Chapter 4 of 4 · ISACA CRISC
Technology and Security
Technology principles, EA, operations, SDLC, data lifecycle, projects, resilience, emerging tech, security and privacy.
- 7topics
- 34 minfast track
- 20%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1Technology Principles, Roadmaps and Enterprise ArchitectureCRISC technology basics: technology principles, cloud models and shared responsibility, technical debt, roadmaps, and enterprise…5 min
- 2Operations Management (Change, Assets, DevOps, Problems, Incidents)CRISC IT operations risk: change enablement and change types, configuration and IT assets, DevOps and CI/CD, incident versus…4 min
- 3SDLC, Portfolio and Project ManagementCRISC SDLC and projects: security in each SDLC phase, waterfall versus Agile, NIST SSDF, portfolio governance, project risk, and…5 min
- 4Data Lifecycle Management and Data Privacy PrinciplesCRISC data lifecycle and privacy: classification, retention and destruction, protection controls, GDPR principles, privacy by…5 min
- 5Technology Resilience and Disaster Response and RecoveryCRISC technology resilience: redundancy and high availability, backup types and immutable copies, hot, warm and cold sites, and…5 min
- 6Emerging TechnologiesCRISC emerging technologies: assessing AI, IoT and OT, quantum computing, blockchain and automation for threats, vulnerabilities…5 min
- 7Security Concepts, Frameworks, Standards and Awareness TrainingCRISC security principles: CIA, least privilege, defense in depth, zero trust, ISO/IEC 27001 and NIST CSF 2.0, and awareness that…5 min
About this chapter
What this chapter covers
Technology and Security is 20% of the ISACA CRISC exam. It tests whether you understand the technology and security practices that IT risk lives in, and whether business practices align with risk management and information security frameworks. It also covers building a risk-aware culture through security awareness and training.
The domain has two parts. Technology and security (4A) covers technology principles, roadmaps and enterprise architecture, operations management, the system development life cycle, data lifecycle management, portfolio and project management, technology resilience and disaster recovery, and emerging technologies. Information security principles (4B) covers security concepts, frameworks and standards, awareness and training, and data privacy and protection.
Questions stay at the risk practitioner's level. You will not configure systems, but you must know where risk arises in each practice and which control or step addresses it FIRST or BEST.
How the topics fit together
Technology is planned through roadmaps and architecture, built through projects and the SDLC, and run through operations with resilience for when things fail. Security and privacy principles apply across the whole lifecycle, and awareness makes people part of the control environment.
When a question asks when to address security or risk in a project, system or new technology, the BEST answer is almost always as early as possible, at requirements or design, not after deployment.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with tables and examples.
- What to remember for the exam: the facts to memorise and how questions are phrased.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
Ready for more practice?
The full ISACA CRISC question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.