CRISC Certified in Risk and Information Systems Control

Explore identifying risk events in this CRISC course, learn to assess threats by probability and impact, identify assets, consult with business process owners, and craft risk responses.

Identify risk factors to understand how contextual and capability factors shape risk events against assets, using COBIT 2019 domains and the risk register for analysis, evaluation, and management.

Learn how changes in the risk environment impact risk identification, monitoring, and response through incident and change management, forecasting, and continuous improvement.

Learn to map the threat landscape and model threats by classifying internal, external, and emerging threats. Document threats and use information from providers, audits, and product vendors to shape responses.

Explore threat modeling and abuse case modeling, identifying threat actors, indicators of compromise and attack, and risk identification, with methods like stride, pasta, Lindoun, and attack trees.

Explore sources of vulnerabilities across networks, physical access, web apps, and cloud and big data. Learn to identify misconfigurations and weak access controls, and apply risk identification and monitoring.

Distinguish vulnerability assessments and penetration testing as distinct processes, and explore manual versus automated testing, scope, OSINT, and gap analysis within CRISC.

develop and analyze risk scenarios to identify potential threats, assess uncertain impacts, and align with business objectives using top-down and bottom-up approaches, guided by FAIR and HARM methodologies.

Explore risk assessment standards and frameworks and how they guide qualitative and quantitative analysis. Review methods like bow tie, Delphi, event tree, fault tree, Markov, Monte Carlo, and Swift.

Choose and apply risk assessment tools wisely to drive accurate risk responses. Maintain a living risk register, rank risks with Pareto analysis, and map outcomes with risk maps.

Explore qualitative and quantitative risk analysis methods, including EMV, ALE, Monte Carlo, and root cause analysis with the Ishikawa diagram, for informed CRISC risk responses.

Identify and prioritize critical services through business impact analysis, enabling disaster recovery and continuity planning with defined recovery time and data loss objectives, guiding risk responses and recovery strategies.

Explore inherent risk, residual risk, and current risk, and how risk appetite, risk tolerance, and risk responses—accept, avoid, mitigate, transfer—shape what's left.

Explore the four risk responses: mitigation, transference, avoidance, and acceptance, and how they align risk with business appetite, tolerance, and capacity through risk assessment, monitoring, and reporting.

Senior management consciously accepts risk within appetite, formalizing the decision with a paper trail and self-insurance reserves; reassess residual risk after mitigation through ongoing reviews.

Assign a single risk owner at the appropriate management level, document ownership in the risk register, drive risk management activities, and aggregate risks to align with strategic risk appetite.

Learn how to manage third-party risk through outsourcing, not transferring liability, with emphasis on data ownership, contracts, service level agreements, and incident and data retention considerations.

Identify issues and exceptions in risk management and apply formal configuration, change, and release controls to mitigate risk. Implement a change advisory board to document exceptions in the risk register.

Identify and manage emergent risk as a dynamic, continuous lifecycle, adapting controls amid evolving technology, cloud, and shadow IT through formal adoption, monitoring, and testing.

Leverage open standards and frameworks to select and implement preventative, detective, deterrent, corrective, and compensating controls across administrative, technical, and physical domains for risk mitigation and governance.

design and select physical, technical, and administrative controls, analyze the current state, perform gap analysis, and apply proactive safeguards or reactive countermeasures within the risk management life cycle.

Learn how to implement and test administrative, technical, and physical controls, using cloud-based test environments, change management, and three changeover methods to manage data migration and maintain business continuity.

Learn how to test controls effectively through post-implementation reviews, progressive and regressive testing, and best practices like data masking, environmental separation, and version control to ensure CRISC risk management.

Develop risk response plans by selecting from avoid, mitigate, transfer, or accept within risk appetite and tolerance, then document a risk treatment plan in the risk register.

Learn how risk practitioners collect, aggregate, analyze, and validate data from diverse sources—including audit reports, incident logs, gap analysis, and cloud tools—to identify and assess risk factors.

Master monitoring techniques for risk and information systems controls by planning observability, identifying risk control owners, engaging stakeholders, and applying audits, vulnerability assessments, and penetration testing.

Master reporting techniques for risk and control using heat maps, scorecards, and dashboards. Turn data quality, timely analysis, and visualizations into clear updates for management and the board.

Learn how key performance indicators (KPIs) measure process performance against SMART targets and guide risk monitoring, with dashboards tracking KPIs as leading indicators of mitigation effectiveness.

Identify key risk indicators (KRIs) and how they measure risk against thresholds, using leading and lagging indicators, balance and root-cause analysis, alongside KPIs, for proactive risk management.

Explore key control indicators (KCIs) that measure control effectiveness, quantify mitigation against risk tolerances, and serve as leading indicators for KRIs linked to that control.

Assess the scope of enterprise architecture to ensure we do the right things, the right way, and deliver benefits using frameworks like Togap and Zachman aligned with business objectives.

Explore hardware and software risk in information systems within CRISC. The lesson covers obsolescence, misconfiguration, physical access, supply chain, and software issues like patching, version control, and data exposure.

Explore networking fundamentals in a risk context, covering TCP/IP and the OSI model, encapsulation, and key infrastructure such as switches, routers, firewalls, DNS, DHCP, VPN, and VLANs.

Explore how virtualization gave rise to cloud, with public, private, and hybrid models, and how data at rest, in transit, and in use must be protected in outsourced cloud environments.

Discover how project management integrates risk assessment, communication, scheduling, cost, and quality across waterfall and agile approaches, including program management for efficient resource allocation.

Learn how disaster recovery and business continuity collaborate, guided by a business impact analysis that defines recovery point objective (RPO) and recovery time objective (RTO) for resilient operations.

Explore risk in the data lifecycle from creation to destruction, and apply data classification, whitelist and blacklist strategies, and cloud access controls with least privilege and separation of duty.

Explore the system development lifecycle from a CRISC perspective, documenting risks in a risk register, categorizing systems, and applying CIA/ICA, privacy, and vendor risk considerations.

Explore emerging technologies and their risks—from cloud and omnipresent connectivity to IoT, BYOD, AI deepfakes, and blockchain—through a CRISC lens.

Explore information security concepts from a CRISC perspective, focusing on protecting data, confidentiality and integrity, and establishing risk management with reliable policies and controls.

Review the CIA triangle—confidentiality, integrity, and availability—and how non-repudiation links them for risk management. Explore least privilege, need to know, system authorization, and the importance of high availability and redundancy.

Master access control by applying identification, authentication, authorization, and accountability, with least privilege and audit logs to govern data and system access.

Explain encryption as a mathematical method that turns plain text into ciphertext to protect confidentiality. Compare symmetric and asymmetric schemes, including AES, public and private keys, PKI, and digital signatures.

Learn how human factors drive information security risk and why security awareness training matters, covering social engineering, spearfishing, reporting incidents, and the role of policies, scope, and least privilege.

Explore data privacy fundamentals in CRISC, contrast privacy and confidentiality, and examine PII, GDPR, informed consent, PIA, minimization, destruction, and risk monitoring for regulatory compliance.