CRISC case studies
CRISC · Put your knowledge to work in context.
CRISC (Certified in Risk and Information Systems Control) is an ISACA credential for professionals who manage IT risk and the controls that support business resilience. ISACA states the certification demonstrates IT risk management expertise and prepares holders to address emerging technology, including AI risk assessment and data governance and ethics. The exam covers four domains: Corporate IT Governance; Risk Assessment; Risk Response & Reporting; and Technology and Security. It suits risk managers, IT audit and control practitioners, security and governance professionals, and others whose work involves identifying, assessing, responding to, and reporting technology risk across an enterprise. The CRISC case studies are 5 cases and about 2,738 words.
1The CRM That Arrived Without a Decision
Northwind Health's sales team signed an 18-month contract for a cloud CRM and migrated 1,400 patient-referral records before IT learned of it from an expense report. The CRM vendor stores data in a region not approved for patient data, and the contract lacks a breach-notification clause.
553 words, about 3 min2Legacy ERP: Quantifying the Deferral
Arcadia Logistics runs a 14-year-old ERP on an unsupported database. A quantitative assessment estimates the asset's replacement value at 4.2M; a successful exploit would destroy or corrupt 35% of records.
546 words, about 3 min3Ransomware: Insurance, Controls, or Both
Meridian Regional Bank's risk register lists ransomware at the top: a successful attack is modeled at 9M in recovery and downtime, with 8% annual likelihood. The risk appetite statement caps tolerance at 2M single-event loss and prohibits uninsured losses above that.
515 words, about 3 min4The KRI the CRO Wants Turned Amber
Atlas Manufacturing's monthly risk report shows four KRIs. The 'third-party security assessment completion' KRI has been red for five months: 61% of critical vendors assessed against a 90% target.
545 words, about 3 min5MFA Exception on the Customer Portal
Helios Insurance's customer portal runs on a vendor product that cannot support multi-factor authentication; the vendor's roadmap promises it in 14 months. The portal is internet-facing, serves 200,000 policyholders, and allows profile and payment-detail changes.
579 words, about 3 min