CRISC Exam Guide 2026: Domains, Cost, and Study Plan

Home / Blog / CRISC Exam Guide 2026: Domains, Cost, and Study Plan Technology 14 min read CRISC Exam Guide 2026: Domains, Cost, and Study Plan A current, source-backed guide to the 2026 CRISC exam: the 26/22/32/20 domain weights, fees, scoring, experience rules, retake waits, and a flexible eight-week study plan. Ran Chen, EA, CFP April 23, 2026 Summarize AI

Free exam prep CRISC Certified in Risk and Information Systems Control Study Guide 55 topics Practice Questions 200 questions

✓ Key Facts • The current CRISC exam has 150 multiple-choice questions and allows four hours, which averages 96 seconds per question. • ISACA reports CRISC scores on a 200-800 scale; 450 is passing, and no published raw percentage guarantees that score. • The current outline, effective November 3, 2025, weights Governance 26%, Risk Assessment 22%, Risk Response and Reporting 32%, and Technology and Security 20%. • CRISC exam registration costs US$575 for ISACA members and US$760 for nonmembers, before optional preparation materials or applicable taxes. • Exam registration creates a six-month eligibility window, and candidates can test at a PSI center or through remote proctoring. • Retakes require waits of 30 days, then 90 days, then another 90 days, with four attempts maximum per rolling year. • Certification requires three years of relevant professional experience across at least two CRISC domains, with no experience waivers or substitutions. • Candidates must apply within five years after passing; qualifying experience must fall within the ten years preceding the certification application. • CRISC maintenance requires 120 CPE hours per three-year cycle, including at least 20 hours annually, plus the annual maintenance fee. • ISACA's CRISC page advertises a six-month QAE subscription with an 833-question pool for practice with the current exam resources.

📺 Watch the Video

CRISC exam guide for 2026 The current CRISC exam has 150 multiple-choice questions in four hours , uses a 200-800 scaled score , and requires 450 to pass . Registration is US$575 for ISACA members or US$760 for nonmembers . The exam outline effective November 3, 2025 weights the domains 26%, 22%, 32%, and 20% . Those numbers matter because many guides still show the previous 26/20/32/22 split or an outdated eligibility window. This guide uses ISACA's current credential page, exam content outline, 2026 Candidate Guide, certification requirements, and maintenance page, all checked July 30, 2026. Ready to establish your baseline? Try free CRISC practice questions , record which domain and reasoning step caused each error, and use that evidence to adapt the plan below. CRISC exam at a glance

Item Current rule Questions 150 multiple-choice questions Time 4 hours, or an average of 96 seconds per question Score 200-800 scaled score; 450 passes Domain weights Governance 26%; Risk Assessment 22%; Risk Response and Reporting 32%; Technology and Security 20% Delivery PSI test center or remotely proctored Registration Continuous registration with a six-month eligibility window Exam fee US$575 member; US$760 nonmember Certification application US$50 after passing and meeting the experience rules Retakes Wait 30 days, then 90 days, then 90 days; four attempts maximum in a rolling 12 months ISACA includes both scored questions and unscored pretest questions in the exam. Pretest items do not affect your result. You cannot identify them, so give every item the same attention. There is no penalty for an incorrect answer; answer all 150 questions. A preliminary pass or fail status appears after the exam. ISACA says the official score is available within 10 working days. The four current CRISC domains ISACA updated the CRISC outline for exams delivered from November 3, 2025. Risk Assessment increased from 20% to 22%, while Technology and Security decreased from 22% to 20%. Governance and Risk Response and Reporting remained at 26% and 32%.

Domain Weight What the official outline emphasizes 1. Governance 26% Organizational and risk governance, business context, roles, policies, standards, and the legal or regulatory environment 2. Risk Assessment 22% Risk events and scenarios, threats, vulnerabilities, assessment methods, analysis, and communicating assessment results 3. Risk Response and Reporting 32% Response options, ownership, control design and implementation, control testing, monitoring, and risk reporting 4. Technology and Security 20% Technology principles, architecture, operations, systems development, emerging technology, and information security concepts Use the percentages to set an initial allocation, not to predict an exact question count. Domain 3 deserves the largest block, but a weak lower-weighted domain still needs remediation. Download the official outline before studying and use its task and knowledge statements as your checklist. Can you take the exam before you have the experience? Yes. The exam is open to anyone. Passing it and earning the certification are separate steps. To become CRISC certified, you need at least three years of cumulative professional experience performing IT risk management and information systems control work across at least two of the four CRISC domains . ISACA does not allow experience waivers or substitutions. Current timing rules are: You may take the exam before meeting the experience requirement. Your qualifying experience must have been earned within the 10 years before your certification application. You must submit the certification application within five years after passing the exam. The application must include verified experience, acceptance of ISACA's ethics and policy requirements, and the US$50 processing fee. Do not add an extra domain restriction from an older or third-party summary. The current CRISC certification page states at least two of the four domains. Use the current application form when you are ready to document the work. What CRISC actually costs The fixed fees most candidates need to plan for are:

