Certified in Risk and Information Systems Control

Exam cost

Not verified

Questions · time · passing score

150 questions · Other exam details not verified

Prerequisites

Not verified — check issuer eligibility

Estimated salary premium

Not established by comparable evidence

Renewal requirements

Not verified in this audit; confirm with issuer.

Difficulty

Not rated

Domains covered

• Governance (26%)
• Risk assessment (22%)
• Risk response and reporting (32%)
• Technology and security (20%)

Where this credential fits

MyCyberPath career mappings are planning guidance, not universal employer requirements.

• GRC Director→CISO →

Recent catalog changes

1. ISACAdomain change2026-10-29

   Certified in Risk and Information Systems Control

   Certified in Risk and Information Systems Control: skills gained. Recorded by the October catalog audit; review date, not necessarily the issuer effective date.

   What changed

   Before

   IT Risk Identification and Assessment · IT Risk Response and Mitigation · Risk Monitoring and Reporting · Information Systems Control Design and Implementation · Governance of Enterprise IT · Organizational Strategy and Objectives Alignment · Business Process Understanding · Legal, Regulatory, and Contractual Compliance · Professional Ethics in Risk Management · AI Risk Assessment and Data Governance · Business Resilience Enhancement · Stakeholder Value Optimization · Who It’s For · IT professionals involved in risk management · Risk and control professionals · Business analysts · Project managers · Compliance officers · Audit professionals

   After

   Governance (26%) · Risk assessment (22%) · Risk response and reporting (32%) · Technology and security (20%)

   Review source
2. ISACAupdated2026-10-29

   Certified in Risk and Information Systems Control

   Certified in Risk and Information Systems Control: cert url. Recorded by the October catalog audit; review date, not necessarily the issuer effective date.

   What changed

   Before

   https://www.isaca.org/credentialing/crisc

   After

   https://www.isaca.org/credentialing/crisc/crisc-exam-content-outline

   Review source
3. ISACAupdated2026-10-29

   Certified in Risk and Information Systems Control

   Certified in Risk and Information Systems Control: vendor url. Recorded by the October catalog audit; review date, not necessarily the issuer effective date.

   What changed

   Before

   Not verified

   After

   https://www.isaca.org/credentialing/crisc/crisc-exam-content-outline

   Review source
4. ISACAupdated2026-10-29

   Certified in Risk and Information Systems Control

   Certified in Risk and Information Systems Control: description. Recorded by the October catalog audit; review date, not necessarily the issuer effective date.

   What changed

   Before

   A Certified in Risk and Information Systems Control® (CRISC®) certification demonstrates expertise in IT risk management. It focuses on enhancing an organization’s business resilience, delivering stakeholder value, and optimizing risk management across the enterprise. CRISC-certified professionals are equipped to address emerging technology, including AI risk assessment and best practices for risk management and mitigation related to AI data governance and ethics 1.

   After

   IT risk governance, assessment, response, reporting and technology controls.

   Review source
5. ISACAprice change2026-10-29

   Certified in Risk and Information Systems Control

   Certified in Risk and Information Systems Control: exam cost usd. Recorded by the October catalog audit; review date, not necessarily the issuer effective date.

   What changed

   Before

   575

   After

   Not verified

6. ISACAexam update2026-10-29

   Certified in Risk and Information Systems Control

   Certified in Risk and Information Systems Control: exam format. Recorded by the October catalog audit; review date, not necessarily the issuer effective date.

   What changed

   Before

   150 multiple-choice questions, 4 hours (240 minutes) time limit, scaled score of 450 out of 800 to pass

   After

   150 questions; four domains. Consult candidate guide for timing and scoring.

   Review source
7. ISACAupdated2026-10-29

   Certified in Risk and Information Systems Control

   Certified in Risk and Information Systems Control: renewal cost. Recorded by the October catalog audit; review date, not necessarily the issuer effective date.

   What changed

   Before

   US$45 for members and US$85 for non-members annually

   After

   Not verified

8. ISACAupdated2026-10-29

   Certified in Risk and Information Systems Control

   Certified in Risk and Information Systems Control: prerequisites. Recorded by the October catalog audit; review date, not necessarily the issuer effective date.

   What changed

   Before

   Pass the CRISC Exam within the last 5 years. 3 or more years of professional work experience across at least 2 of the 4 CRISC domains.

   After

   Not verified

9. ISACAexam update2026-10-29

   Certified in Risk and Information Systems Control

   Certified in Risk and Information Systems Control: exam delivery. Recorded by the October catalog audit; review date, not necessarily the issuer effective date.

   What changed

   Before

   Computer-based and administered at authorized PSI testing centers globally or as remotely proctored exams.

   After

   Not verified

10. ISACAupdated2026-10-29

    Certified in Risk and Information Systems Control

    Certified in Risk and Information Systems Control: renewal period years. Recorded by the October catalog audit; review date, not necessarily the issuer effective date.

    What changed

    Before

    3

    After

    Not verified

Sources and verification

• https://www.isaca.org/credentialing/crisc/crisc-exam-content-outline
• https://www.isaca.org/about-us/newsroom/press-releases/2025/isaca-updates-cdpse-and-crisc-exams-to-reflect-latest-risk-and-privacy-priorities