CRISC Certification Guide: What to Know Before You Commit

CRISC has become ISACA's fastest-growing credential outside of CISA, and while other ISACA credentials such as the ISACA Certified Cybersecurity Operations Analyst target security operations, it's the only major certification built specifically around enterprise IT risk, not audit, security operations, or general governance. Employers hiring for risk analyst, IT risk manager, and GRC-focused roles increasingly list it as preferred or required.

If you already know the name, you're past the marketing pitch. What you need are numbers: what the exam costs once membership and renewal fees are factored in, how the 150-question format actually plays out under a four-hour clock, what experience ISACA will and won't count toward eligibility, and whether the credential moves your salary or just your resume, and whether it can help you become a senior cybersecurity analyst.

CRISC rewards people already working risk problems. It does little for someone with no IT exposure trying to break in.

CRISC Credential Snapshot

ISACA's risk-focused certification landscape has evolved considerably as organizations formalize IT risk management into a standalone discipline, and the Certified in Risk and Information Systems Control (CRISC) credential sits at the center of that shift. Below is a quick-reference table covering the essentials you need before committing time or money.

Key Facts at a Glance

• Issuing body: ISACA
• Full name: Certified in Risk and Information Systems Control
• Exam length: 150 multiple-choice questions, 240 minutes (4 hours)
• Scoring scale: 200 to 800; passing score is 450
• Exam fee (ISACA member): $575
• Exam fee (non-member): $760
• Application fee: $50 (one-time, post-exam)
• ISACA membership dues: $145 first year, $135 renewal
• Annual maintenance fee: $45 for members, $85 for non-members
• Testing provider: PSI, with in-person and remote-proctored options
• Experience requirement: At least 3 years of professional work experience across a minimum of 2 CRISC domains, earned within the past 5 years
• Renewal cycle: Every 3 years
• CPE requirement: 120 continuing professional education hours per 3-year cycle

What the Numbers Mean for Your Budget

If you join ISACA and pass on your first attempt, your year-one outlay is roughly $770: the member exam fee ($575) plus first-year dues ($145) plus the application fee ($50). Non-members pay $810 for the exam and application alone, so membership usually pays for itself through the exam discount and access to ISACA study resources, which can help you prepare for a certification exam. After certification, plan on $45 per year in maintenance fees as a member, or $85 if you let your membership lapse.

Experience Window

ISACA’s experience requirement is among the strictest certification prerequisites: you must have at least 3 years of professional work experience across a minimum of 2 CRISC domains, earned within the past 5 years. You can sit for the exam before meeting that requirement; simply pass first and apply once you accumulate the necessary years.

All details above reflect ISACA's published figures for the 2025 to 2026 exam cycle, as confirmed on the official CRISC credential page.

What CRISC Validates and Why It Matters

CRISC (Certified in Risk and Information Systems Control) validates a professional's ability to identify, assess, respond to, and monitor enterprise IT risk, and to design and maintain the information system controls that keep that risk within tolerance. In plain terms: it certifies that you can look at a company's technology environment, spot where the business could get hurt, quantify how badly, and build or evaluate the controls that reduce that exposure to an acceptable level.

Scope: risk governance, not security operations

The credential covers four practice areas: governance, IT risk assessment, risk response and reporting, and information technology and security. Notice what is not there. You will not be asked to configure a firewall, tune a SIEM, or write detection rules. CRISC sits at the layer above operational security. It is about deciding which risks matter, who owns them, how they map to business objectives, and how leadership should be informed when the risk picture changes.

How it differs from Security+ and CISSP

Security+, an early step in the comptia cybersecurity career path, validates baseline technical knowledge. CISSP covers a broad security management body of knowledge, including architecture, cryptography, and operations. CRISC is narrower and more specialized: it is a risk and controls credential, aligned to frameworks like COBIT, NIST RMF, and ISO 31000. If your job is to run the controls, CISSP or Security+ speaks your language. If your job is to advise the business on which controls are worth running, and to report residual risk to executives and auditors, CRISC is the credential built for that conversation.

Why employers weight it

CRISC is one of the few certifications in cyber security that explicitly ties information systems risk to enterprise objectives rather than to a technology stack. It is also accredited by ANAB under ISO/IEC 17024, the international standard for personnel certification bodies. That accreditation matters to regulated industries, government contractors, and Big Four advisory practices, where procurement and HR teams often require ISO/IEC 17024 accredited credentials on hiring rubrics for cybersecurity consultant roles.

