CRISC
What does the CRISC exam cover, on one page?
The CRISC exam content outline on one page: four domains, their weights, and the parts of each. The mnemonic at the bottom gives you the four in order.
What does the CRISC exam cover, on one page?
CRISC exam: 150 questions, four domains
1 Governance (26%)
- A Organizational governance: strategy, structure, culture, policies, assets
- B Risk governance: ERM, lines of defense, risk profile, appetite and tolerance
2 Risk Assessment (22%)
- A Risk identification: events, threats, vulnerabilities, scenarios
- B Risk analysis: BIA, risk register, methods, inherent and residual risk
3 Risk Response and Reporting (32%)
- A Risk response: options, ownership, third-party risk, exceptions
- B Control design, implementation and testing
- C Monitoring and reporting: action plans, metrics, emerging risk
4 Technology and Security (20%)
- A Technology: architecture, SDLC, data lifecycle, resilience, emerging tech
- B Information security principles, awareness, data privacy
Good Analysts Reduce Threats
- G Governance
- A Risk Assessment
- R Risk Response and Reporting
- T Technology and Security
CRISC mind map
Embed it on your site, wiki or study group page:
<a href="https://credentialpress.com/guides/crisc-mind-map"><img src="https://credentialpress.com/img/mindmaps/crisc.png" alt="CRISC mind map" width="1600" height="1131"></a>
How do you use the mind map?
Print the PDF and pin it where you study, or open the Markdown in Obsidian (a mind map plugin draws it from the headings). Say the mnemonic until you can list the domains in order, then add one item from memory under each branch.
Where next?
Also free: the CRISC interview questions, plus every other credential on our study tools page. For the full syllabus, the CRISC Exam Guide and the CRISC Practice Questions go domain by domain.
Frequently asked questions
What are the CRISC exam domains?
1 Governance (26%); 2 Risk Assessment (22%); 3 Risk Response and Reporting (32%); 4 Technology and Security (20%).
Is there a mnemonic for the CRISC domains?
Good Analysts Reduce Threats: G for Governance, A for Risk Assessment, R for Risk Response and Reporting, T for Technology and Security.
Can I use the CRISC mind map in Obsidian?
Yes. Download the Markdown file and open it in Obsidian; a mind map plugin draws it from the headings. A printable PDF and a PNG are free too.
Which books go deeper on CRISC?
Certified in Risk and Information Systems Control. 14 chapters, 420 pages.
Practice questions with full rationales, sized to the published domain weights. 220 pages.
Sources
Credential Press is independent of ISACA.