(CRISC) Certified In Risk and Information System Control

Chapter 1: Governance

• Organizational Strategy, Goals and Objectives
• Organization structure, Roles and Responsibilities
• Organizational Structure
• Policies and Standards
• Business Process Review
• Organization assets
• Enterprise Risk Management and Risk Management Frameworks
• Three Lines of Defence
• Risk Profile
• Risk Appetite, Tolerance and Capacity
• Legal, Regulatory and Contractual Requirements

Chapter 2: IT Risk Assessment

• Risk Events
• Threat Modelling and Threat landscape
• Vulnerability and Control Deficiency Analysis
• Risk Scenario Development
• Risk Assessment Concepts, Standards and Frameworks
• Risk Register
• Risk Analysis Methodologies
• Business Impact Analysis
• Inherent, Residual and Current risk

Chapter 3: Risk Response and Reporting

• Risk and Control Ownership
• Risk Treatment/Risk Response Options
• Third-party Risk Management
• Issues, Finding and Exception Management
• Management of Emerging risk
• Control Types, Standards and Frameworks
• Control Design, Selection and Analysis
• Control Implementation
• Control Testing and Effectiveness Evaluation
• Risk Treatment Plans
• Data Collection, Aggregation, Analysis and Validation
• Risk and Control Monitoring Techniques
• Risk and Control Reporting Techniques
• Key Performances Indicators
• Key Risk Indicators
• Key Control Indicators

Chapter 4: Information Technology and Security

• Enterprise Architecture
• T Operations Management
• Project Management
• Enterprise Resiliency
• Data Life Cycle Management
• System Development Life Cycle
• Emerging Trends in Technology
• Information Security Concepts, Frameworks and Standards
• Information Security Awareness Training
• Data Privacy and Principles of Data Protection

PREPARATION TO THE EXAM

• Multiple Choice Questions (MCQ) like the exam and correction performed together
• Discussion and exchanges, hints and tips to pass the exam.
• Blank Exam.