection Methods
- BIA Documentation and Reporting
- BIA Integration with Risk Assessment
- Purpose of a Risk Register
- Key Components of a Risk Register
- Risk Register Data Inputs
- Risk Register Maintenance
- Risk Register Ownership and Accountability
- Risk Register Reporting and Communication
- Integration with Risk Management Process
- Risk Analysis Methodologies Overview
- Quantitative Risk Analysis
- Qualitative Risk Analysis
- Semi-Quantitative Risk Analysis
- Selecting Appropriate Methodology
- Definition of Inherent Risk
- Definition of Residual Risk
- Relationship Between Inherent and Residual Risk
- Calculating Residual Risk
- Risk Assessment Process
- Importance of Distinguishing Inherent and Residual Risk
- Risk Response Options
- Risk Response Selection Criteria
- Risk and Control Ownership
- Risk Action Plans
- Risk Action Plan Monitoring
- Vendor Risk Management Framework
- Third-Party Risk Identification
- Vendor Risk Assessment
- Vendor Due Diligence
- Contractual Risk Mitigation
- Vendor Monitoring and Review
- Supply Chain Risk Management
- Incident Response in Vendor Relationships
- Vendor Termination and Exit Management
- Issue Management
- Finding Management
- Exception Management
- Exemption Management
- Control Frameworks
- Control Types
- Control Standards
- Control Design
- Control Selection
- Control Implementation
- Control Analysis
- Control Testing Methodologies
- Testing Evidence and Documentation
- Testing Results and Remediation
- Data Collection for Risk Monitoring
- Data Aggregation and Analysis
- Data Validation Techniques
- Key Risk Indicators (KRIs)
- Key Control Indicators (KCIs)
- Key Performance Indicators (KPIs)
- Risk Monitoring Techniques
- Control Monitoring Techniques
- Risk Reporting Techniques
- Heatmap Reporting
- Scorecard Reporting
- Dashboard Reporting
- Monitoring Emerging Risks
- Reporting Emerging Risks
- Technology Principles
- Aligning Technology Principles with Business Goals
- Technology Roadmaps
- Developing and Maintaining Technology Roadmaps
- Enterprise Architecture (EA) Frameworks
- EA and Risk Management
- Emerging Technologies Identification
- Evaluating Emerging Technologies
- Integrating Emerging Technologies
- Change Management
- Asset Management
- DevOps Practices
- Problem Management
- Incident Management
- SDLC Phases
- SDLC Security Integration
- Data Lifecycle Stages
- Data Protection Controls
- Portfolio Management
- Project Management
- Agile Methodologies
- Technology Resilience Fundamentals
- Disaster Response Planning
- Disaster Recovery Strategies
- Recovery Objectives (RTO/RPO)
- Business Impact Analysis (BIA) for Technology
- Testing and Exercising Recovery Plans
- Incident Response and Recovery Coordination
- Security Concepts
- Security Frameworks
- Security Standards
- Security Awareness and Training
- Security Training Implementation
- Data Privacy Principles
- Data Protection Principles
- Privacy and Data Protection Frameworks
Ready to practice?Test your knowledge with exam-style questions or take an intelligent quiz tailored to your level.
Percentages reflect share of the current practice bank, not official exam weightings — no structured per-skill weight is published for CRISC, so none is invented.