Duration:
4 days
Course Synopsis:
The only globally accepted IT risk management certification for professionals with three or more years of experience. CRISC validates your experience in building a well-defined, agile risk-management program, based on best practices to identify, analyze, evaluate, assess, prioritize and respond to risks. This enhances benefits realization and delivers optimal value to stakeholders. This credential demonstrates expertise in identifying and managing enterprise IT risk and implementing and maintaining information systems controls. CRISC can enhance your IT team’s credibility with stakeholders and clients.
In this course, you'll cover all four domains of the Certified in Risk and Information Systems Control (CRISC) exam and gain the knowledge and concepts required to obtain CRISC certification.
Course Objectives:
This course is organized to assist candidates in understanding essential concepts and students will master the four CRISC domains:
- Governance
- IT Risk Assessment
- Risk Response and Reporting
- Information Technology and Security
Course Prerequisites:
IT risk management professionals with at least 3 years of relevant professional work experience in IT risk and information systems control.
CPE Information:
- To maintain your CRISC, you must earn and report a minimum of 120 CPE hours every 3-year reporting cycle period.
- Earn and report an annual minimum 20 CPE hours. These hours must be appropriate to the currency or advancement of the CRISC’s knowledge or ability to perform CRISC-related tasks.
- Comply with the annual CPE audit if selected
- Comply with ISACA’s Code of Professional Ethics
Who Should Attend:
- Professionals preparing to become CRISC certified
- Risk practitioners
- Students or recent graduates
Domain 1: Governance
- Organizational Governance
- Organizational Strategy, Goals, and Objectives
- Organizational Structure, Roles, and Responsibilities
- Organizational Culture
- Policies and Standards
- Business Processes
- Organizational Assets
- Risk Governance
- Enterprise Risk Management and Risk Management Framework
- Three Lines of Defense
- Risk Profile
- Risk Appetite and Risk Tolerance
- Legal, Regulatory, and Contractual Requirements
- Professional Ethics of Risk Management
Domain 2: IT Risk Assessment
- IT Risk Identification
- Risk Events
- Threat Modelling and Threat Landscape
- Vulnerability and Control Deficiency Analysis
- Risk Scenario Development
- IT Risk Analysis and Evaluation
- Risk Assessment Concepts, Standards, and Frameworks
- Risk Register
- Risk Analysis Methodologies
- Business Impact Analysis
- Inherent and Residual Risk
Domain 3: Risk Response and Reporting
- Risk Response
- Risk Treatment/Risk Response Options
- Risk and Control Ownership
- Third-Party Risk Management
- Issue, Finding and Exception Management
- Management of Emerging Risk
- Control Design and Implementation
- Control Types, Standards, and Frameworks
- Control Design, Selection, and Analysis
- Control Implementation
- Control Testing and Effectiveness Evaluation
- Risk Monitoring and Reporting
- Risk Treatment Plans
- Data Collection, Aggregation, Analysis, and Validation
- Risk and Control Monitoring Techniques
- Risk and Control Reporting Techniques
- Key Performance Indicators
- Key Risk Indicators (KRIs)
- Key Control Indicators (KCIs)
Domain 4: Information Technology and Security
- Information Technology Principles
- System Development Life Cycle (SDLC)
- Emerging Technologies
- Enterprise Architecture
- IT Operations Management
- Project Management
- Disaster Recovery Management (DRM)
- Information Security Principles
- Data Privacy and Data Protection Principles.
- Information Security Concepts, Frameworks, and Standards
- Information Security Awareness Training
- Business Continuity Management
Examination Information
Length of exam
4 hours
Number of questions
Question format
Multiple choice
Passing grade
450 out of 800 points
Exam availability
Chinese Simplified, English, Spanish, Korean.
Testing center
PSI Testing Center or Online Proctoring
Programme scope, delivery arrangements and suitability are confirmed during enquiry.