Teach on Udemy

Turn what you know into an opportunity and reach millions around the world.

Learn More

Your cart is empty.

Keep shopping

CRISC - Complete Course | Master IT Risk and Controls

Name: CRISC - Complete Course | Master IT Risk and Controls
Rating: 4.5 (1139 reviews)

Assess IT risk, select treatment and controls, assign ownership, report residual risk.

Created byCyvitrix Learning | CISSP, CISM, CISA, ITIL, PMP & GRC Courses

Last updated 10/2026

English

English [Auto],Italian [Auto],

What you'll learn

Align IT risk governance, roles, policies, and reporting with business objectives, risk appetite, and stakeholder needs.
Conduct risk assessments using assets, threats, vulnerabilities, likelihood, impact, scenarios, and available evidence.
Compare avoidance, mitigation, transfer, and acceptance options and recommend a business-aligned risk response.
Select and evaluate security and technology controls based on risk, ownership, feasibility, and expected effectiveness.
Monitor treatment actions, control performance, key indicators, emerging risk, and residual exposure.
Analyze CRISC-style scenarios and communicate defensible risk decisions to owners, leaders, auditors, and technical teams.

Course content

24 sections • 169 lectures • 30h 29m total length

CRISC in Practice5:18
Start Here: CRISC Study Roadmap, Coverage and Support5:05
You Will Not Walk Alone: Your Study Plan for Course Success2:23
Welcome to CRISC 2026 - Updated CRISC Training As per New ISACA Outlines11:52
Download Course Study Notes0:56

Security Objectives and the CIA Triad13:36
This lecture introduces the foundational security objectives—confidentiality, integrity, and availability—and explains how they guide enterprise risk decisions. You’ll learn why the CIA Triad is central to every security and governance framework.
What Is a Security Program? Purpose, Scope, and Ownership15:13
Explore the structure and purpose of a security program, including its scope, objectives, and ownership. This lecture explains how organizations build programs that align with business goals and support risk management.
GRC Fundamentals — Objectives of Governance, Risk, and Compliance13:19
A comprehensive overview of GRC and how governance, risk, and compliance work together to support enterprise objectives. You’ll understand how GRC frameworks ensure accountability, transparency, and effective risk oversight.
A Quick Check-In: Your Feedback, Questions & Our Learning Community1:49
Risk Governance vs. Management — Decision Rights and Accountability13:49
Learn the critical differences between governance and management, including decision rights, accountability, and strategic oversight. This lecture clarifies how responsibilities are distributed across the organization.
Information Security Governance — Principles and Practices14:10
This lecture covers the principles of information security governance and how organizations establish effective oversight. You’ll learn how governance ensures alignment between security initiatives and business objectives.
Organizational & Corporate Governance Structures11:51
Understand how organizations are structured and how governance frameworks support decision‑making. This lecture explains reporting lines, committees, and the mechanisms that ensure accountability and strategic alignment.
Your First Meeting with Management
Check-in Quiz 1
Quiz 10:04
Building a Risk‑Aware Culture and Professional Ethics in the Age of AI11:03
Explore how organizations cultivate a risk‑aware culture and uphold ethical standards, especially in an era shaped by automation and AI. This lecture highlights behaviors, values, and leadership practices that strengthen governance.
The Three Lines of Defense (3LOD) — Governance in Practice14:37
A detailed explanation of the 3LOD model and how it enhances risk oversight. You’ll learn how each line contributes to assurance, accountability, and effective governance across the enterprise.
Integrating Cybersecurity with Business Strategy and Operations16:00
This lecture shows how cybersecurity must align with business strategy to support resilience and operational continuity. You’ll understand how risk professionals bridge the gap between technical controls and business outcomes.
Business Process Resilience — BCP & DRP from a Governance Lens10:15
Learn how business continuity and disaster recovery planning support governance objectives. This lecture explains how organizations maintain resilience, protect critical processes, and ensure operational readiness.
RACI Matrix — Clarifying Roles and Responsibilities11:06
A practical guide to using the RACI model to define roles, responsibilities, and decision‑making authority. This lecture helps you understand how clear accountability supports governance and reduces operational risk.
Check-in Quiz 2
Quiz 20:04
Policies as Governance Instruments — Design and Hierarchy11:20
Explore how policies function as governance tools that guide organizational behavior. You’ll learn about policy hierarchy, structure, and how well‑designed policies support compliance and risk management.
Standards as Governance Instruments — Adoption & Control12:17
This lecture explains how standards ensure consistency, quality, and control across the organization. You’ll learn how standards complement policies and support governance and regulatory compliance.
Procedures and Guidelines — Operationalizing Governance12:16
Understand how procedures and guidelines translate governance intent into actionable steps. This lecture shows how operational documents ensure consistency, accountability, and effective risk control.
Security Frameworks & Standards Overview (SOX, ISO, NIST, COSO)18:03
A high‑level overview of major security and governance frameworks. You’ll learn how SOX, ISO, NIST, and COSO support risk management, compliance, and organizational governance.
Check-in Quiz 3
Quiz 30:04
Developing Risk Management Policy
Data Lifecycle — Creation to Destruction10:40
This lecture explains how data moves through its lifecycle and the governance controls required at each stage. You’ll understand how proper handling reduces risk and ensures compliance with regulatory requirements.
Data Governance Programs — Stewardship, Ownership, and Controls10:49
Learn how data governance programs are structured, including roles such as data owners and stewards. This lecture highlights the controls and processes that ensure data quality, security, and accountability.
Organizational Asset Management for Risk Professionals12:34
A detailed look at asset management and why it is foundational to risk assessment. You’ll learn how organizations identify, classify, and manage assets to support governance and security objectives.
Data Classification — Models and Implementation10:15
This lecture explains classification models, labeling, and handling requirements. You’ll learn how proper classification supports security controls, compliance, and risk‑based decision‑making.
Secure Data Destruction — Methods and Compliance13:05
Explore secure data disposal methods and the regulatory requirements that govern destruction. This lecture helps you understand how improper disposal creates risk and how organizations mitigate it.
Check-in Quiz 4
Quiz 40:04
Data Security Controls — End‑to‑End Protections12:00
A comprehensive overview of the technical and administrative controls used to protect data throughout its lifecycle. You’ll learn how layered controls reduce risk and support governance.
Privacy vs. Security — Concepts, Obligations, and Regulations16:13
This lecture clarifies the differences between privacy and security, including legal obligations and regulatory frameworks. You’ll understand how privacy risks intersect with security governance.
Check-in Quiz 5
Quiz 50:04

