Free study guide

ISACA CRISC Study Guide

ISACA Certified in Risk and Information Systems Control (CRISC)

ISACA CRISC (Certified in Risk and Information Systems Control) is the certification for IT risk and control professionals who identify, assess, respond to and report on IT risk. It covers four domains: governance, risk assessment, risk response and reporting, and technology and security, all from the risk practitioner's viewpoint. The exam has 150 multiple choice questions in four hours, and ISACA requires three years of work experience in the CRISC job practice areas.

  • Exam code CRISC
  • 4 exam domains
  • 150 questions

This guide is free, with no sign-up. It explains every ISACA CRISC exam topic in plain English, one chapter at a time. Read them in order or jump straight to the topic you need.

  • 4chapters
  • 29topics
  • 6diagrams and exhibits
  • 2 h 18 minfast track
Start with Governance
  • Every topic follows the same simple pattern: what it is, how it works, common mistakes
  • Diagrams and real command output where a picture explains it best
  • Exam tips and worked subnetting and IPv6 practice, with answers

How the exam is weighted

Each domain is worth this share of the exam, so spend your study time in proportion. Select a domain to open its chapter.

Chapters

Open a chapter to see its topics and how long each takes.

1Governance7 topics · 34 min fast trackStrategy, roles, culture, policies, resilience and assets, plus ERM, lines of defense, risk profile, appetite and frameworks.
  1. 1Strategy, Structure, Roles and Responsibilities5 min
  2. 2Risk Culture, Ethics, Policies and Standards5 min
  3. 3Business Processes and Resilience (BCP and DRP)5 min
  4. 4Organizational Asset Management4 min
  5. 5Enterprise Risk Management and Lines of Defense5 min
  6. 6Risk Profile, Risk Appetite and Risk Tolerance5 min
  7. 7Risk Frameworks and Legal, Regulatory and Contractual Requirements5 min
Read the chapter overview →
2Risk Assessment6 topics · 27 min fast trackRisk events, threats, vulnerabilities, risk scenarios, assessment standards, BIA, analysis methods and the risk register.
  1. 1Risk Events, Threat Modeling and the Threat Landscape4 min
  2. 2Vulnerability Management4 min
  3. 3Risk Scenario Development and Evaluation5 min
  4. 4Risk Assessment Concepts, Standards, Inherent and Residual Risk5 min
  5. 5Business Impact Analysis (BIA)4 min
  6. 6Risk Analysis Methodologies and the Risk Register5 min
Read the chapter overview →
3Risk Response and Reporting9 topics · 43 min fast trackRisk response, ownership, vendor risk, exceptions, control design and testing, action plans, KRIs, monitoring and reporting.
  1. 1Risk Response Options and Risk and Control Ownership5 min
  2. 2Vendor and Supply Chain Risk Management5 min
  3. 3Issues, Findings, Exceptions and Exemptions Management4 min
  4. 4Control Frameworks, Types and Standards4 min
  5. 5Control Design, Selection, Implementation and Analysis5 min
  6. 6Control Testing Methodologies5 min
  7. 7Risk Action Plans and Risk Data Collection and Validation5 min
  8. 8Risk and Control Metrics (KRIs, KCIs, KPIs)5 min
  9. 9Risk Monitoring, Reporting and Emerging Risks5 min
Read the chapter overview →
4Technology and Security7 topics · 34 min fast trackTechnology principles, EA, operations, SDLC, data lifecycle, projects, resilience, emerging tech, security and privacy.
  1. 1Technology Principles, Roadmaps and Enterprise Architecture5 min
  2. 2Operations Management (Change, Assets, DevOps, Problems, Incidents)4 min
  3. 3SDLC, Portfolio and Project Management5 min
  4. 4Data Lifecycle Management and Data Privacy Principles5 min
  5. 5Technology Resilience and Disaster Response and Recovery5 min
  6. 6Emerging Technologies5 min
  7. 7Security Concepts, Frameworks, Standards and Awareness Training5 min
Read the chapter overview →

Ready for more practice?

The full ISACA CRISC question bank has 1,000 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.