Item Member Nonmember Exam registration US$575 US$760 Certification application US$50 US$50 Annual maintenance after certification US$45 US$85 Professional ISACA membership currently costs US$145 to join and US$135 per year after that , plus local chapter dues. The exam discount is US$185, but that does not make the first-year membership decision an exact break-even: chapter dues and the live checkout total vary. Compare the member and nonmember totals at checkout before paying. Preparation products are optional and their prices can change. Check the live ISACA store instead of relying on a bundled total from a blog. A retake requires another full exam fee. Registration, scheduling, and retakes After registration and payment, you receive a six-month exam eligibility window. ISACA says candidates may schedule as early as 48 hours after registration. Available appointments depend on PSI capacity and the selected delivery method. Read the appointment confirmation and the current Candidate Guide before exam day. The guide controls identification, rescheduling, remote workspace, check-in, and prohibited-item rules. Do not rely on a testing-center anecdote for what is allowed. If an attempt is unsuccessful, the current waiting periods are: After attempt 1: wait 30 days before attempt 2. After attempt 2: wait 90 days before attempt 3. After attempt 3: wait 90 days before attempt 4. Maximum: four attempts within a rolling 12-month period. Every retake requires full payment. Build the waiting periods into any deadline tied to a job, promotion, or application. How CRISC scoring works ISACA converts performance to a scale from 200 to 800. A score of 450 or higher passes. The scaled score is not a raw percent correct, so claims that a particular practice percentage equals 450 are not official. ISACA also does not publish a CRISC pass rate. Vendor estimates, candidate polls, and salary claims cannot tell you whether your preparation is sufficient. Use evidence you control: coverage of the current outline, error patterns, explanation quality, and performance under the four-hour time limit. A flexible eight-week CRISC study plan There is no official required study-hour total. Eight weeks is a planning template, not a promise. If the diagnostic exposes unfamiliar domains or your weekly availability is limited, stretch each phase rather than compressing it.

Week Primary work Concrete output 0 Download the outline and Candidate Guide; take a mixed diagnostic Domain baseline and error log 1 Governance Notes mapped to every Domain 1 task and knowledge statement 2 Risk Assessment Worked explanations for missed assessment questions 3-4 Risk Response and Reporting Response, control, monitoring, and reporting comparison sheets 5 Technology and Security Gap list connecting technology concepts to risk decisions 6 Mixed-domain application Error log grouped by knowledge, reading, and reasoning errors 7 Timed full-length practice Pacing record and a ranked remediation list 8 Targeted review and logistics Closed high-priority gaps and confirmed exam-day setup Week 0: establish the baseline Use a mixed set that touches all four domains. For every miss, record the domain, the concept, why your choice failed, and what evidence supports the better answer. A percentage alone does not tell you what to fix. Weeks 1-5: follow the current outline Use the current official Review Manual as the primary reference and map notes to the outline rather than reading passively. Weight the schedule toward Domain 3, then Domain 1, while still covering every listed area. End each session by retrieving the ideas from memory and applying them to original practice questions. Weeks 6-7: integrate and time the work Move from isolated topics to mixed sets. Review correct answers as well as misses when the reasoning was uncertain. Complete at least one 150-question session inside four hours so that pacing, concentration, and breaks are tested before exam day. Week 8: remediate, then taper Rank gaps by repeated errors and domain weight. Revisit the official source, explain the concept without notes, and test it again in a different context. In the final days, confirm ID, appointment time, delivery rules, and workstation or travel plans. Avoid adding an entirely new resource at the last minute. How to use the official preparation resources Use these in this order: CRISC Exam Content Outline: Your scope checklist and the source of the current 26/22/32/20 weights. 2026 Exam Candidate Guide: The authority for registration, identification, delivery, scoring, results, and retakes. Current CRISC Review Manual: ISACA's structured reference; the current store listing is the 8th Edition. CRISC QAE: ISACA's CRISC page advertises a six-month subscription with an 833-question pool. Check the current listing before purchase. Original mixed practice: Use fresh questions to diagnose transfer, not to memorize a vendor's answer sequence. The official pool size is a product fact, not a required question target. Quality of review matters more than chasing a round total. Do not assume a particular practice score guarantees a pass. A practical method for answering questions The Candidate Guide says each multiple-choice item has four options and one best answer. A disciplined process helps: Identify the role and the decision the question asks for. Notice qualifiers such as first, best, or most important. Compare every option with the stated business objective and risk context. Eliminate choices that do not answer the precise question. Select an answer, then move on when more reading is no longer improving the decision. Do not preserve an initial answer merely because it was your first instinct. Change it when your review finds a specific reason. Conversely, do not change answers just because time remains. For pacing, 240 minutes divided by 150 questions is 96 seconds per question. Track your progress at regular checkpoints and reserve time according to the review functions actually available in your exam interface. Answer every item because incorrect answers have no penalty. Exam-day checklist Confirm that your government-issued ID meets the Candidate Guide and matches your registration name. Recheck the appointment time, time zone, delivery method, and check-in instructions. For remote delivery, run the required system check and prepare the room exactly as PSI instructs. For a test center, confirm the location and travel time before exam day. Use only breaks and materials allowed by the current rules. Answer every question, including uncertain ones. Note the preliminary result and wait for the official score, which ISACA says arrives within 10 working days. After you pass Passing does not automatically grant the CRISC designation. Once you meet the experience requirement, submit the certification application within five years of the pass date and pay the US$50 application fee. After certification, maintain the credential by: earning at least 20 CPE hours each year; earning 120 CPE hours during each three-year reporting cycle; paying the annual US$45 member or US$85 nonmember maintenance fee; following ISACA's professional ethics and CPE policies; and keeping supporting CPE records in case ISACA selects you for an audit. ISACA publishes no audit-selection percentage. Its maintenance page says to retain CPE documentation for at least 12 months after the end of the three-year reporting cycle. Is CRISC the right credential? CRISC is the most direct of these three ISACA credentials when your work centers on IT risk and information systems controls. CISA is oriented toward audit and assurance, while CISM is oriented toward information security management. Review each current exam outline before choosing; job titles alone do not establish fit. Do not use an unsourced salary table or a promised payback period to make the decision. Compensation varies by role, experience, location, industry, and employer. A better test is whether the CRISC outline matches work you perform or want to perform and whether employers you target request the credential. Your next action Download the current outline, mark every task and knowledge statement as strong, developing, or new, and take a mixed diagnostic. Then convert the result into a calendar using the eight-week sequence above. Start with free CRISC practice if you need a baseline set. Official sources ISACA CRISC credential page CRISC Exam Content Outline ISACA announcement of the November 2025 exam update 2026 ISACA Exam Candidate Guide CRISC certification requirements and application CRISC maintenance requirements ISACA professional membership pricing Information checked July 30, 2026. Verify live fees, product details, appointment rules, and policies with ISACA before purchasing or scheduling.

