CRISC (Certified in Risk and Systems Information Control) Preparation Course

Prepare the CRISC - Certified Risk and Information System Control certification
This CRISC training course, in association with ISACA, prepares IT professionals for real-world threats with relevant tools to assess, govern and mitigate risk, and is targeting certification preparation.
The CRISC - Certified Risk and Information System Control - certificate gives you international recognition (from ISACA) as a security professional. The CRISC extensive set of online practice questions (QAE) are included in the courseprice.
The CRISC designation will not only certify professionals who have knowledge and experience identifying and evaluating entity-specific risk, but also aid them in helping enterprises accomplish business objectives by designing, implementing, monitoring and maintaining risk-based, efficient and effective IS controls.

• Continuing Professional Education (CPE): 31.
• Practice questions (QAE = Questions, Answers and Explanations): 6 month access.

Domain 1: Governance

A. Organizational Governance

• Strategy, Goals, and Objectives.
• Organizational Structure, Roles, and Responsibilities.
• Organizational Culture and Ethics.
• Policies and Standards.
• Business Processes and Resilience (e.g., DRP, BCP).
• Organizational Asset Management.

B. Risk Governance

• Enterprise Risk Management (ERM).
• Lines of Defense.
• Risk Profile.
• Risk Appetite and Risk Tolerance.
• Risk Frameworks, Legal, Regulatory, and Contractual Requirements.

Domain 2: Risk Assessment

A. Risk Identification

• Threat Modeling and Threat Landscape.
• Vulnerability Management.
• Risk Scenario Development and Evaluation.

B. Risk Analysis

• Risk Assessment Concepts and Standards.
• Business Impact Analysis (BIA).
• Risk Register.
• Risk Analysis Methodologies.
• Inherent and Residual Risk.

Domain 3: Risk Response and Reporting

A. Risk Response

• Risk Response Options.
• Risk and Control Ownership.
• Vendor/Supply Chain Risk Management.
• Issues, Findings, Exceptions, and Exemptions Management.

B. Control Design and Implementation

• Control Frameworks, Types, and Standards.
• Control Design, Selection, Implementation, and Analysis.
• Control Testing Methodologies.

C. Risk Monitoring and Reporting

• Risk Action Plans Data Collection, Aggregation, Analysis, and Validation.
• Risk and Control Metrics (e.g., KRIs, KCIs, KPIs).
• Risk and Control Monitoring Techniques.
• Risk and Control Reporting Techniques (e.g., heatmaps, scorecards, dashboards).
• Monitoring and Reporting of Emerging Risks.

Domain 4: Technology and Security

A. Technology Principles

• Technology Roadmaps and Enterprise Architecture (EA).
• Operations Management (e.g., change management, assets, DevOps, problems, incidents).
• System Development Life Cycle (SDLC).
• Data Lifecycle Management.
• Portfolio and Project Management (e.g., Agile).
• Technology Resilience and Disaster Response/Recovery.
• Emerging Technologies.

B. Information Security Principles

• Security Concepts, Frameworks, and Standards.
• Security/Risk Awareness and Training.
• Data Privacy and Data Protection Principles.

At least three years cumulative work experience performing tasks across at least three CRISC domains is recommended.

CRISC is designed for IT professionals, risk professionals, business analysts, and project manager and/or compliance professionals and anyone who has job responsibilities in the following areas: Risk identification, assessment, evaluation, risk response, monitoring and IS control design/monitoring and implementation/maintenance, including:

• Security Directors/Managers/Consultants.
• Compliance/Risk/Privacy Directors and Managers.
• IT Audit Directors/Managers/Consultants.
• Compliance/Risk/Control Staff.