Everything to know about earning the CRISC certification

Certifications are a vital component of the Information Technology (IT) and Information Security (IS) fields. They substantiate a professional's experience and demonstrate certain skills to potential employers. Many IT/IS positions prefer or require applicants to have certain certifications so that they know that the person they hire has the skills to perform the job. Because of this, earning a certification is something that everyone in the cyber security field should strive for if they want to maximize their success.

In order to earn most IT/IS certifications, you have to fulfill certain experience requirements and pass an exam. The same is true for one popular certification for cyber security professionals that specialize in risk management: Certified in Risk and Information Systems Control (CRISC). According to ISACA, over 23,000 people have obtained the CRISC certification since its inception in 2010. In this guide, we've outlined who the CRISC certification is designed for, how to prepare for the exam, how to leverage this popular certification to your advantage and more.

What is CRISC?

The CRISC certification is one of many IT certifications offered by ISACA, formerly known as the Information Systems Audit and Control Association. ISACA is a membership organization dedicated to the advancement of IT/IS professionals and is recognized as a global leader in the IT/IS fields.

"The CRISC is designed for IT risk, control and compliance practitioners, business analysts, project managers and other IT and business professionals who have three years of risk management and information system control experience within the past ten years," wrote Lisa Cook, GRC Professional Practices Principal at ISACA. "CRISC prepares IT professionals to help the enterprise assess, govern and mitigate risk from internal and external threats and vulnerabilities. These are in-demand skills in organizations."

CRISC certification salary & other benefits

As a cyber security professional, there are many advantages to earning the CRISC certification. Adding the CRISC certification to your resume could be an incredible boon to your career and earning potential in the cyber security field.

"CRISC is the certification associated with the highest salary in North America according to Skillsoft's 2022 IT Skills & Salary Report, increasing from the fourth position in 2021. The CRISC certification garners an average salary of $167,145," Cook said.

The benefits don't end there. Consider these other ways that a CRISC certification could upgrade your career:

The certification allows IT risk practitioners to demonstrate to hiring managers they have the knowledge and skills to perform risk assessments and validate the requisite job experience. CRISC is also an accredited certification program under ISO/IEC 17024:2012, further validating that the job functions tested match the experience required.  All of this helps lend credibility to any CRISC holder, which helps boost earning potential and career opportunity," Cook said.

CRISC exam details

The CRISC exam is a computer-based test administered at authorized testing centers or as a remotely proctored exam. You have four hours to answer the exam's 150 multiple-choice questions. These questions may be in the form of a question or an incomplete statement. You may also be presented with a scenario that requires you to answer two or more questions on the information provided.

ISACA exams are scored on a scale of 200 to 800. You need a score of 450 or higher to pass. After you finish the exam, you are immediately notified if you passed or not.

You can retake the test a maximum of three more times within a year of your first attempt if you don't pass. Keep in mind that you must pay the exam fee for each retake.

CRISC domains and knowledge areas

The CRISC certification exam tests candidates on four core domains that each make up roughly one-fourth of the exam:

Governance: This domain evaluates your understanding of an organization's business and IT environments, such as their organizational strategy, structure, goals and objectives and makes up 26% of the exam. It explores the potential or existing impacts of IT risk on the business objectives and operations of the organization.

IT risk assessment: The second knowledge area validates your knowledge of the threats and vulnerabilities to the organization and the probability and impact of future attacks. This domain constitutes 20% of the exam.

Governance: This domain evaluates your understanding of an organization's business and IT environments, such as their organizational strategy, structure, goals and objectives and makes up 26% of the exam. It explores the potential or existing impacts of IT risk to the business objectives and operations of the organization.

Information technology and security: The fourth and final domain is 22% of the exam and explores the synthesis of business practices with risk management and IS frameworks and standards. It also looks at the development of a risk-aware organizational culture and the implementation of cyber security awareness training.

Preparing for the CRISC exam

ISACA has a wide variety of CRISC exam prep resources available, including online prep courses, study groups, study guides and a free practice quiz. Most of their resources must be purchased, but you can receive a discount if you are an ISACA member. Try to take advantage of as many resources as you can—by checking out exam resources, you can get a good idea of how prepared you already are for the test and what areas you might need to spend extra time studying for.