Who Should Pursue CRISC

Some certifications work as entry points. CRISC is not one of them. It rewards people who already sit close to risk decisions and want a credential that formalizes and monetizes that experience, rather than people looking for a first foothold in IT.

Four Candidate Profiles

• IT risk manager or analyst: Strong fit. If your job already involves identifying threats, scoring likelihood and impact, and reporting to a risk committee, CRISC maps directly onto your daily work and signals mastery employers already expect from you.
• Information security analyst pivoting toward risk: Conditional fit. Technical security experience is valuable, but you should have direct exposure to risk assessment or control monitoring, not just incident response or configuration work, before you commit study hours.
• Compliance or audit professional seeking risk specialization: Strong fit. Auditors who understand control frameworks are usually one step away from formal risk management language, and CRISC gives that transition a recognized credential rather than an informal skill claim.
• GRC consultant: Strong fit, often the clearest case. Consultants advising multiple clients on governance and risk programs benefit from a credential that clients recognize without explanation, shortening sales conversations and engagement approvals.

Why This Isn't a Beginner Credential

ISACA recommends professional experience in IT risk and control work before sitting for the exam, and the test assumes familiarity with enterprise risk concepts most newcomers have not yet encountered. Someone with no IT background is better served building foundational knowledge first, such as through the Google Cybersecurity Professional Certificate Guide, before treating CRISC as a near-term goal. Attempting it too early usually means memorizing terminology without the practical context that makes the credential valuable on the job.

The Hiring Signal

Hiring managers in financial services, healthcare, and government increasingly list CRISC as a preferred or required qualification for risk-focused roles, using it as a screening filter when reviewing candidates for governance, risk, and compliance positions.

Self-Assessment

• Do at least two years of your recent work involve identifying, assessing, or responding to IT risks?
• Is your career trajectory aimed at risk governance or GRC leadership rather than general IT or technical security?
• Can you commit 150 to 250 study hours over three to four months (a Cybersecurity Certification Study Plan for Working Adults can help) without derailing current job performance?

If you answered yes to at least two of these, CRISC likely fits your next career move.

Eligibility, Prerequisites, and Qualifying Experience

What counts as qualifying work experience for CRISC, and can you sit for the exam before meeting the requirement?

ISACA structures CRISC eligibility around demonstrated professional experience rather than academic credentials or prior certifications. Understanding exactly what qualifies and what does not prevents wasted time and application fees.

The Three-Year, Two-Domain Rule

CRISC candidates must accumulate at least three years of cumulative work experience performing IT risk management and information systems control tasks.¹ This experience must span at least two of the four CRISC domains, with at least one of those years falling within Domain 1 (IT Risk Governance) or Domain 2 (IT Risk Assessment). The experience does not need to be consecutive; ISACA accepts cumulative, non-consecutive work history. Part-time roles also count, though hours are prorated accordingly.

All qualifying experience must fall within a 10-year look-back window from your application date.² Work performed more than a decade ago, regardless of relevance, will not satisfy the requirement.

Job Roles That Typically Qualify

Not every IT position meets the bar; ISACA evaluates whether your documented responsibilities involved risk identification, assessment, response, or governance activities. Roles that commonly qualify include:

• IT Risk Analyst: Conducting formal risk assessments, maintaining risk registers, and reporting risk posture to leadership.
• Security Architect: Designing and recommending controls to mitigate identified risks across systems and infrastructure.
• Compliance Officer: Mapping regulatory requirements (SOX, HIPAA, PCI-DSS) to IT controls and validating control effectiveness.
• Internal Auditor: Evaluating IT risk frameworks, testing control environments, and documenting findings for remediation.
• GRC Specialist: Managing governance, risk, and compliance platforms and coordinating cross-functional risk initiatives.

Generic IT helpdesk support, network administration, or system administration roles typically do not qualify unless your documented responsibilities explicitly included risk identification, assessment, or response activities. The distinction matters: troubleshooting user access issues differs from formally assessing access control risks and recommending mitigations.

