_edited.png)
CRISC® by ISACA® teaches expertise in identifying and managing enterprise
IT risk and implementing and maintaining information systems controls.
Online CRISC ISACA Training & Certification
Only $1,995 Training + Exam
What is CRISC Certification by ISACA?
Certified in Risk and Information Systems Control or CRISC is a globally recognised certification that validates expertise in designing, implementing and maintaining information security programs to protect against risks.
Professionals who earn the ISACA CRISC certification have proven their ability to identify
and manage risks across the entire enterprise.
#4
Top Paying
Certification
Worldwide
$151k
Average Salary
of a CRISC Certified Person
What You'll Learn from CRISC
Domain 1: Corporate IT Governance (26%)
The governance domain interrogates your knowledge of information about an organization’s business and IT environments, organizational strategy, goals and objectives, and examines potential or realized impacts of IT risk to the organization’s business objectives and operations, including Enterprise Risk Management and Risk Management Framework.
A: Organisational Governance
-
Organizational Strategy, Goals, and Objectives
-
Organizational Structure, Roles and Responsibilities
-
Organizational Culture
-
Policies and Standards
-
Business Processes
-
Organizational Assets
B: Risk Governance
-
Enterprise Risk Management and Risk Management Framework
-
Three Lines of Defense
-
Risk Profile
-
Risk Appetite and Risk Tolerance
-
Legal, Regulatory and Contractual Requirements
-
Professional Ethics of Risk Management
Domain 2: IT Risk Assessment (20%)
This domain will certify your knowledge of threats and vulnerabilities to the organization’s people, processes and technology as well as the likelihood and impact of threats, vulnerabilities and risk scenarios.
A: IT Risk Identification
-
Risk Events (e.g., contributing conditions, loss result)
-
Threat Modelling and Threat Landscape
-
Vulnerability and Control Deficiency Analysis (e.g., root cause analysis)
-
Risk Scenario Development
B: IT Risk Analysis & Evaluation
-
Risk Assessment Concepts, Standards and Frameworks
-
Risk Register
-
Risk Analysis Methodologies
-
Business Impact Analysis
-
Inherent and Residual Risk
Domain 3: Risk Response and Reporting (32%)
This domain deals with the development and management of risk treatment plans among key stakeholders, the evaluation of existing controls and improving effectiveness for IT risk mitigation, and the assessment of relevant risk and control information to applicable stakeholders.
A: Risk Response
-
Risk Treatment / Risk Response Options
-
Risk and Control Ownership
-
Third-Party Risk Management
-
Issue, Finding and Exception Management
-
Management of Emerging Risk
B: Control Design & Implementation
-
Control Types, Standards and Frameworks
-
Control Design, Selection and Analysis
-
Control Implementation
-
Control Testing and Effectiveness Evaluation
C: Risk Monitoring & Reporting
-
Risk Treatment Plans
-
Data Collection, Aggregation, Analysis and Validation
-
Risk and Control Monitoring Techniques
-
Risk and Control Reporting Techniques (heatmap, scorecards, dashboards)
-
Key Performance Indicators
-
Key Risk Indicators (KRIs)
-
Key Control Indicators (KCIs)
Domain 4: Information Technology and Security (22%)
In this domain we interrogate the alignment of business practices with Risk Management and Information Security frameworks and standards, as well as the development of a risk-aware culture and implementation of security awareness training.
A: Information Technology Principles
-
Enterprise Architecture
-
IT Operations Management (e.g., change management, IT assets, problems, incidents)
-
Project Management
-
Disaster Recovery Management (DRM)
-
Data Lifecycle Management
-
System Development Life Cycle (SDLC)
-
Emerging Technologies
B: Risk Governance
-
Enterprise Risk Management and Risk Management Framework
-
Three Lines of Defense
-
Risk Profile
-
Risk Appetite and Risk Tolerance
-
Legal, Regulatory and Contractual Requirements
-
Professional Ethics of Risk Management
Who Is This CRISC
ISACA Course for?
Why Should I Take CRISC Training?
CRISC is a globally recognised, world-leading certification for advancing your career in information security.
It enhances your skills as a well-rounded security professional and increases your attractiveness to potential employers by showcasing your expertise in identifying, assessing, and responding to risk.
CRISC is an outstanding certification for advancing your career in information security. It enhances your skills as a well-rounded security professional and increases your attractiveness to potential employers by showcasing your expertise in identifying, assessing, and responding to risk.