"ISACA offers an online review course, review manuals (available in English and other languages) and a powerful review questions, answers and explanations database to help practitioners prepare to earn the CRISC certification. There is also the option to participate in the ISACA Engage Community, with access to forums and advice on how to prepare for the exam and seek real-world insight into the day-to-day challenges of a risk professional," Cook said. "ISACA also offers an IT Risk Fundamentals certificate for those interested in gaining knowledge in the field, but who lack the experience to pursue the CRISC. It is a great stepping stone to becoming knowledgeable in IT risk."

In addition, check out some of these test-taking tips that can help ensure you do your best on the exam:

1. Study frequently leading up to the exam instead of cramming.
2. If you are taking an in-person exam, arrive at the testing center early to make sure you can find where you need to be, stow your personal belongings, use the restroom, or anything else you need to do before the exam.
3. Read each answer carefully, answer what you know, and skip questions that are stumping you and come back to them later.
4. Answer every single question. You aren't penalized for wrong answers—your grade is based on the number of correct answers only. If there are questions left that you either didn't know or didn't have time to answer, just make a guess.
5. Try to budget your time as best you can. With 240 minutes to answer 150 questions, that translates to about a minute and a half per question.

After passing the CRISC exam

Unlike many other professional certifications out there, you are not automatically CRISC-certified once you pass the exam. Instead, you must apply for certification as long as you meet the rest of the requirements (including the experience requirements). 

In order to maintain your CRISC certification, you must complete the Continuing Professional Education (CPE) requirements. This means you must complete 20 CPE units annually and 120 CPE units over a three-year period. ISACA offers many ways to earn CPE units including attending conferences, completing training courses and skills-based labs, watching webinars and so much more.

Real-world applications of CRISC

Risk management within the IT/IS fields is arguably more important now than ever before. Integrating new technologies like machine learning into business models requires that businesses understand how to use them safely.

"The breakneck speed of technology innovation and advancement (e.g., AI-enabled systems and other emerging technology) require enterprises to align technology to business needs and design and implement systems in a way that enhances the effectiveness and efficiency of the business processes and services they deliver," Cook said. "It's important for enterprises to first understand the risk associated with emerging tech and then put mechanisms in place to mitigate it. Those mechanisms will require a multi-disciplinary team which will include IT risk and associated practitioners with deep knowledge of IT risk management, governance, data compliance and assurance."

Testimonials from professionals certified in risk and information systems control (CRISC)

Comparing CRISC with other risk management certifications

The CRISC certification is not the only other risk management certification out there. Depending on who you work for, what you do and your individual career goals, there may be other certifications that are better for you or that you could pursue in addition to a CRISC certification.

Here are a few examples of other certifications that may be useful for risk management professionals:

Each of these certifications has its own qualifications and competency areas that make them distinct.

"Other risk certifications focus on general overall enterprise risk from an assurance perspective (such as CRMA) or are focused on project-based risk (such as the offerings from PMI)," Cook said. "CRISC focuses on establishing the connection between IT risk and overall enterprise risks. It is unique in focusing on the impact of IT risk management in the context of overall risk to an organization."

"CRISC can stand alone, but ISACA's other certifications can complement and enhance opportunities for those who want to pursue or demonstrate experience in multiple domains," Cook said. "For example, CISA holders can pursue a CRISC to help balance their audit knowledge with appropriate risk identification and assessment expertise.  CRISC holders interested in navigating their career path into security management or IT governance can pursue the CISM or CGEIT certification, respectively. Practitioners seeking to specialize in privacy and associated risk can pursue CDPSE certification."    

Wrapping it up

If you want to elevate your IT/IS career and validate your risk management skills, the CRISC certification from ISACA could be a fantastic credential to add to your resume. This credential for IS risk management professionals is offered by one of the most recognized organizational leaders in the IT/IS industry. Getting this certification could be that extra boost needed to open up new career possibilities and potentially a higher salary.

To learn more about the CRISC certification and what it could do for your career, check out ISACA's website for more information.

Published: October 16, 2023