CRISC Exam Information and Outline
Certified in Risk and Information Systems Control
Syllabus Update Checked on: November 9, 2026
CRISC Exam Syllabus & Study Guide
Before you start practicing with our exam simulator, it is essential to understand the
official CRISC exam objectives. This course outline serves as your roadmap.
The information below reflects the 2026 syllabus defined by
ISACA.
Below are complete topics detail with latest syllabus and course outline, that will help you good knowledge about exam objectives and topics that you have to prepare. These contents are covered in questions and answers pool of exam.
- Exam Format
- 150 multiple-choice questions; 4 hours
- Domain 1: Governance (26%)
- Organizational strategy, goals and objectives
- Organizational structure, roles and culture
- Policies, standards and enterprise risk management
- Risk appetite and tolerance
- Domain 2: IT Risk Assessment (22%)
- Risk identification, threat modelling and vulnerability analysis
- Risk analysis, assessment and risk register
- Domain 3: Risk Response and Reporting (32%)
- Risk treatment and control design
- Third-party risk
- Control testing and KRIs/KPIs
- Risk reporting
- Domain 4: Information Technology and Security (20%)
- Enterprise architecture and IT operations
- Project and program management
- Business continuity and data privacy
- Information security frameworks and emerging technologies