Exam-First, Experience-Later Option

ISACA permits candidates to sit for the CRISC exam before meeting the full experience requirement. If you pass, you have five years from your exam date to submit verified experience and complete your certification application.² This pathway suits professionals actively building relevant experience or those making a cybersecurity career change who want to lock in a passing score while their study momentum is fresh.

Verification and Documentation

ISACA requires supervisor or manager verification of your claimed experience.² Your verifier must confirm your job title, employment dates, and the specific risk-related responsibilities you performed. Vague job descriptions or inflated claims invite audit scrutiny. Before applying, gather documentation: job descriptions, project summaries, or performance reviews that explicitly reference risk assessment, control design, or governance activities.

No experience waivers exist for CRISC.¹ Unlike some certifications that substitute education or other credentials for work history, ISACA maintains a strict experience standard. This policy reinforces the credential's positioning as a practitioner-level validation rather than an entry-level achievement.

Exam Format, Domains, Scoring, and Testing Options

The tradeoff here is depth versus pace: CRISC gives you a full four hours, but it also asks 150 scenario-heavy questions that reward judgment over recall. Understanding the format before you register helps you decide whether to schedule the exam in a testing center, sit for it remotely, or delay until your domain weak spots are shored up.

Structure, Scoring, and Time Limit

The CRISC exam is 150 multiple-choice questions delivered in a single four-hour window. ISACA uses scaled scoring on a 200 to 800 range, and the passing score is 450. Scaled scoring means your raw number of correct answers is converted to account for slight difficulty variations across exam forms, so there is no fixed "percentage correct" target you can chase. In practice, candidates who consistently score in the 75 to 80 percent range on quality practice banks tend to clear the threshold, but that is a rule of thumb, not an ISACA-published equivalence.

Questions lean heavily on scenario framing. Expect prompts that describe a business context and ask you to choose the best next action, the greatest risk, or the most appropriate control, rather than to define a term.

The Four Domains and Their Weights

ISACA's current CRISC blueprint covers four domains. Allocate study time proportionally:

• Governance: 26 percent. Organizational strategy, risk culture, policies, and the three lines of defense.
• IT Risk Assessment: 22 percent. Risk identification, analysis techniques, and evaluation of IT and business risk.
• Risk Response and Reporting: 32 percent. The largest domain. Risk treatment, control design, monitoring, KRIs, and communication to stakeholders.
• Information Technology and Security: 20 percent. Enterprise architecture, IT operations, emerging technologies, and information security concepts that underpin risk decisions.¹

Risk Response and Reporting is the single heaviest section, so any candidate short on study time should protect that block first.

Testing Options, Languages, and Scheduling

The exam is delivered through PSI, both at physical testing centers and through online remote proctoring, which you can learn more about in our online proctoring and retakes guide. Remote proctoring requires a quiet, private room, a working webcam, and a clean workspace, and the proctor monitors you throughout the four hours. In-person testing remains available worldwide for candidates who prefer a controlled environment or who have unreliable home internet.

The exam is offered in English, Spanish, Chinese (Simplified), French, Japanese, Korean, and German.² ISACA runs continuous testing windows rather than fixed exam dates, so once you register and receive your eligibility window (typically 12 months), you can schedule, reschedule, or cancel within that period based on your readiness.

Full Cost Breakdown: Exam, Membership, Application, and Renewal Fees

Deciding between member and non-member rates creates a significant gap in total investment over the first three years of holding the CRISC credential. Most candidates focus only on the exam registration fee, but the full ownership cost includes membership dues, the certification application fee, and annual maintenance fees that accumulate year after year. Understanding the complete picture helps you budget accurately and decide whether ISACA membership makes financial sense for your situation.

Member Path: Three-Year Total Cost

The member path requires an ISACA professional membership, which costs $145 for the first year³ and $135 for each renewal year³. Here is the breakdown for someone who passes on the first attempt and maintains the credential for three full years:

• Year 1 membership: $145³
• Exam registration (member rate): $575¹
• Certification application fee: $50¹
• Year 1 maintenance fee: $45²
• Year 2 membership renewal: $135³
• Year 2 maintenance fee: $45²
• Year 3 membership renewal: $135³
• Year 3 maintenance fee: $45²

Total member path: $1,175

Non-Member Path: Three-Year Total Cost

Without membership, you pay higher rates at every step. The exam costs more, and the annual maintenance fee nearly doubles. Here is the same scenario without joining ISACA:

