CRISCISACA Certified in Risk and Information Systems Control
Created per CertMap methodology · Updated 12 May 2026 · About the editorial team →
▾ Jump to …4 sections
Overview
What is CRISC?
Certified in Risk and Information Systems Control is the leading certification in IT risk management and is considered the gold standard for professionals at the intersection of IT risk and enterprise governance. CRISC complements CISM and CISA in the ISACA portfolio and is particularly highly valued in regulated industries (banking, insurance, healthcare). The certification was substantially revised in 2025: The new exam content emphasizes Risk Response and Reporting with 32% weighting. CRISC's strength is its direct applicability in GRC roles and strong market penetration; its weakness lies in its broad abstraction, which does not reflect technically deep skills. In career terms, CRISC is a strong signal for risk-focused leadership roles.
Quick facts
Key details
Cost, prerequisites, exam & renewal
Cost over 5 years
AMF prices are ISACA member prices. Membership adds 195 USD/year once per person (135 USD dues + 60 USD Germany chapter, varies by chapter); without membership the AMF is 85 USD per cert.
How is TCO calculated? →Prerequisites
3 years experience in IT risk management and IS control. Min. 1 year in Domain 1 or 2.
Exam format
150 multiple-choice questions, 4 hours, proctored via PSI. Passing score: 450/800.
Renewal & maintenance
Valid for 3 years. 20 CPE hours/year (min. 120 over 3 years) + annual AMF (45 USD Member / 85 USD Non-Member). A one-time application fee of 50 USD applies after passing the exam.
Classification
CertMap score and matching roles
Rating
Matching NICE roles
More certifications
More certifications
From ISACA
AAIAAdvanced in AI AuditAAIRAdvanced in AI RiskAAISMAdvanced in AI Security ManagementCCOACertified Cybersecurity Operations AnalystCDPSECertified Data Privacy Solutions EngineerCGEITISACA Certified in the Governance of Enterprise ITCISAISACA Certified Information Systems AuditorCISMISACA Certified Information Security ManagerIn GRC
CASP+CompTIACCISC2CGEITISACAGSEGIACGSECGIACPECB 22301FPECBPECB 22301LIPECBPECB 22301SLIPECBPECB 27001LIPECBPECB 27001SLIPECBPECB 27001TPECBPECB 31000FPECBPECB 31000LRMPECBPECB Cybersecurity FoundationPECBPECB DORA FoundationPECBPECB DORA Lead ManagerPECBPECB Lead Cybersecurity ManagerPECBPECB NIS2LIPECBSecurity+CompTIASSCPISC2T.I.S.P.TeleTrusTThis page follows CertMap methodology: editorial content is curated by hand. Score, costs and NICE mapping are aggregated from official provider documents. Score methodology → · TCO methodology →
Transparency: CertMap is operated by Daniel Thomas Heessel, who is also managing director of Threat‑Informed, a company specialising in Threat‑Informed Defense. CertMap currently receives no commissions from certification providers, no affiliate links, no sponsored placements. Podcast and interview guests are not paid for appearances and receive no affiliate commissions.
From the knowledge base
View all articles →CISSP oder CISM? Zwei Karrieren, eine Entscheidung
Beide verlangen fünf Jahre Erfahrung, beide kosten auf den ersten Blick ähnlich viel. Trotzdem führen CISSP und CISM in verschiedene Berufe. Der Vergleich mit den Zahlen, die Kursanbieter nicht zeigen.
CISM oder CISA? Zwei ISACA-Wege, eine Richtungsentscheidung
Beide kommen von der ISACA, verlangen fünf Jahre Erfahrung und kosten fast dasselbe. Der Unterschied liegt nicht im Preis, sondern in der Rolle: steuern oder prüfen. Der Vergleich mit den Zahlen und der Rollen-Abbildung.
CC oder Security+? Der Gratis-Einstieg und der Arbeitsmarkt-Klassiker
Beide sind Einsteiger-Zertifikate ohne Zulassungshürde, beide decken die Grundlagen der Cybersicherheit ab, und trotzdem stehen sie für verschiedene Strategien: das eine als niedrigschwelliger, zeitweise kostenloser Start, das andere als etablierter Nachweis mit Gewicht im Arbeitsmarkt. Der Vergleich mit den Zahlen und der gegenläufigen Kostenlogik.
1:1 with the CISO
Need the full picture for your case?
Personal strategy instead of weeks of self-research. Vendor-independent, with auditable recommendations and transparent sources.