CRISC study guide
CRISC · Work through your exam, one topic at a time.
CRISC (Certified in Risk and Information Systems Control) is an ISACA credential for professionals who manage IT risk and the controls that support business resilience. ISACA states the certification demonstrates IT risk management expertise and prepares holders to address emerging technology, including AI risk assessment and data governance and ethics. The exam covers four domains: Corporate IT Governance; Risk Assessment; Risk Response & Reporting; and Technology and Security. It suits risk managers, IT audit and control practitioners, security and governance professionals, and others whose work involves identifying, assessing, responding to, and reporting technology risk across an enterprise. The CRISC study guide has 4 sections and about 1,485 words.
01Corporate IT Governance
Corporate IT governance is the framework of structures, roles, and processes through which the board and senior leadership direct IT and ensure IT risk is managed within agreed limits. It is distinct from IT management: governance decides what level of risk is acceptable and who is accountable, while management decides how to achieve it.
372 words, about 2 min02Risk Assessment
IT risk assessment has three phases. Identification builds the inventory: assets, processes, data flows, threats, vulnerabilities, and existing controls, often through risk scenarios ("who or what could exploit which vulnerability, and with what consequence?").
386 words, about 2 min03Risk Response and Reporting
Every assessed risk receives one of four responses. Avoid eliminates the activity creating the risk.
360 words, about 2 min04Technology and Security
Risk practitioners need working literacy across architecture, security operations, and resilience, always linking technology to business risk. Core concepts include the confidentiality, integrity, and availability triad; identity and access management (least privilege, role-based access, segregation of duties, privileged access management); encryption in transit and at rest with key management; network segmentation, firewalls, and intrusion detection or prevention; logging and monitoring; secure development life cycle with stage gates; change and configuration management; and patch management.
367 words, about 2 min