• Exam registration (non-member rate): $760¹
• Certification application fee: $50¹
• Year 1 maintenance fee: $85²
• Year 2 maintenance fee: $85²
• Year 3 maintenance fee: $85²

Total non-member path: $1,065

At first glance, the non-member route appears cheaper by $110 over three years. However, this calculation ignores the value of ISACA membership benefits, including access to resources, local chapter events, and discounts on training materials. If you plan to pursue additional ISACA certifications such as CISM or CISA, the membership savings compound because you pay reduced exam and maintenance fees across all credentials.

What Retakes Cost

Candidates who do not pass on the first attempt must re-register at the same rate: $575 for members or $760 for non-members¹. There is no reduced retake fee. Given that CRISC is a challenging exam, budgeting for at least one potential retake is prudent. A single retake adds $575 or $760¹ to your total, pushing the three-year cost to $1,750 for members or $1,825 for non-members.

Training Costs Are Separate

The figures above cover only ISACA's official fees. Preparation resources vary widely in price. ISACA's official review courses and question databases can run from $500 to over $1,000. Third-party prep courses, practice exam bundles, and self-study guides range from free community resources to premium programs costing $300 to $800. Many candidates combine an official question database with one or two third-party practice exams, landing in the $400 to $700 range for total study materials.

Why This Matters

No competitor resource currently presents the full three-year ownership cost in one place. Most guides cite only the exam fee, leaving candidates surprised by annual maintenance fees that continue indefinitely. If you hold CRISC for a decade, maintenance alone adds $450 at member rates or $850 at non-member rates. Planning for these ongoing costs ensures the credential remains active and valid throughout your career.

How Difficult the CRISC Exam Is and How to Prepare

The CRISC exam tests your ability to think like a risk manager, not to recall textbook definitions. Instead of multiple-choice trivia, you'll face long scenario questions that describe a governance gap, a risk event, or a control dilemma and ask you to choose the best response. This format sets it apart from more technical exams like CISSP and CompTIA Security+, and it surprises many candidates who assume the relatively modest 150-question length makes it easier than larger exams.

A Scenario-Driven Exam, Not a Vocabulary Test

CISM and CISSP both use scenario items, but CRISC leans more heavily on risk judgment: you must weigh business impact, compliance requirements, and available resources to pick the option that most effectively reduces residual risk. CISSP throws a wide net across eight domains of security, often rewarding technical breadth. CRISC rewards lived experience with risk assessment, response planning, and enterprise governance. If you have spent time in an IT audit, compliance, or risk management role, many questions will feel like daily work. If you are new to the field, the exam can feel abstract no matter how much you study.

What About the Pass Rate?

ISACA does not release granular pass-rate statistics with denominator, time period, exam version, and attempt type, so any numbers you see online are unofficial estimates. Anecdotal figures circulate on forums and prep sites, but they lack the rigor needed to be useful for your own planning. Instead of focusing on a phantom pass rate, understand the scoring system: you need a scaled score of 450 on a scale of 200 to 800.¹ The cut score is set through psychometric analysis, not a fixed percentage, so performing well on practice exams is a far better gauge of readiness than an internet statistic.

How Long Should You Study?

Practitioner consensus lands around 90 to 150 hours² spread over two to four months.³ Candidates already working in risk or audit functions often lean toward the lower end; those without direct risk management experience should budget more. A sustainable week-by-week outline might look like this:

• Weeks 1-4: Work through all four CRISC domains using the official review manual and the ISACA Question, Answer and Explanation (QAE) database to build a broad conceptual base.
• Weeks 5-7: Shift to full-length timed practice exams, aiming for consistency above 80 percent correct. Flag every missed question and trace it back to the domain topic.
• Week 8: Revisit your weakest domains with focused QAE drills and lighter review, avoiding burnout in the final days.