Core Security Terms — Threats, Risks, Exploits, and Attacks12:19
Vulnerabilities — Understanding Weaknesses and Exposure10:59
Malware Landscape — Types, Behavior, and Impact13:08
Threat Actors and Adversary Profiles14:19
Advanced Persistent Threats (APTs) — TTPs and Campaigns14:04
Analyze advanced persistent threats (APTs) and their tactics, techniques, and procedures (TTPs) to attribute campaigns and strengthen defenses of critical assets using threat intelligence and the MITRE ATT&CK framework.
Security Hygiene — Anti‑Malware and Foundational Defenses13:23
Check-in Quiz 6
Quiz 60:04
Abstraction of Cyber Attacks — Kill Chain & MITRE ATT&CK13:48
Analyze the abstraction of cyber attacks from reconnaissance to objective, highlighting the killchain and MITRE ATT&CK framework for understanding tactics and defenses.
DoS & DDoS Attacks — Methods and Mitigations14:11
Man‑in‑the‑Middle Attacks — Network and Protocol Risks14:48
Explore man-in-the-middle attacks that intercept and alter communications, threatening confidentiality, integrity, and availability; leverage HTTPS, VPNs, ARP spoofing defenses, DNS spoofing protection, and MFA.
Web Application Attacks and the OWASP Top 1013:52
Common Weakness Enumeration (CWE) — Patterns and Prevention11:46
Check-in Quiz 7
Quiz 70:04
Social Engineering — Techniques and Controls11:47
Digital Risk Protection and Dark Web Monitoring14:18
Protect brand integrity, data protection, and executive security by mastering digital risk protection and dark web monitoring, including threat intelligence, data leak detection, and proactive takedown actions.
Network Attack Vectors — Wired Environments16:31
Wireless Security Threats and Countermeasures16:58
Check-in Quiz 8
Quiz 80:04
The Complete Risk Management Process — End‑to‑End Flow15:58
Risk Management Frameworks — Overview and Selection13:39
Explore risk management frameworks, including ISO 31000, ISO 27005, NIST, COSO, IZAKA, and RMF, and learn how they identify, assess, mitigate, and monitor risk across business and cybersecurity operations.
Risk Profile — Purpose, Inputs, and Maintenance15:46
Define risk appetite, tolerance, and a living risk profile that links strategy to decisions, using crisp appetite statements, measurable tolerances, triggers, escalation, and thorough documentation.
Inherent vs. Residual Risk — Interpreting Risk Levels11:32
Check-in Quiz 9
Quiz 90:04
Risk Identification — Sources, Tools, and Techniques12:31
Risk Scenario Development — From Qualitative to Quantitative18:21
Develop well-structured risk scenarios that specify assets, threats, events, vulnerabilities, and impacts. Evaluate them across likelihood, impact, velocity, persistence, and detectability to prioritize responses and reporting.
Risk Analysis — Likelihood, Impact, and Aggregation13:16
Risk Evaluation and Response — Treatment Strategies14:09
Risk Reporting and Monitoring — Cadence and Metrics15:27
Check-in Quiz 10
Quiz 100:04
Threat Modeling — Identifying Threats and Misuse12:25
Use Cases and Abuse Cases — Uncovering Control Gaps12:17
Vulnerability Assessment and Penetration Testing - Red Team/Blue Team7:53
Explore vulnerability scanning, penetration testing, and red-blue team exercises to identify and remediate vulnerabilities, test defenses, and strengthen incident response through realistic simulations and debriefings.
Vulnerability Management — Continuous Exposure Reduction13:23
Maturity Assessment Models — Using CMMI for Risk Improvement12:31
Check-in Quiz 11
Quiz 110:04

