Skip to content
CBT Nuggets
DemoBook a Demo
ISACAProfessional

CRISC – Certified in Risk and Information Systems Control

Standardize your team on CRISC – Certified in Risk and Information Systems Control with a structured ISACA training path — virtual labs, a blueprint-weighted practice exam, and team admin reporting included on every CBT Nuggets training subscription.

Book a DemoAll ISACA certs
1
Course
$575 for ISACA members, $760 for non-members
Exam cost
1
Practice exam
5
Core skills
Security operations center analysts monitoring threat dashboards
Difficulty
Difficulty: 4 of 5 (Advanced)
Advanced
Exam cost
$575 for ISACA members, $760 for non-members
Courses on path
1
Official source
Vendor cert page
Exam code
  • CRISC

Exam datasheet

Exam length
4 hours
Questions
150
Passing score
450 out of 800
Format
Multiple choice
Prerequisites
None, but experience in IT risk management is recommended
Recommended experience
At least 3 years of cumulative work experience in IT risk management and information systems control
Recertification
3 years
Hiring-market salary
$110,000 - $150,000 per year
Certified professionals
Over 30,000
Testing centerExam blueprint

Public hiring-market data — not a CBT Nuggets guarantee.

Skills your team builds

Risk IdentificationRisk AssessmentRisk Response and MitigationRisk and Control Monitoring and ReportingInformation Systems Control

Training path

Your team's training path

One CBT Nuggets course covers the full CRISC – Certified in Risk and Information Systems Control path. Your team can start today and have admin reporting visible from day one.

  1. Start here · primary course

    CRISC

    This ISACA CRISC training is designed to help you earn your Certified in Risk and Information Systems Control credential. This course helps you learn to identify IT risks, build threat models, and align technology with business goals. Once you've completed this course, you'll know how to design effective control frameworks, manage vendor risk, and handle data lifecycles from start to finish. You'll also gain the skills to analyze risk appetite, report metrics through heatmaps and dashboards, and lead disaster recovery efforts.

    Bob Salmans
    102 videosPractice exam14h
    Open course

Every certification includes

Expert-led video training
Virtual labs
Certification practice exams
Per-team completion reporting

ISACA career ladder

Where CRISC – Certified in Risk and Information Systems Control sits in your team's ISACA progression

The cert your team is on now, plus the levels above and below. Use this to map an engineer's next-step credential or to plan headcount coverage across tiers.

  1. Professional level

    5 certs

    CISA – Certified Information Systems Auditor

    CISA

    CISM – Certified Information Security Manager

    CISM

    CRISC – Certified in Risk and Information Systems Control

    CRISC

    You are here

    ISACA Cybersecurity Fundamentals (ITCA)

    ITCA

    ISACA Data Science Fundamentals (ITCA)

    ITCA

Customer outcome

Make CRISC a coverage number your auditor can quote

CRISC – Certified in Risk and Information Systems Control certified engineers are easy to count and easy to prove. CBT Nuggets bundles the prep into a single team playlist so leadership sees who's on the path, who finished, and who's exam-ready — without spreadsheets.

See team pricing
1 path
from foundation to credential — assigned and tracked as one playlist

Coverage proof

Make CRISC a number on your team capability sheet, not a single engineer’s certificate.

Standardizing your team on CRISC gives leadership and auditors a coverage number they can quote — and gives ISACA incident response a baseline of capability you can predict instead of hoping for.

Credential: CRISC – Certified in Risk and Information Systems Control

Exam
  • CRISC

Frequently asked questions about CRISC – Certified in Risk and Information Systems Control training

Common questions IT directors ask when evaluating CRISC – Certified in Risk and Information Systems Control training for their team.

How does CRISC – Certified in Risk and Information Systems Control fit into our internal compliance and governance program?

Team reporting in CBT Nuggets documents assigned training, completion, and certification coverage for internal governance or external audit conversations. Pair the CRISC – Certified in Risk and Information Systems Control path with your auditor's control crosswalk for the formal compliance mapping your specific framework requires.

What's the ROI of certifying our team on CRISC – Certified in Risk and Information Systems Control?

IT Directors typically frame CRISC – Certified in Risk and Information Systems Control ROI in operational terms — faster troubleshooting, defensible role coverage, predictable onboarding velocity, and audit-ready training documentation. The metrics that matter aren't seat-time or completion percentages; they're mean time to resolve, time-to-productivity for new ISACA hires, and certification coverage by role.

How does CBT Nuggets CRISC – Certified in Risk and Information Systems Control training compare to Pluralsight, LinkedIn Learning, or Udemy Business?

CBT Nuggets CRISC – Certified in Risk and Information Systems Control courses are built by named expert trainers (not crowd-sourced contributors), include hands-on virtual labs in many courses, and include certification practice exams mapped to the vendor's published exam objectives. Team admin reporting tracks assignment, completion, and exam-readiness per engineer — the surface managers actually use to manage team training programs. See /compare for the full feature comparison.

How do I assign and track CRISC – Certified in Risk and Information Systems Control training for my team?

From the admin console, managers create a training playlist (one or more courses on the CRISC – Certified in Risk and Information Systems Control path), assign it to specific engineers or role groups, and track completion + practice-exam scores per learner. Team-wide reporting rolls up to a single dashboard you can export for monthly leadership reviews or quarterly compliance reporting. No spreadsheet, no per-engineer license fiddling.

How long does it take to certify a team on CRISC – Certified in Risk and Information Systems Control?

Depends on the cert and the team's starting baseline. Entry-level ISACA certs typically run 4–6 weeks per engineer from a cold start; associate-level certs run 8–12 weeks; professional/expert tracks can run 3–6 months. Most teams budget the full quarter for any associate-level certification so engineers have time to actually apply the lab work before the exam.

What if ISACA updates the CRISC – Certified in Risk and Information Systems Control exam objectives?

CBT Nuggets updates ISACA course content as exam objectives refresh — typically within weeks of the vendor's release. When ISACA restructures or renames a track (a common pattern), the assigned training paths stay aligned with the same team training plan; managers don't have to rebuild the playlist from scratch. The training stays current without anyone losing their certification status mid-stream.

Ready to CRISC – Certified in Risk and Information Systems Control-certify your team?

Build CRISC – Certified in Risk and Information Systems Control capability across your team

See how CBT Nuggets helps IT Directors plan and track CRISC – Certified in Risk and Information Systems Control training across the team — labs, practice exams, and reporting included.

Book a Demo