thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Courses  /  ISACA  /  ISACA Certified in Risk and Information Systems Control (CRISC)
Exam CRISCRisk and Information Systems Control ISACA College credit Guaranteed to run

ISACA Certified in Risk and Information Systems Control (CRISC)

Govern IT risk inside a real organization: assess it honestly, choose a response, design the controls and report in terms a board will act on.

5 days, instructor-led In class or live online Class Hub + 90 days Military funding accepted Up to 3 college credits

Course overview

32%Risk Response and ReportingThe heaviest of four domains
150 questionsFour-hour examScaled score, 450 to pass
2025 outlineCurrent job practiceEffective 3 November 2025

thinQtank® Learning is offering a unique instructor-led training camp that gives students the knowledge and skills needed to govern IT risk inside a real organizational structure — identifying and analyzing risk honestly, choosing a response and designing the controls that carry it, and then monitoring and reporting in terms a board will act on rather than merely acknowledge.

This course also helps students prepare to take the ISACA CRISC exam. It is built on the exam content outline that took effect on 3 NOVEMBER 2025, when ISACA revised the CRISC job practice: Risk Assessment rose from 20% to 22% and Technology and Security fell from 22% to 20%. Material still quoting the older split is a year out of date.

Your certification path

Where this course sits: what to have first, and where it leads.

This courseISACA Certified in Risk and Information Systems Control (CRISC)Exam CRISC

Course objectives

What you will be able to do by the end of the class.

Risk governanceApply ERM, the three lines of defense, risk appetite and tolerance.
Risk identificationIdentify risk events, model threats and develop realistic risk scenarios.
Risk analysisRun business impact analysis and quantitative analysis, and keep a useful risk register.
Risk responseChoose responses, assign ownership and manage third-party and supply-chain risk.
Controls and indicatorsDesign and test controls, and define KRIs, KCIs and KPIs.
Technology and securityAssess architecture, lifecycle, data, resilience and emerging technology risk.

Who it is for

Who gets the most from this class, and what to know before you start.

Who should attend

  • Risk and compliance managers, directors and consultants
  • IT audit managers and consultants moving from auditing controls to designing them
  • Security managers accountable for risk rather than only for technology
  • Business analysts and project managers who own risk on what they deliver
  • Anyone holding CISA or CISM and specializing into risk next
  • Service members, veterans and military spouses using AF COOL, Army Credentialing Assistance, MyCAA or VET TEC 2.0

Prerequisites

  • Three years of professional experience across at least two of the four CRISC domains, gained within the ten years before you apply
  • THE EXAM IS NOT GATED BEHIND IT. Sit and pass the exam first if you like — you then have five years to submit the certification application
  • Working familiarity with a risk or control framework makes the course land faster

Course outline

6 modules. Open any one to see what it covers.

01Governance
  • Organizational structures and accountability
  • ERM and risk frameworks
  • Risk appetite and tolerance
02Risk assessment
  • Threat modeling and vulnerability management
  • Risk scenarios
  • Risk analysis and business impact analysis
03Risk response
  • Response options and ownership
  • Third-party and supply-chain risk
  • Exceptions and issues
04Controls and reporting
  • Control design, implementation and testing
  • KRIs, KCIs and KPIs
  • Monitoring and reporting
05Technology and security
  • Architecture and development lifecycle
  • Data lifecycle and resilience
  • Security principles, awareness and privacy
06Emerging technology and exam preparation
  • Risk from emerging technology
  • Domain review
  • Practice exams

The full lesson-by-lesson outline is in the course datasheet (PDF).

Course features

How the class is taught, and why it works.

Live, instructor-ledEvery session is taught live by a certified instructor, in the classroom and online at the same time.
Hands-on labsLabs are built into the modules so you practise what you learn.
Exam preparation built inPractice questions and focused review aligned to exam CRISC.
Class Hub for 90 daysRecordings, materials and practice stay open for the class plus 90 days after it ends.
Attend your waySterling, VA, Atlanta, GA, Burbank, CA, or live online from anywhere.
Funding friendlyMilitary flat rate, thinQflex monthly payments, or a formal quote for your employer.

What you get

Everything below is included in the course price.

Class Hub access for the length of the class plus 90 days
thinQtank® Learning Accelerated Custom Exam Study Guide for the CRISC exam
Help registering for and scheduling your exam
Custom and focused exam preparation software and materials
Course specific thinQtank® Learning publications to promote a fun and exciting learning
Membership to the thinQtank® Learning University Online
WE DO NOT "TEACH THE TEST" - Students will receive valuable examples and discussion
Receive all reading material and study guides when you register
All courses taught by certified instructors
Additional hours of remote lab access across risk scenarios, controls and metrics
Custom video recordings with even more in-depth learning of course topics
Customized practice exam software
Digital courseware
Retake any or all portions of the course as many times as you like in person or live on-line for 24 months
Six months mentoring access to our engineers after completing the course

Study plan

How the 5 days run, plus what to do before and after class.

Before class
  • Check the prerequisites above and fill any gaps
  • We send joining details and course materials before day one
Day 1
  • Governance
  • Risk assessment
Day 2
  • Risk response
  • Controls and reporting
Day 3
  • Technology and security
  • Emerging technology and exam preparation
Day 5
  • Final review and exam strategy
After class
  • Class Hub stays open 90 days: recordings, labs and practice
  • Book your exam while the material is fresh

The order of topics can shift with the class; your instructor confirms the schedule on day one.

The certification exam

ISACA Certified in Risk and Information Systems Control (CRISC) · exam CRISC

Exam codeCRISC
Questions150
Time4 hours
Passing score450 / 800 (scaled)

Exam domains and weighting

1. Governance
26%
2. Risk Assessment
22%
3. Risk Response and Reporting
32%
4. Technology and Security
20%

Domain weights are from ISACA's CRISC outline effective 3 November 2025.

