CRISC
IT risk owners and control owners: who the CRISC is for
Every IT control exists to answer a risk, and somebody has to decide which risks matter, how much of each the organization will accept, and whether the controls actually bring the risk down to that level. The CRISC is ISACA's credential for that work. ISACA says it demonstrates IT risk management expertise. This guide is about the people who do it, from IT risk managers to the control owners whose systems carry the risk, the rules that have put IT risk on the board agenda, and what the exam asks.
The facts here come from ISACA's Certification Exams Candidate Guide, version 1.26, with the CRISC Exam Content Outline (2025), ISACA's CRISC and Get CRISC Certified pages and its CPE 2027 page, read on 20 October 2026, with the Official Journal texts of DORA and NIS2 and our CRISC Exam Guide. Where this page and ISACA differ, ISACA wins.
What does the CRISC measure?
ISACA's Candidate Guide describes the CRISC as designed for those experienced in the management of IT risk and the design, implementation, monitoring and maintenance of IS controls. Its exam content outline divides the work into four domains:
| Domain | Share | Subdomains and topics |
|---|---|---|
| 1. Governance | 26% | Organizational governance: strategy and objectives, structure and roles, culture and ethics, policies and standards, business processes and resilience, asset management. Risk governance: enterprise risk management, lines of defense, risk profile, risk appetite and tolerance, frameworks and legal, regulatory and contractual requirements |
| 2. Risk Assessment | 22% | Risk identification: risk events, threat modeling and the threat landscape, vulnerability management, risk scenarios. Risk analysis: assessment concepts and standards, business impact analysis, the risk register, analysis methodologies, inherent and residual risk |
| 3. Risk Response and Reporting | 32% | Risk response: options, risk and control ownership, vendor and supply chain risk, issues, findings, exceptions and exemptions. Control design and implementation: frameworks, types and standards, design and selection, testing. Risk monitoring and reporting: action plans, data, KRIs, KCIs and KPIs, monitoring and reporting techniques |
| 4. Technology and Security | 20% | Technology principles: roadmaps and enterprise architecture, operations management, the SDLC, data life cycle, portfolio and project management. Information security principles: security concepts and frameworks, awareness and training, data privacy and protection principles |
The largest domain is the one where risk turns into action. Risk response and reporting, at 32%, covers choosing a response, assigning ownership, designing and testing controls, and reporting on all of it with metrics a board can read. Governance, at 26%, sets the frame: the organization's strategy, the lines of defense, and the appetite and tolerance that tell everyone how much risk is acceptable. Risk assessment sits between them, and technology and security supplies the context an IT risk professional has to understand.
Read as a job description, the outline describes a translator. An IT risk professional takes a technical fact, a vulnerability, a vendor failure, an architecture change, and expresses it as a risk to a business objective, with a likelihood, an impact, an owner and a response. Then they make sure the response happens and report whether it worked.
Appetite, tolerance and the register
Three ideas from the outline hold the rest together. Risk appetite is the amount of risk the organization is willing to take in pursuit of its objectives, set by the board and senior management. Risk tolerance is the acceptable variation around it for a particular risk or objective. The risk register is where each risk is recorded with its inherent rating, the controls that act on it, its residual rating after those controls, its owner and its response. A CRISC holder spends much of their time keeping those three aligned: a residual risk above tolerance needs a response, and a change in appetite set by the board means the register has to be read again.
The register is never finished. Our guide lists the events that should trigger a reassessment: an incident, a change in business objectives, a KRI threshold breach, and a change in appetite set by the board. A completed treatment action changes residual risk too, and should close or downgrade the entry. A register that is only updated once a year is reporting last year's risk.
Indicators that tell the truth
Risk monitoring rests on three kinds of metric. Key risk indicators (KRIs) show whether exposure is rising. Key control indicators (KCIs) show whether controls are working. Key performance indicators (KPIs) show whether the program is delivering. Reading them together is the skill. A green KCI beside a red KRI means the control works and the environment got worse. A KRI that stayed green through an incident was measuring the wrong thing, and the indicator, not only the control, needs to change.
Who is the CRISC for?
