CRISC candidates often study from material written for the previous exam weights, assume the exam alone makes them certified, or let the credential lapse over an unpaid fee or a missing year of CPE. This guide sets out what ISACA publishes about the Certified in Risk and Information Systems Control: the 150-question exam, the four domains and their weights in the outline used since 3 November 2025, the three-year experience rule, fees, the application window and the CPE cycle. It adds a phased preparation plan and career context for risk, control, security and audit practitioners deciding whether to sit the exam, and for managers who fund or require it. Facts are taken from isaca.org pages checked on 24 October 2026; ISACA changes fees and policies, and a new CPE policy takes effect on 1 January 2027, so confirm on the linked ISACA pages before you book.
Key takeaways
- It certifies IT risk management, not technical security. CRISC tests how you govern, assess, respond to and report IT risk and how you design and monitor controls; the largest domain, Risk Response and Reporting, carries 32% of the exam.
- The outline changed on 3 November 2025. ISACA kept the same four domains but moved two points of weight from Technology and Security (now 20%) to Risk Assessment (now 22%), so check that your study material is dated for the current outline.
- Passing is only half the process. You need three or more years of CRISC work experience across at least two of the four domains, gained in the ten years before you apply, verified by a supervisor or manager; ISACA's pages list no experience waivers.
- Windows are long but finite. Exam eligibility lasts six months from registration, and you must apply for certification within five years of passing.
- Maintenance is yearly as well as three-yearly. Holders report at least 20 CPE hours each year and 120 over three years, and pay an annual maintenance fee (US$45 for members, US$85 for non-members) due by 1 January; missing either can lead to revocation.
Who the certification is for
ISACA positions CRISC for professionals in IT-related business risk management roles and states that many organisations and government agencies require it. ISACA reports that more than 45,000 professionals have earned CRISC since it launched (April 2025 announcement). The domain content (enterprise risk management, risk appetite, risk registers, control testing, key risk indicators) points to a fairly clear set of roles.
- Good fit: IT risk analysts and managers, second-line technology risk teams, control owners and control testers, GRC programme leads and security managers who already run risk assessments and want a credential that matches that work. See the Three Lines Model for Cyber Risk Guide.
- Good fit for auditors moving across: IT auditors who hold or are working towards CISA and are moving from assurance into risk ownership or advisory roles. See the CISA Certification Guide.
- Weaker fit: engineers and analysts who want to prove hands-on technical skill. CRISC Domain 4 covers technology and security principles at a conceptual level; a technical credential suits that goal better. See the Cybersecurity Certifications Guide.
- Identity and NHI teams: risk owners for identity programmes (machine identities, service accounts, access reviews) use CRISC concepts directly: risk scenarios, control ownership, exception management and KRIs. The exam does not test identity tooling.
Exam format and domains
Format and logistics
| Item | What ISACA publishes | ISACA page |
|---|---|---|
| Number of questions | 150 | CRISC exam content outline |
| Delivery | Computer-based, at authorised PSI test centres or remotely proctored | CRISC certification page |
| Registration | Continuous, any time; eligibility is set at registration and lasts six months | CRISC certification page |
| Scheduling | From 48 hours after paying the registration fee; appointments open up to 90 days ahead; free rescheduling within the eligibility period if done at least 48 hours before the appointment | CRISC certification page |
| Identification | The name on your ISACA account must match the government-issued ID you present on exam day | CRISC certification page |
| Current outline | Updated exam available from 3 November 2025 (prep materials from 3 September 2025, when older prep materials were withdrawn) | ISACA press release, April 2025 |
| Duration and passing score | Not stated on the ISACA pages checked; take them from the current ISACA Exam Candidate Guide | Check ISACA |
The four domains (outline effective 3 November 2025)
| Domain | Weight | Subdomains and main topics (ISACA outline) |
|---|---|---|
| 1. Governance | 26% | 1A Organizational Governance: strategy and objectives, structure and roles, culture and ethics, policies and standards, business processes and resilience (DRP, BCP), asset management. 1B Risk Governance: enterprise risk management, lines of defence, risk profile, risk appetite and tolerance, risk frameworks and legal, regulatory and contractual requirements |
| 2. Risk Assessment | 22% (was 20%) | 2A Risk Identification: risk events, threat modelling and threat landscape, vulnerability management, risk scenario development. 2B Risk Analysis: assessment concepts and standards, business impact analysis, risk register, analysis methodologies, inherent and residual risk |
| 3. Risk Response and Reporting | 32% | 3A Risk Response: response options, risk and control ownership, vendor and supply chain risk, issues, findings, exceptions and exemptions. 3B Control Design and Implementation: control frameworks and types, design, selection and testing. 3C Risk Monitoring and Reporting: action plans, data aggregation and validation, KRIs, KCIs and KPIs, heatmaps, scorecards and dashboards, emerging risk |
| 4. Technology and Security | 20% (was 22%) | 4A Technology and Security: enterprise architecture and roadmaps, operations, SDLC, data lifecycle, project management including Agile, technology resilience, emerging technologies. 4B Information Security Principles: security frameworks and standards, awareness and training, data privacy and protection principles |
The outline also lists task statements, including building IT risk scenarios, maintaining the risk register, judging whether risk exceeds appetite or tolerance, agreeing treatment plans and indicators with risk and control owners, validating that responses follow action plans, and facilitating tabletop exercises. Questions are scenario based: expect to choose the best next step for a risk practitioner, not the most technical answer.
