CRISC—Certified in Risk and Information Systems Control

What is the CRISC difference?

A Certified in Risk and Information Systems Control^® (CRISC^®) certification will make you a Risk Management expert. Studying a proactive approach based on Agile methodology, you’ll learn how to enhance your company’s business resilience, deliver stakeholder value and optimize Risk Management across the enterprise.

What you will learn with the CRISC certification?

26% DOMAIN 1 – GOVERNANCE

The governance domain interrogates your knowledge of information about an organization’s business and IT environments, organizational strategy, goals and objectives, and examines potential or realized impacts of IT risk to the organization’s business objectives and operations, including Enterprise Risk Management and Risk Management Framework.

A—ORGANIZATIONAL GOVERNANCE

Organizational Strategy, Goals, and Objectives
Organizational Structure, Roles and Responsibilities
Organizational Culture
Policies and Standards
Business Processes
Organizational Assets

B—RISK GOVERNANCE

Enterprise Risk Management and Risk Management Framework
Three Lines of Defense
Risk Profile
Risk Appetite and Risk Tolerance
Legal, Regulatory and Contractual Requirements
Professional Ethics of Risk Management

20% DOMAIN 2 – IT RISK ASSESSMENT

This domain will certify your knowledge of threats and vulnerabilities to the organization’s people, processes and technology as well as the likelihood and impact of threats, vulnerabilities and risk scenarios.

A—IT RISK IDENTIFICATION

Risk Events (e.g., contributing conditions, loss result)
Threat Modelling and Threat Landscape
Vulnerability and Control Deficiency Analysis (e.g., root cause analysis)
Risk Scenario Development

B—IT RISK ANALYSIS AND EVALUATION

Risk Assessment Concepts, Standards and Frameworks
Risk Register
Risk Analysis Methodologies
Business Impact Analysis
Inherent and Residual Risk

32% DOMAIN 3 – RISK RESPONSE AND REPORTING

This domain deals with the development and management of risk treatment plans among key stakeholders, the evaluation of existing controls and improving effectiveness for IT risk mitigation, and the assessment of relevant risk and control information to applicable stakeholders.

A—RISK RESPONSE

Risk Treatment / Risk Response Options
Risk and Control Ownership
Third-Party Risk Management
Issue, Finding and Exception Management
Management of Emerging Risk

B—CONTROL DESIGN AND IMPLEMENTATION

Control Types, Standards and Frameworks
Control Design, Selection and Analysis
Control Implementation
Control Testing and Effectiveness Evaluation

C—RISK MONITORING AND REPORTING

Risk Treatment Plans
Data Collection, Aggregation, Analysis and Validation
Risk and Control Monitoring Techniques
Risk and Control Reporting Techniques (heatmap, scorecards, dashboards)
Key Performance Indicators
Key Risk Indicators (KRIs)
Key Control Indicators (KCIs)

22% DOMAIN 4 – INFORMATION TECHNOLOGY AND SECURITY

In this domain we interrogate the alignment of business practices with Risk Management and Information Security frameworks and standards, as well as the development of a risk-aware culture and implementation of security awareness training.

A—INFORMATION TECHNOLOGY PRINCIPLES

Enterprise Architecture
IT Operations Management (e.g., change management, IT assets, problems, incidents)
Project Management
Disaster Recovery Management (DRM)
Data Lifecycle Management
System Development Life Cycle (SDLC)
Emerging Technologies

B—INFORMATION SECURITY PRINCIPLES