CRISC — Certified in Risk and Information Systems Control
ISACA Advanced
Enterprise IT risk management on the current outline (from 3 November 2025): governance, risk assessment, risk response and reporting, and technology and security. The most risk-focused of the ISACA credentials. There is no current-outline CRISC course here and no CRISC practice tests yet: each step teaches its domain from our GRC and continuity courses.
4 courses · 30 sections · 141 lectures · 28 labs · ≈ 38 h of hands-on labs
Free to start: the free lessons and guides for this roadmap →
Exam domains
- Governance — 26%
- Risk Assessment — 22%
- Risk Response and Reporting — 32%
- Technology and Security — 20%
Try a free hacking lab: Recon to shell (~5 min) → A scripted simulation in your browser. No account needed.
The path
Start here →
Step 1 — Governance
Domain 1 (26%): organisational governance, the risk universe, the three lines of defence and who owns which risk.
1 course · 15 sections · 72 lectures
Learn
- CourseMastering Governance, Risk, and Compliance (GRC): A Handbook (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
15 sections · 72 lectures
- Course Overview 2
- Introduction 6
- Module 1 - What is Governance Risk and Compliance - Quite Literally 9
- Module 2 - The Three Lines of Defense 7
- Module 3-Step 1 Information Gathering-Understand the organisation risk universe 11
- Module 4 - Step 2: Drafting inherent risks 14
- Module 5 - Step 3: Mapping the Lines of Defense - Roles and Responsibilities 4
- Module 6 - Step 4: Existing Controls Environment 5
- Module 7 - Step 5: Residual Risk 2
- Module 8 - Follow Through 2
- Module 9 - Bringing it all together 1
- Module 10 - GRC Tools 2
- Module 11 - IT Auditing: The Third Line of Defense 3
- Module 12 - Course Conclusion 3
- Audio Version of Training 1
Step 2 — Risk assessment
Domain 2 (22%): identify and assess IT risk — inherent risk, the existing controls, residual risk.
1 course · 1 section · 11 lectures
Learn
- CourseInformation Security Risk Management (ISO 27005) (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
1 section · 11 lectures
- Information Security Risk Management (ISO 27005) 11
Step 3 — Risk response and reporting
Domain 3 (32%): choose the response, design and test the controls, and report on risk. The labs are the audit and control ones, among them Comparing Controls, and Monitoring and Verifying Management Systems.
1 course · 11 sections · 50 lectures · 7 labs
Learn
- CourseGovernance, Risk and Compliance (GRC) (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
11 sections · 50 lectures
- Training Overview 2
- Introduction 3
- Governance 6
- Risk Management 6
- Compliance 4
- Internal Controls 13
- Audit 4
- Cybersecurity 4
- Emerging Trends in GRC 4
- Conclusion 3
- Audio Version of Training 1
Practise
- LabsCritical Security Controls — 7 labs 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
- Auditing Service Accounts and Setting Up Automated Log CollectionDuration: 2 h
- CIRP Creation and DisasterDuration: 2 h
- Comparing ControlsDuration: 1 h
- Creation of Standard Operating Procedures for RecoveryDuration: 1 h
- Identifying Key AssetsDuration: 1 h
- Monitoring and Verifying Management SystemsDuration: 1 h
- Sensitive Information IdentificationDuration: 1 h
Step 4 — Technology and security
Domain 4 (20%): business continuity and disaster recovery, and the security controls your risk responses rely on.
1 course · 3 sections · 8 lectures · 22 labs
Learn
- CourseBusiness Continuity and Disaster Recovery Planning (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
3 sections · 8 lectures
- Descrition 1
- BCP / DRP 6
- Audio Version of Training 1
Practise
- LabsCyber Security Fundamentals — 22 labs 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
- Additional Scanning OptionsDuration: 1 h
- Basics of MetasploitDuration: 2 h
- BCP DRP and Test PlanningDuration: 2 h
- BitLocker SetupDuration: 1 h
- Block Incoming Traffic on Known PortDuration: 1 h
- Comparing ControlsDuration: 1 h
- Creating a List of Installed Programs, Services and User Accounts from a WIN2K12 ServerDuration: 1 h
- Creation of BCP and DRPDuration: 3 h
- Data Backup to Prep for RecoveryDuration: 1 h
- Event LogDuration: 1 h
- Host Data Integrity BaseliningDuration: 1 h
- Installing Patches and Testing SoftwareDuration: 2 h
- MITRE - AttackDuration: 1 h
- MITRE - DefendDuration: 1 h
- Network DiscoveryDuration: 2 h
- Network Segmentation (FW/DMZ/WAN/LAN)Duration: 1 h
- Network Topology GenerationDuration: 2 h
- Open Source CollectionDuration: 2 h
- Open Source Password CrackingDuration: 1 h
- Scanning From WindowsDuration: 1 h
- Windows Event Log Manipulation via Windows Event ViewerDuration: 1 h
- WiresharkDuration: 1 h