ISACA says more than 30,000 professionals hold the CRISC. The outline's lines of defense topic is a useful way to see who they are, because IT risk work happens on all three lines:
| Role | Line | What they do with IT risk | CRISC domains that carry the day job |
|---|---|---|---|
| Control owner, IT manager or system owner | First | Runs the controls and owns the risk in their systems | 3 (control design, ownership), 4 |
| Security risk analyst | First or second | Threat modeling, vulnerability management, risk scenarios | 2, then 4 |
| IT risk manager or technology risk lead | Second | Risk framework, register, appetite, reporting to committees | 1, then 3 |
| Vendor or third-party risk specialist | Second | Supplier assessments and supply chain risk | 3 (vendor and supply chain risk) |
| Compliance or operational risk professional | Second | Regulatory requirements, exceptions and exemptions | 1 (requirements), 3 (exceptions) |
| IT auditor | Third | Testing whether controls answer the risk | 3 (control testing), 2 |
The common thread is the risk register. Every role above either feeds it, owns entries in it, challenges it or tests what it claims. Our guide is clear about who decides: the risk owner accepts the risk that remains after the controls operating today, not the inherent level, and a control failure is not something the second line catches after the first line drops it. Each line has its own job.
What the job looks like in numbers
No US occupation code covers IT risk alone. Two bracket it: Information Security Analysts on the technology side, and Financial Risk Specialists on the risk side. O*NET gives these figures from Bureau of Labor Statistics data:
| Measure | Information Security Analysts (15-1212) | Financial Risk Specialists (13-2054) |
|---|---|---|
| Employment | 192,900 | 66,000 (2025) |
| Median annual wage, 2025 | $129,180 | $117,330 |
| Projected growth, 2025 to 2035 | Much faster than average (7% or higher) | Much faster than average (7% or higher) |
| Projected job openings, 2025 to 2035 | 14,100 | 4,800 |
Neither code is IT risk management, and the second is mostly market and credit risk in financial firms. The table shows the two professions IT risk sits between. ISACA publishes a salary figure for CRISC holders on its CRISC page, but it does not say how it was measured, so we have not repeated it.
When does the CRISC start to matter?
IT risk management becomes a formal job when a rule, a board or a business change demands it. These are the moments that most often do.
A regulator requires an ICT risk framework
DORA, Regulation (EU) 2022/2554, makes the management body of an EU financial entity "define, approve, oversee and be responsible for the implementation of all arrangements related to the ICT risk management framework" (Article 5(2)). Article 6(4) requires financial entities, other than microenterprises, to assign the responsibility for managing and overseeing ICT risk to a control function with an appropriate level of independence, and to ensure segregation and independence of ICT risk management, control and internal audit functions, according to the three lines of defense model or an internal risk management and control model. That is close to the CRISC's governance domain, written into law.
NIS2 asks for risk analysis
The NIS2 Directive's minimum cybersecurity measures, in Article 21(2), start with "policies on risk analysis and information system security." An essential or important entity under NIS2 needs someone who can run that analysis, keep the register and report on it to the management body that has to approve the measures.
The board has to describe its risk process
For US public companies, the SEC's Regulation S-K Item 106 requires each annual report to describe the processes for assessing, identifying and managing material risks from cybersecurity threats, and the board's oversight of them. A described process has to exist, and the people who run it have to be able to defend it.
A risk is accepted, or a control fails
Most CRISC work is everyday. A business owner wants to accept a risk; somebody has to check that the right person is accepting the right level of it. A control fails in operation; somebody has to work out whether it was a design flaw or residual risk materializing. Our guide's rule for the second case is precise: "performed as documented but the loss still happened" points to design only if the documented control was insufficient; otherwise it is residual risk materializing.
Someone asks for an exception
Policies cannot cover every case, and the outline gives issues, findings, exceptions and exemptions their own topic. An exception is a risk decision in disguise: a system that cannot meet a standard carries a risk the standard was meant to prevent. A well-run exception process records the gap, the compensating control if there is one, the owner who accepts the residual risk, and an expiry date, so the exception is revisited rather than forgotten.
A vendor becomes critical
Vendor and supply chain risk management sits in the risk response subdomain. When a supplier becomes critical to a business process, its risks become the organization's risks, and the register has to show them, with an owner and a response.