Security Controls — Concepts, Purposes, and Categories14:28
Control Examples — Preventive, Detective, and Corrective12:58
Explore the foundation of information technology general controls within information security management, highlighting layered detective, preventive, deterrent, and corrective measures across physical, technological, and administrative domains.
Control Objectives, Control Types, and Compensating Controls12:57
Selecting and Implementing Security Controls11:34
Check-in Quiz 12
Quiz 120:04
Documenting Controls — HLD, LLD, and As‑Built Records13:17
Document control implementations by recording methods and configurations, including their linkage to the system security plan and related artifacts. Maintain versioned, up-to-date evidence for audits and assessments.
Assessing and Monitoring Controls — Effectiveness and Assurance13:39
KRIs, KPIs, and KCIs — Metrics and Risk Reporting Dashboards11:51
Design and report risk metrics using KPIs, KRIs, and KCIs with dashboards that balance leading and lagging indicators, ensuring clear definitions, data sources, owners, and actionable thresholds.
Defense in Depth — Layered Control Design14:04
Control Acquisition — Planning, Procurement, and Governance15:25
Issues, Findings, Exceptions, and Risk Acceptance Governance11:38
Roles and Accountability — Owner vs. Custodian11:47
Identify and delineate owner, custodian, and user roles to protect data and assets, implement access controls, and ensure accountability, compliance, and operational resilience.
Check-in Quiz 13
Quiz 130:04
NIST RMF — Risk Management Framework in Practice12:48
NIST SP 800‑30 — Guide for Risk Assessments13:55
COSO ERM — Enterprise Risk Management Integration13:54
ISO 31000 & ISO 27005 — Risk Principles and Methods14:06
ISACA COBIT Framework — Governance Alignment10:27
Explore the COBIT framework, its governance and management objectives, how design factors tailor governance, and map stakeholder needs to IT objectives via the goals cascade.
Check-in Quiz 14
Quiz 140:04
Incident Management — Processes and Playbooks13:43
Business Impact Analysis (BIA) — Methods and Outcomes12:06
Explore how business impact analysis identifies critical functions, assesses dependencies, and quantifies disruption impacts to guide risk management, contingency planning, and resilient recovery for organizational continuity.
Disaster Recovery Planning (DRP) — Strategies and Testing12:17
Business Continuity Planning (BCP) — Program Design13:39
Tabletop Exercises and Simulations — Validating Risk Response12:39
Data Backup — Strategies, Testing, and Recovery13:29
Check-in Quiz 15
Quiz 150:04
Firewalls — Types and Deployment Patterns14:22
Learn how firewalls protect networks—from packet filtering and stateful, circuit-level, and application-layer approaches to NGFWs, cloud firewalls, and web application firewalls—enabling defense-in-depth.
DMZ and Honeypot Architectures — Use Cases and Risks11:41
IDS & IPS — Detection and Prevention in Practice12:32
Email Security — Controls and Threat Handling11:55
Network Segmentation — Isolation and Zero Trust Alignment11:35
Content Filtering & Web Application Firewalls (WAF)11:56
Check-in Quiz 16
Quiz 160:04
Data Loss Prevention (DLP) — Strategies and Governance14:50
Digital Rights Management (DRM) — Control of Sensitive Content12:14
Change Management — Process, Risk, and Approval Workflows13:28
Endpoint Protection — Hardening and Monitoring11:47
Security Awareness Programs — Behavior Change as a Control12:43
Third‑Party and Supply Chain Risk Management11:18
Check-in Quiz 17
Quiz 170:04

