CRISC
Certified in Risk and Information Systems Control

Overview

Certified in Risk and Information Systems Control (CRISC) shows that a person can identify and assess IT risk, decide how to respond to it, and design, run, and monitor the controls that treat it. ISACA aims it at people experienced in managing IT risk and information systems controls. The exam covers governance, risk assessment, risk response and reporting, and the technology and security controls that support risk treatment. Holders often work as IT risk managers, risk and controls analysts, compliance leads, or consultants who build risk programs. The exam has 150 questions.

Candidates need 3 years of experience across at least 2 of the 4 CRISC domains, gained within the 10 years before they apply, and ISACA's candidate guide states that no waivers or substitutions are allowed. CISA, also from ISACA, approaches controls from the auditor's side, while CRISC is written for the people who own and manage the risk. CISM covers the wider management of a security program, of which risk management is 1 domain. CRISC isn't tied to a single framework, so holders apply it alongside standards such as ISO/IEC 27001 or the NIST Cybersecurity Framework. Renewal runs on a 3-year cycle.

What the exam covers

The CRISC exam content outline organizes the exam into 4 job practice domains, each with a published weight.

Requirements

At least 3 years of CRISC professional work experience across at least 2 of the 4 CRISC domains, gained within the 10 years before the application. ISACA's candidate guide states there are no experience waivers or substitutions, and candidates have 5 years after passing the exam to apply.

Format

Computer-based, multiple choice, offered in English and several other languages

Questions

150

Time

4 hours

Passing score

450 on a scaled score of 200 to 800

Delivery

PSI test centres or online remote proctoring

Certification also requires a USD 50 application processing fee, work experience verified by a supervisor or manager, and agreement to ISACA's Code of Professional Ethics and CPE policy.

Cost

Exam fee: USD 575 for ISACA members, USD 760 for non-members. Prices from ISACA's CRISC page and exam candidate guide, checked October 12, 2026, plus a USD 50 application processing fee. ISACA lists fees in US dollars, and prices change, so confirm with ISACA before registering.

Keeping it current

Cycle

3 years

Continuing education

120 CPE hours per 3-year period, with at least 20 each year

Fees

USD 45 a year for ISACA members, USD 85 for non-members (lower rates apply from a third ISACA certification), due January 1

How to verify that someone holds it

Employers can use ISACA's verification tool by selecting the certification, entering the certificate number the holder provides, and entering the holder's last name. ISACA also issues CRISC as a Credly badge. Use the issuer’s verification page.

On InfoSecHub, a CRISC listed on a profile shows Verified by Credly only when a current Credly badge issued to that person confirms it.

In Canada

ISACA has chapters across Canada, including Toronto, Montréal, Ottawa Valley, Calgary, and Vancouver.

Typical roles

• IT risk manager
• Risk and controls analyst
• Compliance lead
• Information security risk consultant
• Control owner

Related frameworks

• ISO 27001
• NIST CSF
• NIST 800-53
• OSFI B-13

References

1. Earn a CRISC certification, ISACA
2. Maintain CRISC certification, ISACA
3. CRISC exam content outline, ISACA
4. Exam candidate guides, ISACA

Reviewed 2026-10-12. Exam details, prices, and renewal rules change. Confirm them on the ISACA website before you register. InfoSecHub is not affiliated with ISACA.