The technology changes
The fourth domain covers the technology context an IT risk professional has to understand: technology roadmaps and enterprise architecture, operations management including change, assets, DevOps, problems and incidents, the system development life cycle, the data life cycle, and portfolio and project management, including agile delivery. Its security half covers security concepts, frameworks and standards, awareness and training, and data privacy and protection principles. Every one of those is a source of risk events. A move to the cloud, a new delivery method or a new data platform changes the risk profile, and the register should change with it.
Business resilience sits in governance for the same reason. Disaster recovery and business continuity plans, with the business impact analysis behind them, tell the organization which processes matter most and how fast they must come back. A risk professional who knows those priorities can weight a technology risk by what it would actually interrupt.
What each artifact asks of the outline
Here is the outline turned into the work products an IT risk professional maintains. For each artifact, the second column says what it is for, and the third gives the CRISC domain and subdomain that teaches it.
| Artifact | What it is for | CRISC domain and subdomain |
|---|---|---|
| Risk appetite and tolerance statement | Telling everyone how much risk is acceptable | 1. Risk Governance |
| Lines of defense map | Showing who owns, oversees and audits each risk | 1. Risk Governance |
| Risk scenarios | Turning threats and vulnerabilities into business risks | 2. Risk Identification |
| Business impact analysis | Knowing which processes matter most and how fast they must recover | 2. Risk Analysis |
| Risk register | Recording each risk with its inherent and residual rating, owner and response | 2. Risk Analysis |
| Risk response decisions and action plans | Accept, mitigate, transfer or avoid, with owners and dates | 3. Risk Response |
| Control design and test results | Showing controls are designed to reduce the risk and operate as designed | 3. Control Design and Implementation |
| Exceptions and exemptions log | Tracking where policy is not met, and until when | 3. Risk Response |
| KRI and KCI dashboard | Watching risk and control health between assessments | 3. Risk Monitoring and Reporting |
| Board risk report (heatmap or scorecard) | Giving the board a view it can act on | 3. Risk Monitoring and Reporting |
The register is the center of the table. We have turned the qualities a register entry needs into a checklist you can copy or download below.
IT risk register entry checklist
IT risk register entry checklist
Use this to check that each entry in an IT risk register will stand up to a risk committee, an auditor or a regulator. The fields follow the risk assessment, response and monitoring topics in ISACA's CRISC exam content outline (2025).
The risk
- Written as a risk scenario: a threat, a vulnerability or event, and the impact on a business objective
- Linked to the business process and assets it affects
- A named risk owner: the person accountable for the business outcome, not the analyst who wrote it up
The analysis
- Inherent risk rated (likelihood and impact before controls)
- Each control mapped to the likelihood or the impact it reduces (a control that maps to neither is not
reducing this risk, so do not count it)
- Controls checked as operating, not only documented
- Residual risk rated after the controls that operate today
- Compared with the risk appetite and tolerance set by the board and senior management
The response
- Response chosen: accept, mitigate, transfer or avoid
- If accepted: accepted by the risk owner, against residual (not inherent) risk, and recorded
- If mitigated: an action plan with owner and date, and the residual risk expected afterwards
- A cheaper control rejected if it leaves residual risk above tolerance
- Compensating controls only where the intended control cannot be implemented, and only if they bring
the risk to a level the owner accepts
- Exceptions and exemptions recorded with an expiry date
Monitoring
- Key risk indicators (KRIs) and key control indicators (KCIs) defined, with thresholds
- A trigger to reassess: a KRI breach, a change in business objectives, a change in appetite, or an incident
- Entry closed or downgraded when a treatment action is completed and verified
- Ratings never lowered because remediation is unaffordable; the cost goes into the response decision instead
Where does the credential apply?
The CRISC is global. ISACA runs the exam at PSI test centers and by online remote proctoring. The content is not tied to one jurisdiction: legal, regulatory and contractual requirements appear as a governance topic, and the rest of the outline is method. DORA and NIS2 in the EU and the SEC's disclosure rules in the US are examples of the rules a CRISC holder will work under; they are not exam content.
The method travels because risk management works the same way everywhere: identify, analyze, respond, monitor, report. What changes by jurisdiction is who demands to see the results, how often, and in what form.
