CRISC Certification

What are the prerequisites for the CRISC exam?

• The CRISC certification would require you to have 3 or more years of experience in IT Control and IT Risk Management.
• Moreover, you must also carry an understanding of Information Security, Information Technology and the basics of administration.

Who should take the CRISC exam?

This exam is for you, if you carry an experience in the Management of IT risks, Design, monitoring, implementation and maintenance of IS controls.

Candidates with the following job roles are suitable to take the CRISC exam:

• Risk Manager
• IT Risk Practitioner
• IT Auditor
• IT Professionals
• Business Analyst
• Project Manager
• Control Professional
• Information Security Professional
• Compliance Professional

What skills will be measured in the CRISC exam?

The exam validates your expertise in the following domains applicable across industry verticals:

Governance:
This domain will cover 26% of the exam objectives. This includes Organizational Governance and Risk Governance, which comprise Organizational Strategy and Structure, goals, objectives, roles and responsibilities, assets and culture.

Also, the policies and standards, business processes, risk profile, appetite and tolerance, 3 lines of defense, regulatory, legal and contractual requirements, professional ethics for Risk Management, Enterprise Risk Management and framework.

IT Risk Assessment:
This section will cover 20% of the exam. This will include IT Risk Identification, Analysis and Evaluation.

This involves Risk assessment, standards and frameworks, registration, analysis techniques, Business impact analysis, Residual and Inherent Risk, Risk Scenario Development, Risk Events, Threat Landscape and Modeling, and Vulnerability and Control Deficiency Analysis.

Risk Response and Reporting :
This section will cover 32% of the exam objectives. This includes Risk Response, Reporting and Monitoring, and Control Design and Implementation.

This comprise risk treatment and response, risk and control ownership, issue finding and exception management, emerging risk management, third party risk management, Control standards, types, design, analysis, selection, implementation, frameworks, testing and effectiveness evaluation, risk and control reporting and monitoring techniques, risk treatment plans, key risk, control and performance indicators, data collection, analysis, aggregation, and validation.

Information Technology and Security:
This domain will cover 22% of the exam. This includes Information Technology and Security principles.

This comprises IT operations and Project Management, Disaster Recovery and Data Lifecycle Management, SDLC, enterprise architecture, emerging technologies, Information Security concepts, standards, frameworks, awareness training, data privacy and protection principles, and business continuity management.

What are the various career paths that you can pursue after completing the CRISC exam?

Once you are a CRISC professional, you can opt for the following careers:

• Chief Information Security
• Information Security
• Business Analyst
• Operations Manager
• Information Control Manager
• Risk and Security Manager
• Information Security Manager