Training Options to Consider

The preparation path you choose, balancing Self-Study vs. Instructor-Led Cybersecurity Training, depends on your budget, learning style, and schedule. Available options include:

• Official ISACA materials: The CRISC Review Manual and QAE database are the most direct preparation tools and closely mirror the exam's phrasing and logic.
• Third-party courses and bootcamps: Many providers offer live or on-demand training that emphasizes scenario drills. Look for programs that explicitly tie practice questions back to risk concepts, not just factual recall.
• Self-study with practice exams: If you prefer independent learning, combine the QAE with supplementary test banks from reputable vendors, but prioritize question quality over quantity.
• Employer-sponsored training: Some organizations cover exam prep costs as part of professional development, so it's worth checking your company's reimbursement policies early.

No single resource guarantees a result. What matters most is the hours you spend wrestling with realistic risk scenarios and learning from your mistakes, not simply completing a course.

Information Security Analyst Salary by State

Geographic location plays a significant role in information security analyst compensation. The table below draws from the most recent Occupational Employment and Wage Statistics published by the U.S. Bureau of Labor Statistics (2024 data) and covers all 50 states, the District of Columbia, and Puerto Rico. States with the largest concentrations of security analysts, such as Virginia, California, and Texas, also tend to offer above-average pay, though cost of living should factor into any relocation decision.

Renewal, Continuing Education, and What Happens if You Lapse

CRISC is maintain-or-lose; ISACA does not treat it as a lifetime achievement. If you stop reporting continuing professional education (CPE) hours or fail to pay the annual maintenance fee, your certification can be revoked, and there is no built-in grace period.

The CPE Requirement

CRISC holders must earn 120 CPE hours over each rolling three-year reporting cycle, with a minimum of 20 CPE hours per year. That annual floor matters: hitting 120 total but earning zero in one of the three years still results in non-compliance.

Eligible CPE activities are broad. They include ISACA chapter meetings and webinars, vendor-neutral conferences, university coursework, teaching or presenting on risk topics, publishing articles or books, passing other professional exams, and self-study aligned to the CRISC job practice areas. Contributions to ISACA (question writing, volunteer work, committee service) also count. Keep documentation: attendance records, transcripts, agendas, or receipts. ISACA runs an annual CPE audit, and audited holders must produce evidence on request.

Annual Maintenance Fee

There is a yearly maintenance fee due at the start of each renewal year: currently $45 for ISACA members and $85 for non-members. Miss the payment window and your certification moves toward suspension, independent of your CPE status.

If You Lapse

ISACA provides no formal grace period. Miss your CPE hours, skip the annual fee, or fail an audit, and the credential can be suspended and ultimately revoked. Reinstatement is not automatic. You must submit a written appeal to ISACA explaining the lapse, pay a $50 reinstatement fee (assessed after roughly 60 days of non-compliance)¹, settle any back maintenance fees, and demonstrate that you have made up the missing CPE hours.

If ISACA approves the appeal, you are reinstated without re-taking the exam. If the appeal is denied, however, reinstatement requires passing the current CRISC exam again, meeting the full experience verification process, and paying application fees from scratch.¹ That is the outcome to avoid.

CRISC vs CISM, CISA, CGRC, and Other Alternatives

ISACA and (ISC)² have carved out distinct certification tracks, making the choice between CRISC and its peers less about brand loyalty and more about the specific risk, audit, or governance seat you want to occupy. Since every credential in this group demands years of professional experience, the right path usually becomes clear once you match the exam's focus to your daily responsibilities.

How the Four Credentials Stack Up

All four exams are delivered computer-based, but their target roles diverge sharply.

• CISM (Certified Information Security Manager): Designed for senior security leaders and CISO-track professionals. It requires five years of information security experience, with at least three years in management across three of the four domains. The exam is 150 questions over four hours, with a passing scaled score of 450 out of 800.¹
• CISA (Certified Information Systems Auditor): The cisa certification is built for IT and IS auditors, audit managers, and compliance analysts. The experience threshold mirrors CISM at five years, and the exam structure is identical: 150 questions, four hours, 450 out of 800 to pass.²
• CRISC (Certified in Risk and Information Systems Control): Focused squarely on IT risk management, from identification through monitoring. It demands three years of relevant experience, making it accessible earlier in a career than CISM or CISA. The exam follows the same format: 150 questions, four hours, scaled score of 450.
• CGRC (Certified in Governance, Risk and Compliance): The CGRC certification is offered by (ISC)² and previously known as CAP. It targets GRC specialists, information system security officers, and RMF practitioners. The bar is lower at two years of experience (or an Associate path), and the exam is 125 questions over three hours, with a passing score of 700 out of 1,000.⁴

When CRISC Is the Better Choice

Choose CRISC if your role revolves around designing, implementing, and monitoring risk controls rather than running a full security program or auditing one. It is the only ISACA credential that explicitly bridges IT and business risk, asking candidates to speak the language of enterprise risk appetite, key risk indicators, and control testing. With a three-year experience requirement, it also serves as a practical first ISACA certification for professionals who are not yet at the management or audit seniority level CISM and CISA demand.