Prerequisites and experience
You can sit the exam before you have the experience. Certification itself needs the following, as listed on ISACA's "Get CRISC certified" page.
- Pass the exam: within the last five years at the time you apply.
- Experience: three or more years of CRISC professional work experience across at least two of the four CRISC domains, gained within the ten years before your application date.
- Verification: your supervisor or manager verifies the experience.
- Application: submitted within five years of passing, with a one-time US$50 application processing fee paid through MyISACA after official scores are released.
- Ethics and CPE: agree to the ISACA Code of Professional Ethics and the Continuing Professional Education Policy.
The ISACA pages checked list no experience waivers or substitutions for CRISC. Some older study material and third-party sites describe waivers; do not rely on them unless ISACA confirms them in writing.
- Write experience in domain language: describe work as risk identification, scenario analysis, control design, control testing or risk reporting, so a verifier and ISACA can map it to the domains.
- Pick two strong domains: most applicants have clear evidence in Risk Assessment and Risk Response and Reporting; that is enough to meet the "at least two" rule.
- Line up the verifier early: a former manager may be hard to reach years later, which is a common reason applications stall.
Preparation plan
The plan below assumes a working risk or control practitioner. ISACA's official resources are the CRISC Review Manual (8th edition), the Questions, Answers and Explanations database (833 questions, six-month subscription), a self-paced online review course, a free ten-question practice quiz and Engage study groups for members. Timings are our guidance, not ISACA's.
- Week 1, baseline: read the current exam content outline, confirm your material is for the November 2025 outline, and take the free quiz to see how ISACA phrases questions.
- Weeks 2 to 4, Governance and Risk Assessment (48% together): study ERM, lines of defence, appetite versus tolerance, scenario building, BIA and inherent versus residual risk. Relate each topic to a real assessment you have run. See the ISO 31000 Risk Management Guide and the Cyber Risk Appetite Statement Template.
- Weeks 5 to 7, Risk Response and Reporting (32%): response options (accept, mitigate, transfer, avoid), control ownership, exception and exemption handling, third-party risk, control testing and KRI, KCI and KPI design. See the Third-Party Risk Management Guide and the Board Cyber Risk Reporting Guide.
- Week 8, Technology and Security (20%): revise architecture, SDLC, data lifecycle, resilience and security principles at the level of a risk owner who must judge them, not build them.
- Weeks 9 to 10, practice under exam conditions: work through the question database by domain, then mixed. For every wrong answer write down why the ISACA answer is the better risk practitioner decision.
- Final week: rest the weak domain, re-read the outline, check ID and the PSI or remote proctoring requirements, and book within your six-month eligibility.
| Readiness signal | What to look for |
|---|---|
| Domain coverage | Every subdomain (1A to 4B) studied at least once and revisited after practice questions |
| Practice scores by domain | No domain trailing the others; weight weak areas by the exam percentages |
| Reasoning quality | You can explain why the right answer is the risk practitioner's choice, not just recall it |
| Timing | Comfortable pace across a full mixed set of practice questions |
| Admin | Account name matches ID, eligibility window and appointment confirmed |
Cost, renewal and continuing education
| Cost or rule | ISACA member | Non-member |
|---|---|---|
| Exam registration | US$575 | US$760 |
| Application processing fee (one-time, after passing) | US$50 | US$50 |
| Annual maintenance fee | US$45 (US$25 for a third or later ISACA certification) | US$85 (US$50 for a third or later) |
| Reinstatement after revocation, if an appeal is approved | Outstanding fees plus a US$50 reinstatement fee | |
- CPE hours: at least 20 CPE hours each year and 120 CPE hours related to CRISC over a three-year reporting period.
