CRISC Prep Course

Domain 1: Governance

A. Organizational Governance

• Strategy, Goals, and Objectives.
• Organizational Structure, Roles, and Responsibilities.
• Organizational Culture and Ethics.
• Policies and Standards.
• Business Processes and Resilience (e.g., DRP, BCP).
• Organizational Asset Management.

B. Risk Governance

• Enterprise Risk Management (ERM).
• Lines of Defense.
• Risk Profile.
• Risk Appetite and Risk Tolerance.
• Risk Frameworks, Legal, Regulatory, and Contractual Requirements.

Domain 2: Risk Assessment

A. Risk Identification

• Threat Modeling and Threat Landscape.
• Vulnerability Management.
• Risk Scenario Development and Evaluation.

B. Risk Analysis

• Risk Assessment Concepts and Standards.
• Business Impact Analysis (BIA).
• Risk Register.
• Risk Analysis Methodologies.
• Inherent and Residual Risk.

Domain 3: Risk Response and Reporting

A. Risk Response

• Risk Response Options.
• Risk and Control Ownership.
• Vendor/Supply Chain Risk Management.
• Issues, Findings, Exceptions, and Exemptions Management.

B. Control Design and Implementation

• Control Frameworks, Types, and Standards.
• Control Design, Selection, Implementation, and Analysis.
• Control Testing Methodologies.

C. Risk Monitoring and Reporting

• Risk Action Plans Data Collection, Aggregation, Analysis, and Validation.
• Risk and Control Metrics (e.g., KRIs, KCIs, KPIs).
• Risk and Control Monitoring Techniques.
• Risk and Control Reporting Techniques (e.g., heatmaps, scorecards, dashboards).
• Monitoring and Reporting of Emerging Risks.

Domain 4: Technology and Security

A. Technology Principles

• Technology Roadmaps and Enterprise Architecture (EA).
• Operations Management (e.g., change management, assets, DevOps, problems, incidents).
• System Development Life Cycle (SDLC).
• Data Lifecycle Management.
• Portfolio and Project Management (e.g., Agile).
• Technology Resilience and Disaster Response/Recovery.
• Emerging Technologies.

B. Information Security Principles

• Security Concepts, Frameworks, and Standards.
• Security/Risk Awareness and Training.
• Data Privacy and Data Protection Principles.