Certified in Risk and Information Systems Control® (CRISC®): the practice module
Exam body: ISACA. Verified for CRISC Examination Content Outline (Effective 2025), ISACA Certification Exam Candidate Guide Version 1.26 on October 28, 2026.
What it covers
Covers: standard multiple-choice questions written to this exam’s outline, format and timing.
Does not cover: nothing else; the real exam is multiple-choice throughout.
Question format
- Every question has exactly 4 options.
- One correct answer per question.
- Not allowed as an option: “all of the above”, “none of the above”.
- Stems follow the exam’s conventions, such as “Which of the following is MOST important to determine when defining risk management strategies?”, “Which of the following BEST ensures that appropriate mitigation occurs on identified information systems vulnerabilities?”, “The GREATEST risk posed by an absence of strategic planning is:”.
Exam mode
The real exam is 150 questions in 240 minutes. Exam mode keeps that pace for any number of questions.
Topics
The official topic list, as the exam body names it. Your questions must use these names; the coverage dashboard compares your set to each topic’s official weight.
| Topic | Weight | Subtopics |
|---|---|---|
| Governance | 26% | Strategy, Goals, and Objectives · Organizational Structure, Roles, and Responsibilities · Organizational Culture and Ethics · Policies and Standards · Business Processes and Resilience (e.g., DRP, BCP) · Organizational Asset Management · Enterprise Risk Management (ERM) · Lines of Defense · Risk Profile · Risk Appetite and Risk Tolerance · Risk Frameworks, Legal, Regulatory, and Contractual Requirements |
| Risk Assessment | 22% | Risk Events · Threat Modeling and Threat Landscape · Vulnerability Management · Risk Scenario Development and Evaluation · Risk Assessment Concepts and Standards · Business Impact Analysis (BIA) · Risk Register · Risk Analysis Methodologies · Inherent and Residual Risk |
| Risk Response and Reporting | 32% | Risk Response Options · Risk and Control Ownership · Vendor/Supply Chain Risk Management · Issues, Findings, Exceptions and Exemptions Management · Control Frameworks, Types, and Standards · Control Design, Selection, Implementation, and Analysis · Control Testing Methodologies · Risk Action Plans · Data Collection, Aggregation, Analysis, and Validation · Risk and Control Metrics (e.g., KRIs, KCIs, KPIs) · Risk and Control Monitoring Techniques · Risk and Control Reporting Techniques (e.g., heatmap, scorecards, dashboards) · Monitoring and Reporting of Emerging Risks |
| Technology and Security | 20% | Technology Roadmaps and Enterprise Architecture (EA) · Operations Management (e.g., change management, assets, DevOps, problems, incidents) · System Development Life Cycle (SDLC) · Data Lifecycle Management · Portfolio and Project Management (e.g. Agile) · Technology Resilience and Disaster Response/Recovery · Emerging Technologies · Security Concepts, Frameworks, and Standards · Security/Risk Awareness and Training · Data Privacy and Data Protection Principles |
Trademarks
DoMcq is an independent practice tool. It is not affiliated with, endorsed by, sponsored by or approved by any exam body. Exam names are used only to say which exam a module is for. DoMcq holds no exam content: a module is the exam body's published topic names, the question format, the exam's timing, its published weights and a prompt, and every question in DoMcq is a student's own. The marks below belong to their owners. Trademarks
DoMcq is an independent practice tool and is not affiliated with, sponsored by or endorsed by ISACA; the names are used only to identify the exam. ISACA® and the names of ISACA certifications, including Certified Information Systems Auditor® (CISA®) and Certified Information Security Manager® (CISM®), are trademarks of ISACA.
Use it
Practice the questions you already have: a PDF or Word file of multiple-choice questions, from a class or a study group, becomes a timed practice test here, with your own AI doing the copying. Every step, with pictures: How to turn a PDF or Word file of multiple-choice questions into a timed practice test.
Convert questions I already haveGenerate new questions
Free to start. DoMcq never writes or fixes questions; it checks the file your AI produces and gives you the practice system.