CRISC study guide · 2026

The 4 CRISC domains, explained

4 domains and 44 official subtopics. Risk Response and Reporting carries the most weight at 32%. Each guide explains what the domain covers, how its questions are framed and where candidates lose marks.

Start with Domain 3 See all domains
Questions
150
Time
4 hours
Passing score
450 / 800 (scaled)
Outline
Exam Content Outline effective 3 November 2025 (current)

Exam blueprint

Bar widths follow the official weights. Weight ranges are drawn at their midpoint.

  1. 1 26%
  2. 2 22%
  3. 3 32%
  4. 4 20%
  1. 1 Governance
  2. 2 Risk Assessment
  3. 3 Risk Response and Reporting
  4. 4 Technology and Security

All 4 domains

44 official subtopics 130–175 hrs suggested study

  1. Domain 01 26%

    Governance

    Governance decides who owns risk, how much of it the enterprise will carry, and which rules it must follow. Every later CRISC answer is judged against those decisions, so this is where the exam's logic is set.

    Inside this domain

    • Strategy, Goals, and Objectives
    • Organizational Structure, Roles, and Responsibilities
    • Organizational Culture and Ethics
    • Policies and Standards
    • and 7 more subtopics

    Watch for The practitioner makes the call

    Subtopics
    11
    Questions est.
    ~39
    Study time est.
    35–45 hrs
  2. Domain 02 22%

    Risk Assessment

    Risk Assessment turns threats, vulnerabilities and business impact into risk ratings that leaders can act on. The exam tests whether your ratings reflect business consequences or just technical severity.

    Inside this domain

    • Risk Events
    • Threat Modeling and Threat Landscape
    • Vulnerability Management
    • Risk Scenario Development and Evaluation
    • and 5 more subtopics

    Watch for Highest score first

    Subtopics
    9
    Questions est.
    ~33
    Study time est.
    30–40 hrs
  3. Domain 03 32%

    Risk Response and Reporting

    This is the largest CRISC domain. It covers choosing a risk response, designing and testing controls, and monitoring and reporting so that the right people can decide. Most questions turn on who decides and on whether the evidence shows a control actually works.

    Inside this domain

    • Risk Response Options
    • Risk and Control Ownership
    • Vendor/Supply Chain Risk Management
    • Issues, Findings, Exceptions and Exemptions Management
    • and 9 more subtopics

    Watch for Transfer removes the risk

    Subtopics
    13
    Questions est.
    ~48
    Study time est.
    40–55 hrs
  4. Domain 04 20%

    Technology and Security

    Technology and Security is where IT risk actually arises: architecture, operations, development, data, resilience and new technology. CRISC tests whether you can see the business risk in each of these, not whether you can configure it.

    Inside this domain

    • Technology Principles
    • Technology Roadmaps and Enterprise Architecture (EA)
    • Operations Management (e.g., change management, assets, DevOps, problems, incidents)
    • System Development Life Cycle (SDLC)
    • and 7 more subtopics

    Watch for Emergency means no control

    Subtopics
    11
    Questions est.
    ~30
    Study time est.
    25–35 hrs

Study the heaviest domains first

Marks follow weight. This order puts the most marks behind you first, across about 130–175 hrs of study.

  1. 3 Risk Response and Reporting 32% · 40–55 hrs
  2. 1 Governance 26% · 35–45 hrs
  3. 2 Risk Assessment 22% · 30–40 hrs
  4. 4 Technology and Security 20% · 25–35 hrs

Try one

Practice questionDomain 3: Risk Response and Reporting

After assessment, a business owner decides to accept a risk whose residual rating falls within the enterprise's risk tolerance. What should the risk practitioner ensure happens next?

One trap from every domain

The answer that looks right, and the clue that gives it away.

  • Domain 1

    The practitioner makes the call

    Clue If the option has 'you' deciding on behalf of the business, look for one that informs or escalates to the owner instead.

  • Domain 2

    Highest score first

    Clue If the scenario tells you what the affected systems do or who can reach them, that information is there to change the priority.

  • Domain 3

    Transfer removes the risk

    Clue The scenario mentions customer data, regulators or brand impact after outsourcing.

  • Domain 4

    Emergency means no control

    Clue The change is discovered later with no record or approval.

Other Cybersecurity certifications

Study guides for exams that overlap with CRISC.

Practise what you read

CRISC domains: common questions

How many domains are in the CRISC exam?

CRISC has 4 domains with 44 official subtopics between them: Governance, Risk Assessment, Risk Response and Reporting and Technology and Security.

Which CRISC domain carries the most weight?

Risk Response and Reporting is the heaviest at 32%, followed by Governance (26%). The lightest is Technology and Security (20%). Weights come from ISACA's official outline.

What is the CRISC exam format?

Questions: 150. Time allowed: 4 hours. Passing score: 450 / 800 (scaled).

How long should I study for CRISC?

Our planning estimate is 130–175 hrs across all domains, split by weight. It is an editorial estimate, not an official figure, so adjust it to your experience and to how you score on practice questions.

Where should I start?

Start with Risk Response and Reporting, because it carries the most marks, then work down by weight. Use the checklist on each domain page to confirm you can do what the domain asks before moving on.

Which outline is this guide based on?

This guide follows Exam Content Outline effective 3 November 2025 (current), published by ISACA. It was last reviewed in October 2026.

Domain names, weights and subtopics come from ISACA's official outline (Exam Content Outline effective 3 November 2025 (current)). Question counts and study hours are editorial planning estimates, not official figures. Last reviewed October 2026.