Through this CRISC Course you will Explore:
Domain 1: Corporate IT Governance (26%)
What are the goals and objectives of the organization and how will risk management align with them?
What structure will be put in place to oversee risk management activities?
Who is responsible for the different aspects of risk management?
Better yet, who is the person who makes the decision on how to respond to the risk? Who is accountable?
What is the organization’s risk profile, and how will you monitor for changes to it?
What is the organization’s risk capacity and tolerance levels?
How does risk management fit with the legal, regulatory and contractual requirements of the organization?
Domain 2: IT Risk Assessment (20%)
How do you identify risk?
What are risk scenarios and how can you use one to understand risks and potential impact?
What is the root cause of the risk?
Understanding different risk assessment methodologies
Domain 3: Risk Response and Reporting (32%)
What are the different options for responding to and treating risk, and why would you choose one over the other?
What risks do third parties and emerging technologies present?
What is a risk treatment plan?
How do you select the appropriate controls including design, implementation and testing?
How do you monitor risk, including your chosen risk treatment plan to ensure that it is reducing risk to the desired level?
What are the different types of indicators to monitor your risk management activities?
Domain 4: Information Technology and Security (22%)
Overview of key cybersecurity concepts:
What are core aspects of information technology operations and what risks do they present and/or treat?
What are the different cybersecurity frameworks and standards that can aid your activities?
How does risk management fit into project management and the systems development lifecycle?
Privacy and business continuity management concepts
Prerequisites for CRISC by ISACA
There are no formal prerequisites for attending the CISM course or sitting for the exam. This practice is accepted and encouraged by ISACA.
However, to be eligible for CRISC certification you must have three or more years of experience in IT risk management and information system control.
If you don't have this experience then you can still take the CRISC course and exam. If you wish to certify, then you have 5 years in which to do so after passing the exam.
The CRISC Course is ideal for professionals managing risks associated with information technology in any industry.
CISM is typically chosen by enterprise risk managers, information security auditors, information security analysts, compliance officers, chief information security officers (CISOs) and other IT or cybersecurity professionals.
Frequently Asked Questions
1. What is the cost of the CRISC certification course?
The cost of the CRISC certification course is $1,995.
2. What is the duration of the CRISC training course?
The CRISC training course takes 5 days.
3. What is included in the CRISC training course?
The course includes official courseware, labs, practice exams, and the CRISC certification exam.
4. What are the subjects covered in the CRISC certification?
The CRISC certification covers the following four domains:
-
IT Risk Identification
-
IT Risk Assessment
-
Risk Response and Mitigation
-
Risk and Control Monitoring and Reporting
5. Is the CRISC training course conducted online?
Yes, all CRISC training courses are conducted live online to keep costs to a minimum for customers.
6. Who should take the CRISC certification course?
The course is ideal for IT professionals responsible for managing enterprise risk, including network architects, information security managers, and IT risk managers.
7. What are the prerequisites for attending the CRISC training course?
There are no formal prerequisites for attending the CRISC course and sitting for the exam.
8. How do I become CRISC certified?
To become CRISC certified, you must:
-
Pass the CRISC exam
-
Adhere to ISACA's Code of Professional Ethics
-
Agree to comply with the Continuing Professional Education Policy
-
Accumulate sufficient work experience in IT risk management
-
Submit an application for CRISC certification within 5 years of passing the exam
9. What work experience is required for CRISC certification?
You need a minimum of three years of work experience in at least two of the CRISC domains. This experience must be gained within the ten years preceding the application date or within five years of passing the exam.
10. Are there any substitutions for the work experience requirement?
Yes, certain certifications and experience can substitute for up to two years of the work experience requirement, including certifications like CISA or CISSP and postgraduate degrees in information security or related fields.
11. What are the benefits of obtaining the CRISC certification?
Benefits include recognition of advanced risk management skills, worldwide recognition as a competent IT risk manager, career growth opportunities, and the potential for a salary increase or promotion.
12. How can I prepare for the CRISC exam?
ISACA offers various resources, including group training, self-paced training, study materials, and an online community for exam guidance.
13. What is the format of the CRISC exam?
The CRISC exam consists of 150 multiple-choice questions and has a duration of 4 hours. The exam is available in multiple languages, including English, Spanish, Japanese, Korean, and Chinese (Simplified).
14. How do I register for the CRISC exam?
You can register for the CRISC exam through the ISACA website.
15. What continuing education is required to maintain the CRISC certification?
CRISC certification holders must comply with the Continuing Professional Education (CPE) policy, which requires earning a specific number of CPE hours annually to maintain their certification.