Enterprise Architecture — Foundations and Risk Perspectives14:21
Security Architecture Layers10:13
Application Architecture Overview — Risk Considerations13:28
Check-in Quiz 18
Quiz 180:04
Technology Roadmaps — Prioritization and Risk Visibility13:48
Trust Models and Trust Relationships12:39
Zero Trust Architecture — Principles and Implementation Paths12:07
Check-in Quiz 19
Quiz 190:04
Computing Device Components — Implications for Risk12:16
Enterprise Computing — Platforms, Workloads, and Risks16:17
IT Network Foundations — Protocols and Topologies19:21
OSI and TCP/IP Models — Control Placement and Monitoring17:20
DNS and DNSSEC — Integrity and Availability Controls13:58
Map domain names to IP addresses to enable web, email, and cloud interactions. Learn how DNSSEC, DOH, and DOT encrypt queries to protect integrity and privacy.
Check-in Quiz 20
Quiz 200:04
Virtualization and Software‑Defined Data Centers15:39
Virtualization Security — Isolation, Sprawl, and Escape Risks12:47
Containers and Microservices — Architecture and Risks16:18
Explore how containers enable portable, efficient packaging of applications with isolated user spaces. Learn how microservices architecture decomposes apps into independent services, orchestrated via APIs, registries, and platforms like Kubernetes.
Container Security — Images, Registries, and Runtime13:47
Check-in Quiz 21
Quiz 210:04
Serverless Computing — Responsibility Model and Threats16:29
Software‑Defined Networking — Control Planes and Risks12:45
Network Function Virtualization — Reliability and Segregation15:48
Technology Resilience, Observability, and Recovery Practices13:08
Design resilient technology systems that anticipate failure, enable observability, and sustain services through redundancy, graceful degradation, and rapid recovery. Align architecture, monitoring, and testing with business priorities.
Check-in Quiz 22
Cloud Computing — Concepts and Risk Considerations17:15
Explore how cloud computing shifts spending from capex to opex, enables on-demand, pay-as-you-go resources, and automates scalable IaaS, PaaS, and SaaS across public, private, and multi-cloud deployments.
Cloud Deployment Models — Public, Private, Hybrid16:05
Cloud Service Models — IaaS, PaaS, SaaS Risk Differences17:00
Check-in Quiz 23
Quiz 230:04
Shared Responsibility Model — Security and Compliance Roles15:51
Cloud Contracts — Risk and Assurance Requirements16:14
Threats in Cloud Environments — Visibility and Control Gaps16:10
Check-in Quiz 24
Quiz 240:04
Identity, Authentication, Authorization, and Accounting (IAAA)15:40
Access Control Terminology — DAC, MAC, RBAC, ABAC10:56
Authorization Models — Design and Enforcement11:42
Accounting and Auditing — Evidence and Traceability12:35
Capture, centralize, and analyze event data to create an audit trail that enables traceability, incident response, and regulatory compliance across systems, with role-based, mandatory, discretionary, and rule-based access controls.
Check-in Quiz 25
Quiz 250:04
Physical Access Controls — People, Facilities, and Assets15:48
Learn how physical access controls use PACS, credentialing, barriers, and surveillance to deter threats and protect people, facilities, and assets while aligning with ISO 27001 and GDPR.
Check-in Quiz 26
Quiz 260:04
Cryptography Overview — Objectives and Use Cases12:39
Symmetric Encryption — Algorithms and Key Management11:26
Asymmetric Encryption — PKI and Key Exchange15:21
Integrity and Hashing — Non‑Repudiation and Validation12:34
Check-in Quiz 27
Quiz 270:04
Public Key Infrastructure — Components and Operations12:31
Digital Signatures — Assurance and Legal Enforceability9:57
SSL/TLS Decryption and Encryption Applications13:47
Emerging Cryptography — Post‑Quantum and Modern Trends15:42
Check-in Quiz 28
Quiz 280:04
AI Risk Management — Foundations for Risk Practitioners15:01
AI Governance and Risk Frameworks12:38
Explore how AI governance extends risk management to address scale, opacity, and bias with lifecycle controls, reporting, and integration into enterprise risk management across steering committees and ethics boards.
AI Data Governance, Privacy, and Ethics15:51
AI/ML Risk Assessment — Scenarios, Threat Modeling, and BIA11:23
OWASP LLM Top 10 — AI Application Risks16:44
Check-in Quiz 29
Quiz 290:04
DevOps and Change Management — Operational Risk Controls11:58
Balance speed and safety by embedding DevOps risk controls into automated pipelines, combining code review, shift-left security, and configuration management with KRIs, incident response, and blameless postmortems.
Portfolio and Agile Project Management Risks13:57
Emerging Risk Monitoring and Horizon Scanning12:19
Quantum Computing — Impacts on Cryptography and Risk14:51
OT and ICS Security — Fundamentals and Risk Patterns14:49
Check-in Quiz 30
Quiz 300:04

