Skip to content
CBT Nuggets
DemoBook a Demo
ISACAProfessional

CRISC – Certified in Risk and Information Systems Control

Standardize your team on CRISC – Certified in Risk and Information Systems Control with a structured ISACA training path — a blueprint-weighted practice exam and team admin reporting included on every CBT Nuggets Teams seat.

Book a DemoAll ISACA certs
1
Course
1
Practice exam
5
Core skills
$575 for ISACA members, $760 for non-members
Exam fee (ISACA)
Security operations center analysts monitoring threat dashboards
Difficulty
Difficulty: 4 of 5 (Advanced)
Advanced
Exam fee (ISACA)
$575 for ISACA members, $760 for non-members
Courses on path
1
Official source
ISACA’s official exam page
Exam code
  • CRISC

Exam datasheet

Format
Multiple choice
Prerequisites
None, but experience in IT risk management is recommended
Recommended experience
At least 3 years of cumulative work experience in IT risk management and information systems control
Recertification
3 years
Testing center

Exams

Exams for this certification

Exam fees per engineer, paid to the exam vendor$575 for ISACA members, $760 for non-members

Exam — Required

Every engineer on the CRISC – Certified in Risk and Information Systems Control path takes CRISC.

  1. CRISCCRISC – Certified in Risk and Information Systems ControlPractice exam included on every Teams seat
    Exam fee
    $575 for ISACA members, $760 for non-members
    Exam length
    4 hours
    Questions
    150
    Passing score
    450 out of 800

    Exam blueprint: CRISC

Skills your team builds

Risk IdentificationRisk AssessmentRisk Response and MitigationRisk and Control Monitoring and ReportingInformation Systems Control

Training path

Your team's training path

One CBT Nuggets course covers the full CRISC – Certified in Risk and Information Systems Control path. Your team can start today and have admin reporting visible from day one.

  1. Start here · primary course

    CRISC

    This ISACA CRISC training is designed to help you earn your Certified in Risk and Information Systems Control credential. This course helps you learn to identify IT risks, build threat models, and align technology with business goals. Once you've completed this course, you'll know how to design effective control frameworks, manage vendor risk, and handle data lifecycles from start to finish. You'll also gain the skills to analyze risk appetite, report metrics through heatmaps and dashboards, and lead disaster recovery efforts.

    Bob Salmans
    102 videosPractice exam14h
    Open course

Every certification course includes

  • Expert-led video training
  • Certification practice exams
  • Per-team completion reporting

ISACA career ladder

Where CRISC – Certified in Risk and Information Systems Control sits in your team's ISACA progression

The cert your team is on now, plus the levels above and below. Use this to map an engineer's next-step credential or to plan headcount coverage across tiers.

  1. Associate level

    1 cert

    ISACA Cybersecurity Fundamentals (ITCA)

    ITCA

  2. Professional level

    3 certs

    CISA – Certified Information Systems Auditor

    CISA

    CISM – Certified Information Security Manager

    CISM

    CRISC – Certified in Risk and Information Systems Control

    CRISC

    You are here
Customer outcome

Build CRISC capability across the whole team, not one engineer

Assign the CRISC – Certified in Risk and Information Systems Control course to the engineers who need it, and the team report shows who has started, who has finished, and who has passed the practice exam — the view leadership uses to see ISACA skills coverage across the team and where the gaps are.

See team pricing

Team capability

Make CRISC a number on your team capability sheet, not a single engineer’s certificate.

Standardizing your team on CRISC gives leadership a clear picture of ISACA skills coverage — who has completed the training, who is still on the path, and where the gaps are — so staffing and escalation plans rest on known capability instead of on one engineer.

Credential: CRISC – Certified in Risk and Information Systems Control

Exam
  • CRISC

Frequently asked questions about CRISC – Certified in Risk and Information Systems Control training

Common questions IT directors ask when evaluating CRISC – Certified in Risk and Information Systems Control training for their team.

How does CRISC fit into an IT risk governance or compliance program?

Teams commonly cite CRISC when documenting that the people who run risk governance, risk response and control monitoring have validated, vendor-issued skills in those areas. CBT Nuggets team reporting adds per-learner completion and completion exports that can serve as audit evidence. The auditor's control crosswalk decides how the credential formally maps to the framework the organization follows.

Who on the team should hold CRISC, and what can a CRISC-certified team own?

IT leaders typically target CRISC at security managers, risk analysts and control owners who translate business risk into IT controls. Based on the linked course lessons, a certified team can own risk and threat identification, vulnerability analysis and risk scenario development, IT risk analysis and evaluation, risk response, and control design and implementation. It can also own ongoing risk monitoring and reporting across network and endpoint security, business applications, information systems operations and data classification and encryption.

What does CBT Nuggets CRISC – Certified in Risk and Information Systems Control training include for a team?

CBT Nuggets CRISC – Certified in Risk and Information Systems Control courses are built by named expert trainers. Where a course includes hands-on virtual labs or a practice exam mapped to ISACA's published exam objectives, the course list on this page says so. Team admin reporting tracks assignment, completion and exam readiness per engineer — the view managers use to run a team training program.

How do I assign and track CRISC – Certified in Risk and Information Systems Control training for my team?

From the admin console, managers assign the CRISC – Certified in Risk and Information Systems Control courses directly to specific engineers or role groups and track completion and practice-exam scores per learner. Team-wide reporting rolls up to a single dashboard you can review or export for leadership reviews or compliance reporting.

How long does it take to certify a team on CRISC?

The linked CBT Nuggets training totals about 14 hours of video. Actual time to certify depends on the team's starting point, including how much hands-on experience each member already has with risk governance and information systems controls.

What if ISACA updates the CRISC – Certified in Risk and Information Systems Control exam objectives?

CBT Nuggets updates ISACA course content as exam objectives refresh, and this page shows the current exam's status and any retirement date the vendor has announced. When ISACA restructures or renames a track, the assigned training stays aligned with the same team training plan, and the training stays current without anyone losing their progress mid-stream.

Ready to CRISC – Certified in Risk and Information Systems Control-certify your team?

Build CRISC – Certified in Risk and Information Systems Control capability across your team

See how CBT Nuggets helps IT leaders plan and track CRISC – Certified in Risk and Information Systems Control training across the team — a practice exam and reporting included.

Book a Demo