Test Your Knowledge Question 1 of 8

What score is required to pass the CRISC exam?

400 on a 200-800 scale

450 on a 200-800 scale

70 percent correct

500 on a 0-1,000 scale Check Answer Need a hint? AI

Where shall we go next? Your AI study companion · 10 free interactions a day

Quiz Me on This Test your understanding with AI-generated questions

Create Study Plan Get a personalized study plan for this topic

Explain Simply Get a simplified explanation of complex concepts

Practice Scenarios Practice with real-world scenarios CRISC ISACA IT Risk Management Risk Assessment Risk Response Information Systems Control GRC Study Plan

Free Study Resources

CRISC Certified in Risk and Information Systems Control Study Guide 55 topics Practice Questions 200 questions Shorts 2 short s Videos 1 video Blogs 1 blog Free CE Podcast

Third-party resources · We may earn a commission from purchases.

ISACA Certified in Risk and Information Systems Control (CRISC®) Exam Guide: A primer on GRC and an exam guide for the most recent and rigorous IT risk certification By Shobhit Mehta $47.47 · Buy on Amazon Take courses on Udemy Learning path on Pluralsight

CISM Study Guide 72 topics Practice Questions 198 questions Cheat Sheet 72 facts Flashcards 50 cards Videos 2 videos Blogs 2 blogs Free CE Podcast

Third-party resources · We may earn a commission from purchases.

CISM Certified Information Security Manager All-in-One Exam Guide, Second Edition By Gregory, Peter H. $27.00 · Buy on Amazon Take courses on Udemy Learning path on Pluralsight

CISA Study Guide 34 topics Practice Questions 200 questions Cheat Sheet 90 facts Flashcards 50 cards Shorts 3 short s Videos 2 videos Blogs 2 blogs Free CE Podcast

Third-party resources · We may earn a commission from purchases.

CISA Certified Information Systems Auditor Study Guide: Covers 2024 - 2029 Exam Objectives (Sybex Study Guide) By Gregory, Peter H., Chapple, Mike $16.99 · Buy on Amazon Take courses on Udemy Learning path on Pluralsight Flashcards on Mometrix

Technology CCAO-F Official Sample Questions Explained 2026: Why Dumps Fail

Technology Free CCAO-F Practice Questions 2026: 12 Worked Examples by Domain

Technology Which Claude Certification Should You Take in 2026? CCAO-F vs CCDV-F vs CCAR-F vs CCAR-P

Stay Updated Get free exam tips and study guides delivered to your inbox. Subscribe Free exam tips & study guides. Unsubscribe anytime. Back to Blog All Exams

Independent exam preparation notice OpenExamPrep is an independent education provider, not affiliated with or endorsed by the exam sponsors named on this site. Exam and certification names identify what our resources help you study for; they do not imply sponsorship, approval, or review of our materials. Unless a resource expressly identifies authorized public material, our practice questions are independently developed simulations, not actual, recalled, or sponsor-provided exam items. We aim to reflect publicly available exam outlines and topic information in our study resources. Coverage, format, and difficulty may differ from the actual exam, and we cannot guarantee that every detail is accurate or current. Confirm exam requirements, fees, and policies with the official exam sponsor.