Requirements

No risk-management role or certification is required; basic familiarity with business, IT, security, audit, or governance is helpful.
Certification eligibility is separate from course enrollment; review current official ISACA requirements if you plan to sit the exam.

Description

This course contains the use of artificial intelligence.

Cyvitrix Learning creates and reviews the curriculum, scripts, explanations, and examples. Human subject matter experts remain responsible for accuracy, quality, and updates.

Turn risk concepts into business-aligned decisions about ownership, treatment, controls, and residual exposure. This full CRISC course helps you understand how governance shapes IT risk work, how risk is assessed, how responses are selected, and how technology and security controls support organizational objectives.

What the curriculum covers

The course follows four CRISC domains. Governance establishes organizational context, objectives, roles, policy direction, accountability, and the conditions needed for effective risk management. IT Risk Assessment develops a structured way to identify assets, threats, vulnerabilities, events, likelihood, impact, and risk scenarios while using evidence to support analysis.

Risk Response and Mitigation examines treatment choices, control selection, ownership, action planning, acceptance, escalation, and the difference between inherent and residual risk. Information Technology and Security connects risk decisions to security objectives, programs, architecture, operations, and controls. Throughout the course, scenarios show how risk appetite, tolerance, indicators, reporting, and stakeholder communication affect the final decision.

How to use this course

For each scenario, define the objective, risk owner, affected asset, event, consequence, available evidence, response options, selected controls, and residual risk. Compare alternatives rather than memorizing one isolated definition. Use the course Q&A when you need clarification about a risk decision, a domain relationship, or the reasoning behind an answer.

This is a full instructional course with practice activities, not a question-only practice-exam product. It supports certification preparation and professional risk practice without promising an exam result.

This is an independent educational resource. It is not sponsored by, endorsed by, affiliated with, or approved by ISACA. CRISC and related marks belong to their respective owners. Official ISACA outlines, requirements, and materials remain authoritative.

What you will be able to do

Align IT risk governance, roles, policies, and reporting with business objectives, risk appetite, and stakeholder needs.
Conduct risk assessments using assets, threats, vulnerabilities, likelihood, impact, scenarios, and available evidence.
Compare avoidance, mitigation, transfer, and acceptance options and recommend a business-aligned risk response.
Select and evaluate security and technology controls based on risk, ownership, feasibility, and expected effectiveness.
Monitor treatment actions, control performance, key indicators, emerging risk, and residual exposure.
Analyze CRISC-style scenarios and communicate defensible risk decisions to owners, leaders, auditors, and technical teams.

How to get the most from this course

Follow the sections in order so the concepts build into a connected professional workflow.
Pause after each major topic and relate the decision, evidence, or control to your own environment.
Use the scenarios and review activities to test your reasoning, not only your recall.
Use the course Q&A when a concept, decision, or example needs clarification.

Who this course is for:

IT risk analysts and GRC professionals who need an end-to-end view of assessment, response, controls, and reporting.
Security, audit, compliance, and technology professionals who contribute evidence or recommendations to risk decisions.
Managers, control owners, and consultants who must communicate inherent and residual risk to business stakeholders.
CRISC candidates who want domain coverage connected to worked risk decisions and practice scenarios.

CRISC - Complete Course | Master IT Risk and Controls

What you'll learn

Explore related topics

Course content

CRISC Course Introduction5 lectures • 26min

CRISC Domain 1 — Governance30 lectures • 4hr 47min

CRISC Domain 2 — IT Risk Assessment35 lectures • 6hr 36min

CRISC Domain 3 — Risk Response and Mitigation40 lectures • 7hr 17min

CRISC Domain 4 — Information Technology and Security60 lectures • 11hr 22min

CRISC Certification - Domain 1: Governance Fundamentals (Part 1)0

CRISC Certification - Domain 1: Governance Tools and Policies (Part 2)0

CRISC Certification - Domain 1: Data Management and Privacy (Part 3)0

Domain 2: Security Terminologies and Foundations (CRISC Part 1)0

Domain 2: Security Threats (CRISC Part 2)0

Requirements

Description

Who this course is for: