Skip to Content

Certified in Risk and Information Systems Control (CRISC)  


Request for price


Length: 5 day (40 hours)

 

This course provides a comprehensive framework for aligning IT risk management with broader business goals. It moves beyond technical security to focus on Business Resilience. You will learn to identify vulnerabilities, prioritize them based on business impact, and design cost-effective controls that don't stifle innovation.

The current 2026 syllabus is structured around four updated domains, with a heightened emphasis on Risk Reporting and Emerging Technology (Cloud, AI, and IoT).

To become fully certified, ISACA requires a combination of passing the exam and verifiable professional experience:

  • Work Experience: A minimum of 3 years of professional experience in IT risk management and IS control.
  • Domain Coverage: This experience must span at least two of the four CRISC domains.
  • Waivers: Unlike some other certifications, there are no substitutions or waivers (like degrees or other certs) for the three-year experience requirement.
  • The 5-Year Rule: You can take the exam first, but you must fulfill and submit your experience requirements within five years of passing.

CRISC is specifically designed for professionals who "own" or manage risk rather than just auditing it.

  • IT Risk Managers & Analysts: Those responsible for identifying and evaluating enterprise-wide exposure.
  • Information Security Managers (CISM): Professionals looking to bridge the gap between technical security and business risk.
  • Compliance & Privacy Officers: Individuals ensuring the organization meets legal (GDPR, CCPA) and industry standards.
  • Project Managers & Business Analysts: Who need to integrate risk assessment into the System Development Life Cycle (SDLC).
  • Chief Risk Officers (CROs): Executive-level leaders focused on business continuity and risk appetite.
Course objectivesCourse outlines

Course objectives

After completing this course, students will be able to:

      • Establish Governance: Design and maintain a risk management framework that aligns with organizational culture and strategy.
      • Conduct Precision Assessments: Use quantitative and qualitative methodologies to identify threats and develop realistic risk scenarios.
      • Optimize Risk Response: Choose the best strategy (Avoid, Mitigate, Transfer, or Accept) based on cost-benefit analysis.
      • Monitor with Metrics: Develop and track Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs) to provide actionable reports to stakeholders.
      • Secure Modern Tech: Evaluate and manage the unique risks associated with AI data ethics, Cloud migrations, and Third-party vendors.

Course outlines

    • Domain 1: Governance
      • Organizational Strategy: Aligning risk appetite with business goals.
      • Risk Culture: Promoting ethics and accountability across the enterprise.
      • Legal & Regulatory: Navigating global privacy laws and contractual requirements.
    • Domain 2: IT Risk Assessment
      • Risk Identification: Threat modeling and vulnerability analysis.
      • Scenario Development: Creating "What-if" scenarios for potential business impacts.
      • Analysis Methodologies: Mastering Inherent vs. Residual risk evaluations.
    • Domain 3: Risk Response and Reporting
      • Response Strategies: Designing and implementing effective IS controls.
      • Control Monitoring: Testing the maturity and effectiveness of safeguards.
      • Stakeholder Reporting: Using heatmaps and dashboards to communicate risk to the board.
    • Domain 4: Technology and Security
      • Enterprise Architecture: Understanding the risk footprint of the IT landscape.
      • Data Lifecycle: Managing risks from data creation to destruction (Privacy/Protection).
      • Emerging Trends: Security implications of Generative AI, Blockchain, and IoT.


Download Outlines