CRISC Course

CRISC course details:

CRISC body of knowledge consists of the following domains:

Domain 1: IT Risk Identification (27 percent):

 This part focuses on the actions and requirements needed to collect an organization’s information and data to identify present or potential risks, threats, and vulnerabilities. These questions also cover the preparation of scenarios to determine the potential impact of risks to an organization, who the stakeholders are, and the business risk tolerance.

Domain 2: IT Risk Assessment (28 percent):

This domain covers the creation of an efficient security assessment program that allows the identification of any issues that could pose a threat to the organization. Questions test your knowledge of the current and desired states of a given IT risk environment for securing reasonable and appropriate controls. This domain also focuses on testing current controls and communicating the assessment results to management and other stakeholders.

Domain 3: Risk Response and Mitigation (23 percent):

This section focuses on the development and implementation of effective risk responses, followed by the application of appropriate controls to mitigate exposure. It also covers evaluating the effectiveness of threat response and restoring the organization’s processes to normal, including who is accountable for what roles in the recovery. Finally, this domain covers the documenting controls and procedures, updating risk registers, and ensuring that all established risk control policies are followed.

Domain 4: Risk and Control Monitoring and Reporting (22 percent):

This domain deals with the requirements for continuously monitoring both the IT risks and the controls put in place, as well as the continued effectiveness of the risk management strategy and how it supports business objectives. This domain also covers the process of reporting these findings to stakeholders.

The questions revolve around metrics value, including the monitoring and critical risk indicator (KRIs) analysis, and the means of analyzing key performance indicators (KPIs), the latter which can be used to identify changes or trends related to the controls’ efficiency and effectiveness.