Certified in Risk and Information Systems Control (CRISC®) Online Review Course - Self-paced

Course subjects

Domain 1: Governance

The governance domain interrogates your knowledge of information about an organisation’s business and IT environments, organisational strategy, goals and objectives, and examines potential or realised impacts of IT risk to the organisation’s business objectives and operations, including Enterprise Risk Management and Risk Management Framework.

Topics:

• Strategy, Goals and Objectives

• Organisational Structure, Roles, and Responsibilities

• Organisational Culture and Ethics

• Policies and Standards

• Business Processes and Resilience

• Organisational Assets

• Enterprise Risk Management

• Lines of Defense

• Risk Profile

• Risk Appetite and Risk Tolerance

• Risk Frameworks, Legal, Regulatory, and Contractual Requirements

Domain 2: IT Risk Assessment

This domain will certify your knowledge of threats and vulnerabilities to the organisation’s people, processes and technology as well as the likelihood and impact of threats, vulnerabilities and risk scenarios.

Topics:

• Risk Events

• Threat Modelling and Threat Landscape

• Vulnerability Management

• Risk Scenario Development

• Risk Assessment Concepts and Standards

• Business Impact Analysis

• Risk Register

• Risk Analysis Methodologies

• Inherent and Residual Risk

Domain 3: Risk Response and Reporting

This domain deals with the development and management of risk treatment plans among key stakeholders, the evaluation of existing controls and improving effectiveness for IT risk mitigation, and the assessment of relevant risk and control information to applicable stakeholders.

Topics:

• Risk Response Options

• Risk and Control Ownership

• Vendor/Supply Chain Risk Management

• Issue, Finding, and Exception Management

• Control Frameworks, Types, and Standards

• Control Design, Selection, Implementation and Analysis

• Control Testing Methodologies

• Risk Action Plans

• Data Collection, Aggregation, Analysis, and Validation

• Risk and Control Metrics

• Risk and Control Monitoring Techniques

• Risk and Control Reporting Techniques

• Monitoring and Reporting of Emerging Risks

Domain 4: Information Technology and Security

In this domain we interrogate the alignment of business practices with Risk Management and Information Security frameworks and standards, as well as the development of a risk-aware culture and implementation of security awareness training.

Topics:

• Technology Roadmaps and Enterprise Architecture

• Operations Management

• System Development Life Cycle

• Data Lifecycle Management

• Portfolio and Project Management

• Technology Resilience and Disaster Response/Recovery

• Emerging Technologies

• Security Concepts, Frameworks, and Standards

• Security/Risk Awareness and Training

• Data Privacy and Data Protection Principles