- Fee timing: the maintenance fee is due by 1 January each year; ISACA starts invoicing in September for the following year.
- Audit: ISACA randomly selects holders to document all activities reported for a given year. Keep evidence for 12 months after each three-year cycle ends. Not complying with an audit leads to revocation.
- Revocation: a revoked holder may not present themselves as certified, and verification requests show the revoked status. If an appeal is refused, you must pass the exam again and reapply.
- Activity caps: ISACA's CPE page caps some activities per year (for example 10 hours for vendor sales or marketing presentations and 10 for mentoring) while ISACA conferences, other education, self-study and teaching are uncapped. CPE can be reported in quarter-hour increments.
- Policy change: ISACA states that a new CPE policy takes effect on 1 January 2027. Read it on isaca.org before planning your next cycle; this guide does not summarise it.
Where it fits on the career path
CRISC sits in ISACA's management-level family alongside CISA (audit), CISM (security management) and CGEIT (governance of enterprise IT). The choice depends on which side of the three lines you work on.
| Credential | Core focus | Typical role | Choose it when |
|---|---|---|---|
| CRISC | IT risk identification, assessment, response, control monitoring | Technology risk manager, control owner, second line | You own or advise on risk decisions and controls |
| CISA | Information systems audit and assurance | IT auditor, third line | You test and report on controls independently |
| CISM | Information security programme management | Security manager, CISO track | You run the security programme |
| CGEIT | Governance of enterprise IT | Senior IT governance and executive roles | You set IT governance at board or executive level |
| CDPSE | Privacy engineering and data lifecycle | Privacy engineer, architect | You build privacy into systems |
- Before CRISC: broad foundations and some years in security, audit or IT operations. See the Cybersecurity Careers Guide.
- Alongside CRISC: quantitative methods make CRISC skills more useful in board reporting. See the Cyber Risk Quantification Guide.
- After CRISC: CISM for security leadership, CGEIT for governance, or ISACA's AI credentials where AI risk is now part of the role. See the CISM Certification Guide, the CGEIT Certification Guide and the ISACA AAISM and AAIA AI Certifications Guide.
Common failure patterns
- Old weights, old books: studying a pre-November 2025 edition without checking the outline; the topics are close, but emphasis and terms shift.
- Answering as an engineer: picking the most technical fix when the question asks what the risk practitioner should do first, which is usually to understand context, ownership and appetite.
- Letting eligibility expire: registering, then not booking within six months.
- Thin experience records: descriptions that do not map to at least two domains, or no reachable verifier.
- Front-loading CPE: doing 120 hours in year three and missing the 20-hour annual minimum in earlier years, or not keeping evidence for an audit.
Practitioner checklist
- Read the current CRISC exam content outline and confirm all study material is for the outline used since 3 November 2025.
- Map your last ten years of work to the four domains and confirm at least three years across two or more of them.
- Identify and contact the supervisor or manager who will verify your experience.
- Check fees and the current Exam Candidate Guide on isaca.org (duration, ID and proctoring rules) before registering.
- Book the exam within the six-month eligibility window, with ID matching your ISACA account.
- Weight study time by domain percentage, with Risk Response and Reporting first.
- Apply within five years of passing and pay the US$50 processing fee after scores are released.
- Log at least 20 CRISC-related CPE hours every year, keep evidence, and pay the maintenance fee before 1 January.
- Read ISACA's 2027 CPE policy before your next reporting cycle.
Standards and references
- ISACA: CRISC Exam Content Outline
- ISACA: CRISC Certification
- ISACA: Get CRISC Certified
- ISACA: How Do I Maintain My CRISC?
- ISACA: ISACA Updates CDPSE and CRISC Exams to Reflect Latest Risk and Privacy Priorities
- ISACA: How to Earn CPE
- ISACA: Code of Professional Ethics
Related NHI Mgmt Group resources: Cybersecurity Certifications Guide · CISM Certification Guide · CDPSE Certification Guide · ISACA AAISM and AAIA AI Certifications Guide · GRC Maturity Model