Certified in Risk and Information Systems Control credential artwork

Certified in Risk and Information Systems Control (CRISC)

Validates knowledge of IT risk governance, risk assessment, risk response and reporting, and technology controls.

Summary

CRISC is ISACA's certification for IT risk management, for people who identify risks and design or monitor the controls that manage them. It covers risk governance, assessment, response and reporting, and the technology and security principles behind controls.

Good fit if

  • You assess IT risk or design and monitor controls
  • You work in IT risk or GRC and want a risk credential
  • Your target roles list CRISC alongside CISA or CISM

Look elsewhere if

  • You want to audit IT controls, not manage risk: CISA
  • You want to run the whole security program: CISM
  • You are new to security and risk work: Security+

Salary & jobs

Prerequisites

Experience required for certification

3 years in risk assessment and risk response

Required

You need three years of work performing CRISC tasks in both Domain 2 (Risk Assessment) and Domain 3 (Risk Response and Reporting). There are no waivers or substitutions.

Verified experience and application

Required

The experience must fall within the ten years before you apply. Have it verified, then apply and pay the $50 application fee within five years of passing.

You can take the exam before you have the experience. If you passed between August 2021 and November 2025, the earlier rule applies: three years across at least two domains, one of them Governance or Risk Assessment.

Cost

USD · Non-member pricing
$760
$50
Members pay $575 for the exam. Membership costs $145 a year plus chapter dues. Each retake needs a new registration at the full fee. A six-month eligibility extension costs $75.

What holders say

Most useful when you are moving toward risk management

Commenters say CRISC helps most for a risk role, and one passed it a month after CISM. A CISSP and CISM holder skipped it over the extra annual fees and CPE.

r/cismThread: CRISC after CISM (June 2025)

Renewal

Keep CRISC active each year with continuing education and an annual maintenance fee.

CPE each year
20 hours minimum
CPE over 3 years
120 hours
Annual maintenance
$45 member / $85 non-member
Due January 1. Reduced for a third ISACA certification.

CPE can count toward more than one ISACA certification when it is relevant to each. Keep records for 12 months after each three-year cycle in case you are selected for an audit.

ISACA CRISC maintenance requirements ↗

Alternatives

Certified Information Systems Auditor credential artwork
CISA$810 required · Advanced

IT audit, control and assurance.

Certified Information Security Manager credential artwork
CISM$810 required · Advanced

Security management and program leadership.

Certified Information Systems Security Professional credential artwork
CISSP$884 required · Advanced

Broad security practice for architects and senior practitioners.

CompTIA Security+ credential artwork
CompTIA Security+$439 required · Entry

Entry-level security knowledge with no experience requirement.

FAQ

What are the CRISC requirements?

Pass the exam, then apply with three years of work in both risk assessment and risk response and reporting, from the last ten years. There are no waivers. Apply within five years of passing.

Can I take the CRISC exam before I have the experience?

Yes. Anyone can register. You have five years after passing to gain the experience and apply.

How much does CRISC cost?

The non-member exam fee is $760 and the application fee is $50, so $810 in total. Members pay $575 for the exam. Study materials and the annual maintenance fee are extra.

CRISC vs CISM vs CISA: which should I get?

CRISC is about identifying and responding to IT risk. CISM is about managing a security program. CISA is about auditing IT systems and controls.

How is the CRISC exam scored?

Your result is a scaled score from 200 to 800, and you need 450 to pass. It is based on the total number of correct answers, not on each domain.

Last updated October 2026