When CISM, CISA, or CGRC Makes More Sense

Go after CISM if you lead an information security team, set policy, and report to executive leadership on program maturity. CISA fits perfectly if your day-to-day involves testing controls, documenting findings, and communicating audit results. And CGRC is the strongest option if you operate inside a formal risk management framework like NIST RMF or if your employer values governance and compliance program design over control optimization. Its lower experience requirement and (ISC)² continuing education structure also pair well with other (ISC)² credentials like the CISSP.

Other Certifications Worth Considering

Beyond this immediate comparison, the CISSP remains the broadest baseline for security knowledge, though it lacks the risk-specific depth of CRISC. vendor-specific certifications from AWS, Microsoft, or Google can complement a CRISC if your risk management responsibilities involve cloud workloads. For practitioners deep in operational risk, the NIST-backed certifications or the FAIR Institute's Open FAIR pathway offer more granular frameworks, but they carry less name recognition with hiring managers outside specialized GRC teams.

Editorial Verdict by Learner Profile

The editorial verdict, alongside our How to Choose a Cybersecurity Certification guide, helps you decide whether CRISC fits your career stage and experience. Each learner profile below gets a clear, no-nonsense recommendation based on what the credential demands and what it delivers.

No IT background

If you are completely new to IT and have no professional experience in technology or security, CRISC is premature. The exam assumes you can identify and evaluate organizational risk, which requires working knowledge of IT infrastructure, controls, and governance. Jumping in now would likely lead to frustration and a failed exam. Instead, focus on building foundational IT and security knowledge first. Explore our best free cybersecurity resources and consider earning CompTIA Security+ or pursuing an entry-level role such as IT support or junior analyst. Spend a year or two gaining hands-on exposure to how systems, policies, and risks actually interact before circling back to CRISC.

Early IT professional (1-3 years)

Professionals with one to three years of general IT experience fit the CRISC profile only conditionally. If your current role already includes documented risk assessment, control evaluation, or audit assistance, the certification can accelerate your move into a dedicated GRC position. However, if your daily work is still primarily operational, troubleshooting tickets, managing endpoints, or basic security monitoring, you likely lack the breadth of risk exposure that CRISC demands. In that case, gain more domain experience first: volunteer for audit projects, shadow a risk team, or seek a lateral move into compliance. When you can point to concrete risk-related tasks, the certification becomes a far more strategic investment.

Working cybersecurity practitioner (3-5 years)

For cybersecurity professionals with a solid three- to five-year track record, CRISC is a strong fit if you want to pivot toward risk governance, GRC, or risk advisory roles. Unlike broad certifications (compare our Cybersecurity Certification Roadmaps), CRISC specifically validates your ability to design and manage a risk-based information security program. It signals specialization that hiring managers recognize when staffing risk management offices or building internal audit capabilities. If your goal is to move from hands-on technical work to strategic, process-driven leadership, the certification sharpens your narrative and differentiates you from peers who remain generalists.

Experienced specialist or manager (5+ years in risk/GRC)

If you already have five or more years of dedicated risk management, IT audit, or GRC experience, CRISC offers the highest-value investment you can make next. It validates expertise you have been practicing for years and immediately opens doors to senior risk officer, director of IT risk, and CISO-track conversations. Because CRISC aligns tightly with ISACA’s frameworks and C-suite priorities, it stacks well with CISM or CISA for professionals building a complete governance portfolio. At this career stage, the exam is less about learning new concepts and more about formalizing your command of risk identification, response, and monitoring, exactly the proof executive recruiters seek.

Frequently Asked Questions

The questions below address the most common concerns candidates raise before committing to the CRISC credential. Because policies, pricing, and exam content can change between cycles, always confirm details against the primary sources listed in each answer rather than relying on secondhand summaries.

Related Articles