What the CRISC is not
It is not an audit credential. The CISA audits controls from outside. The CRISC manages the risk the controls address, from the first and second lines. The two are complementary, and some IT risk professionals hold both.
It is not a security management credential. The CISM is about running the security function. The CRISC covers security as one of the contexts of IT risk.
It is not financial risk. GARP's FRM covers market, credit and liquidity risk in finance. The CRISC is about information systems and technology risk.
It is not a percentage. The pass mark is 450 on ISACA's scale of 200 to 800, and ISACA publishes no percentage pass mark.
From exam to certification: ISACA's rules
| Step | ISACA's rule |
|---|---|
| Register | US$575 for members, US$760 for non-members; six months to sit the exam, extendable by six months for US$75 |
| Sit the exam | 150 multiple-choice questions in 4 hours, at a PSI test center or remotely proctored |
| Results | Preliminary pass status on screen; the official score within 10 working days |
| Retakes | Four attempts in a rolling 12 months; wait 30 days, then 90, then 90; full fee each time |
| Apply | Within five years of passing; US$50 application processing fee |
| Experience | Three or more years within the 10 years before applying; no waivers or substitutions; verified by a supervisor or manager |
| Keep it | At least 20 CPE hours a year and 120 per three-year cycle; from 1 January 2027, at least 90 aligned to the exam content outline |
ISACA describes the experience in two ways. Its Candidate Guide says three or more years of experience in IT risk management and IS control. Its Get CRISC Certified page says three years of professional information systems auditing, control or security work as described in the CRISC job practice areas. In practice, document your experience against the CRISC domains, and ask ISACA if your history sits on the line between the two descriptions.
How does it compare with the credentials around it?
| CRISC | CISA | CISM | |
|---|---|---|---|
| ISACA says it is designed for | Those experienced in IT risk management and IS controls | IT/IS auditors and control, assurance and information security professionals | Those who manage, design, oversee and assess an enterprise's information security function |
| Largest domain | Risk response and reporting (32%) | Operations and resilience; protection of information assets (26% each) | Information security program (33%) |
| Experience | 3 years; no waivers | 5 years; waivers up to 3 | 5 years; waivers up to 2 |
| Exam | 150 questions, 4 hours, 450 on a 200 to 800 scale | ||
The three share a format and answer different questions. The CISA asks whether the controls work. The CISM asks how the security function is run. The CRISC asks which risks matter, how much the organization will accept, and whether the controls bring the risk to that level. Our CISA or CISM comparison and the CISA and CISM exam pages cover the other two.
What will the exam expect of you?
The CRISC has 150 multiple-choice questions in four hours, 1 minute 36 seconds a question on average. As on all ISACA exams, stems carry qualifiers such as FIRST, BEST and MOST, and the order of the risk process is what they test. "Implement multi-factor authentication" is a good idea and a wrong answer when the stem asks what to do FIRST after a threat is identified but before any assessment; the assessment comes first.
The traps our guide warns about follow the same logic. A cheaper control that leaves residual risk above tolerance fails, however attractive its price. A compensating control is used when the intended control cannot be implemented, and it must reduce the risk to a level the risk owner accepts. A control that you cannot map to either likelihood or impact is probably not reducing the risk, and claiming credit for it inflates control effectiveness and understates residual risk. When a risk owner asks for a lower score because remediation is unaffordable, the score does not change; the cost belongs in the response decision. And a green KCI beside a red KRI means the control works and the environment got worse.
Test yourself with the CRISC quiz, see the domains on one page in the CRISC mind map, and if the credential is part of a job move, the CRISC interview questions page covers what employers ask.
How to prepare
Start from the exam content outline in the Candidate Guide, and size your time to the weights. If you plan 100 hours, the shares give 32 to risk response and reporting, 26 to governance, 22 to risk assessment and 20 to technology and security. Then move hours toward what your job does not cover: a technologist may need more time on governance and appetite; a risk professional from outside IT may need more on technology principles.
The CRISC Exam Guide (Wikidata) has 14 chapters across 467 pages. Every chapter maps to a published domain, the percentage is printed at the head of each domain, and the book treats risk as a discipline with an order to it, which is how the exam treats it too. Every source is named at the back.
The CRISC Practice Questions (Wikidata) has 205 questions weighted to the published domain shares, with a full rationale for each and the answer letters spread on purpose.