Format
Multiple choice
Voucher
Exam voucher available through thinQtank for $760. PSI test center or remote proctored
Validity
Maintained with 120 CPE hours per three-year cycle (minimum 20 a year) and an annual maintenance fee

DoD 8140 and college credit

What this certification counts for with the Department of Defense, and toward a degree.

DoD 8140 / 8570 This certification is not on the DoD 8570 baseline list. Under DoD 8140, a degree or qualifying training can also meet the requirement. See which certifications qualify in the DoD Workforce Navigator.
College credit Pass the exam and these universities will count it toward a degree. This is what each school publishes about its own transfer policy; the registrar makes the final call.
3credits UMGC
Accepted WGU amount not published
Accepted Purdue Global amount not published

Most schools only count IT certifications earned in the last three to five years (some require them to be current), and several will not award transfer credit once you have enrolled. Get your evaluation done first.

Where it can take you

Roles this certification is commonly asked for.

IT Risk ManagerOwn the IT risk register and the decisions it drives.
Risk and Compliance DirectorLead risk and control programs across the business.
IT Audit ManagerMove from auditing controls to designing them.
Security Risk AnalystAssess security risk and recommend responses.
GRC ConsultantBuild risk programs for clients.

Upcoming dates

Every class runs in the classroom and live online at the same time. Pick the dates; choose how you attend when you register.

DatesLocationFormat
Nov 2 – 6, 2026GUARANTEED Burbank, CA Classroom + live online Reserve
Nov 30 – Dec 4, 2026 Sterling, VA Classroom + live online Reserve
Dec 14 – 18, 2026 Atlanta, GA Classroom + live online Reserve
Jan 4 – 8, 2027 Burbank, CA Classroom + live online Reserve
Jan 25 – 29, 2027 Sterling, VA Classroom + live online Reserve
Feb 8 – 12, 2027 Atlanta, GA Classroom + live online Reserve
Feb 22 – 26, 2027 Burbank, CA Classroom + live online Reserve
Mar 22 – 26, 2027 Sterling, VA Classroom + live online Reserve
Apr 5 – 9, 2027 Atlanta, GA Classroom + live online Reserve
Apr 19 – 23, 2027 Burbank, CA Classroom + live online Reserve
May 17 – 21, 2027 Sterling, VA Classroom + live online Reserve
Jun 7 – 11, 2027 Atlanta, GA Classroom + live online Reserve

10 more dates through November 2027. Ask about a later date.

Paying for it

The price above is our standard rate. These options can bring it down or spread it out.

Military & veterans
$1,500

Flat rate per class when you use Air Force COOL, Army Credentialing Assistance, MyCAA or VET TEC 2.0. Your program confirms eligibility.

Funding details
thinQflex™
Name your price

Paying yourself? Tell us what you can pay and over how many months, up to twelve. We say yes, or come back with terms.

Make an offer
Employer or agency
Formal quote

A formal quote with the course and exam voucher as separate lines, valid 30 days. Group and government pricing available.

Request a quote

How to enroll

Four steps from here to certified.

  1. Pick your datesChoose a class from the dates above, in a classroom or live online.
  2. Reserve or get a quoteReserve your seat, ask for a quote for your employer, or make a thinQflex offer.
  3. Get readyWe confirm your seat and send joining details and materials before day one.
  4. Attend and certifyTake the class, then sit exam CRISC, with Class Hub open for 90 days after.

Frequently asked questions

Can I sit the exam first?
Yes. You need three years of experience across at least two domains to certify, and you have five years after passing to apply.
Is CRISC the right next step after CISA or CISM?
Often. It suits auditors and security managers who now own risk decisions rather than only technology.
How is the exam delivered?
At a PSI test center or by remote proctoring, booked through isaca.org.
What does it cost?
The standard price is $2,850; exam voucher available through thinQtank for $760. Military students using AF COOL, Army CA, MyCAA or VET TEC 2.0 pay $1,500, and thinQflex lets you name your own price and monthly payment.
How long is the class?
5 days of live, instructor-led training.
Can I attend live online?
Yes. Every class runs live online at the same time as the classroom, with the same instructor and labs.
How long do I keep access to the materials?
Your Class Hub stays open for the length of the class plus 90 days.
Is the exam included?
The exam voucher is priced separately; we can add it to your registration or quote.
Can I use military funding?
Yes. With Air Force COOL, Army CA, MyCAA or VET TEC 2.0 you pay a flat $1,500 per class.
Can my employer pay?
Yes. Request a quote and we will send a formal one, valid for 30 days.
What if I cannot pay all at once?
Use thinQflex to name your price and spread payments over up to twelve months.
Where are the classrooms?
Sterling, Virginia; Atlanta, Georgia; and Burbank, California. Every class also runs live online, so you can join from anywhere.
What do I need to attend online?
A computer with a reliable internet connection, a headset or speakers, and a microphone. A webcam is recommended.
Will I get a certificate of completion?
Yes. You receive a thinQtank Learning certificate of completion when you finish the class.
Which course should I take next?
Most students go on to ISACA CISA, ISACA CISM, ISACA Advanced in AI Risk (AAIR). Tell us your goal and we will map the path with you.
Do you run private classes for teams?
Yes. We deliver private classes on-site or online for teams and agencies, on your dates. Ask for a quote.
Can you help me choose the right course?
Yes. Call 855-868-4467 or email sasmith@thinqtanklearning.com and we will recommend the right starting point.

Ready to earn your Certified in Risk and Information Systems Control (CRISC)?

Next class Nov 2 – 6, 2026 · Burbank, CA and live online.