Is it current? Both books follow the CRISC exam content outline (2025) in ISACA's Candidate Guide version 1.26. ISACA revises outlines from time to time, so check its CRISC page before you book.
So, do you need the CRISC?
Take it if your job is to identify, assess, respond to and report on IT risk, or to own the controls that answer it: IT risk managers, second-line risk and compliance staff, control owners, security risk analysts and vendor risk specialists. It is ISACA's credential for the translator between technology and the business, and DORA, NIS2 and the SEC's disclosure rules have all made that translation a formal requirement.
It also suits technologists who keep being asked to explain risk to people who are not technologists: the architect asked for a risk view of a migration, the operations lead asked to brief the risk committee. The CRISC gives that work a method and a vocabulary the business recognizes.
Take the CISA instead if your job is auditing the controls, and the CISM if it is running the security function. And if your risk work is market or credit risk in a financial firm rather than technology risk, GARP's FRM is the closer fit.
Questions people ask about the CRISC
Who is the CRISC for?
ISACA's Candidate Guide says it is designed for those experienced in the management of IT risk and the design, implementation, monitoring and maintenance of IS controls. That covers IT risk managers, second-line risk and compliance staff, control owners, security risk analysts, vendor risk specialists and the auditors who test the controls.
What experience do I need for the CRISC?
Three or more years, with no waivers or substitutions. The Candidate Guide describes it as experience in IT risk management and IS control; ISACA's Get CRISC Certified page describes it as IS auditing, control or security work as described in the CRISC job practice areas. The experience must fall within the 10 years before you apply, and you have five years from passing to apply.
How many questions are on the CRISC exam?
150 multiple-choice questions in four hours, at a PSI test center or remotely proctored.
What is the CRISC passing score?
450 on ISACA's scale of 200 to 800. ISACA publishes no percentage pass mark.
What does the CRISC cover?
Four domains: governance (26%), risk assessment (22%), risk response and reporting (32%) and technology and security (20%).
How much does the CRISC cost?
ISACA lists the exam at US$575 for members and US$760 for non-members, plus a one-time US$50 application processing fee after you pass.
CRISC or CISM?
The CRISC is about IT risk across the enterprise and the controls that answer it. The CISM is about running the information security function. A risk manager takes the CRISC; a security manager takes the CISM. Some people hold both.
CRISC or CISA?
The CISA audits systems and controls from outside; the CRISC identifies and manages the risk that the controls are there to address. Auditors take the CISA; risk professionals the CRISC.
How do I keep the CRISC?
At least 20 CPE hours a year and 120 over each three-year cycle, the annual maintenance fee, and ISACA's Code of Professional Ethics. From 1 January 2027 at least 90 of the 120 hours must be aligned to the exam content outline.
How many people hold the CRISC?
ISACA says more than 30,000 professionals hold the CRISC.
CRISC: test yourself in five minutes
Which books prepare you for the CRISC exam?
Certified in Risk and Information Systems Control. 14 chapters, 467 pages.
Practice questions with full rationales, sized to the published domain weights. 220 pages.
How to credit this page
Using a figure or a passage from this page in an article, a course, a forum answer or AI-generated text? Please credit Credential Press and link to this page, so your readers can check the source and the date it was reviewed. Copy a ready-made citation:
Plain text
Markdown
HTML
Sources
- ISACA, Certification Exams Candidate Guide, version 1.26, with the CRISC Exam Content Outline (2025)
- ISACA, CRISC Certification: positioning, fees, holder count
- ISACA, Get CRISC Certified: experience, application and CPE requirements
- ISACA, CPE Policy Changes for 2027
- Regulation (EU) 2022/2554 (DORA), Articles 5 and 6
- Directive (EU) 2022/2555 (NIS2), Article 21
- US SEC, Public Company Cybersecurity Disclosures; Final Rules, fact sheet
- O*NET OnLine, 15-1212.00 Information Security Analysts (BLS data)
- O*NET OnLine, 13-2054.00 Financial Risk Specialists (BLS data)
Credential Press is not affiliated with, endorsed by or authorized by ISACA. CRISC, CISA and CISM are trademarks of ISACA; FRM is a trademark of GARP.