Leanpub Header

Skip to main content
Go to Leanpub.com

CRISC: The Last Mile

Your guide to the finish line

CRISC: The Last Mile
This book is 100% completeLast updated on 2026-10-21
Pete Zerger

This book covers every topic in the latest CRISC exam syllabus, approaching topics from the ISACA perspective. It's 350+ pages, organized in a format following the syllabus that makes it easy to drill down on specific exam domains and concepts at-a-glance, making it an essential exam resource for anyone who aims to prepare for the CRISC exam without wasting time or money.

Minimum price

$9.99

$14.99

You pay

Author earns

$

Also available for 1 book credit with a Reader Membership

PDF
EPUB
WEB
APP
About

About

About the Book

This book covers every topic in the latest CRISC exam syllabus, approaching topics from the ISACA perspective. It's 350+ pages, organized in a format following the syllabus that makes it easy to drill down on specific exam domains and concepts at-a-glance, making it an essential exam resource for anyone who aims to prepare for the CRISC exam without wasting time or money.

Share this book

Categories

Computer Security

Feedback

Contact the author

Author

About the Author

Pete Zerger
The Leanpub Podcast

Podcast

Podcast Episode

Contents

Table of Contents

Preface (Read this first!)

  1. Legend
  2. Exam Prep Strategy
  3. Exam Mindset
  4. Time management
  5. Evaluating Exam Answers (The READ Strategy)
  6. Recommended Study Materials
  7. Books
  8. Practice Questions
  9. Video Training
  10. Flashcards

Domain 1A: Organizational Governance

  1. 1A1. Strategy, Goals, and Objectives
  2. Strategy Archetypes
  3. Enterprise Objectives
  4. Context of IT Risk Management
  5. Key Concepts of Risk
  6. Importance and Value of IT Risk Management
  7. IT Risk Strategy of the Business
  8. Alignment With Business Goals and Objectives
  9. 1A2. Organizational Structure, Roles, and Responsibilities
  10. RACI (Responsible, Accountable, Consulted, Informed)
  11. Key Roles
  12. Organizational Structure and Culture
  13. 1A3. Organizational Culture and Ethics
  14. Organizational Culture and Behavior and the Impact on Risk Management
  15. Risk Culture
  16. A Risk-Driven Business Approach
  17. The Value of Risk Communication
  18. Professional Ethics of Risk Management
  19. 1A4. Policies and Standards
  20. Policies
  21. Standards
  22. Procedures
  23. Exception Management
  24. Risk Management Standards
  25. 1A5. Business Process Review and Resilience
  26. Risk Management Principles, Processes, and Controls
  27. IT Risk in Relation to Other Business Functions
  28. Business Resilience and Continuity
  29. 1A6. Organizational Asset Management
  30. Organizational Assets
  31. Asset Valuation
  32. Key Exam Reminders for Domain 1A

Domain 1B: Risk Governance

  1. 1B1. Enterprise Risk Management
  2. IT Risk Management Good Practices
  3. Establishing an Enterprise Approach to Risk Management
  4. 1B2. Lines of Defense
  5. Operational/Business Line (First Line of Defense)
  6. Oversight Line (Second Line of Defense)
  7. Assurance Line (Third Line of Defense)
  8. The Role of the Risk Practitioner Within the Lines of Defense
  9. 1B3. Risk Profile
  10. New Technologies
  11. Changes to Business Procedures
  12. Mergers and Acquisitions
  13. New or Revised Regulations
  14. Changes in Customer Expectations
  15. Actions of Competitors
  16. Effectiveness of Risk Awareness Programs
  17. Reliance on Third Parties
  18. Talent Management and Succession Planning
  19. Building Resilience
  20. Monitoring the Risk Profile
  21. 1B4. Risk Appetite, Tolerance, and Capacity
  22. 1B5. Risk Frameworks, Legal, Regulatory, and Contractual Requirements
  23. COBIT and Information Risk
  24. Key Exam Reminders for Domain 1B

Domain 2A: Risk Identification

  1. 2A1. Risk Events
  2. Risk Factors
  3. Methods of Risk Identification
  4. Changes in the Risk Environment
  5. 2A2. Threat Modeling and Threat Landscape
  6. Internal Threats
  7. External Threats
  8. Emerging Threats
  9. Additional Sources for Threat Information
  10. Threat, Misuse, and Abuse-Case Modeling
  11. 2A3. Vulnerability Management
  12. Sources of Vulnerabilities
  13. Gap Analysis
  14. Vulnerability Assessment and Penetration Testing
  15. Root Cause Analysis
  16. 2A4. Risk Scenario Development and Evaluation
  17. Risk Scenario Development Tools and Techniques
  18. Benefits of Using Risk Scenarios
  19. Developing IT Risk Scenarios
  20. Analyzing Risk Scenarios
  21. Key Exam Reminders for Domain 2A

Domain 2B: Risk Analysis

  1. 2B1. Risk Assessment Concepts and Standards
  2. Risk Ranking
  3. Risk Ownership and Accountability
  4. Documenting Risk Assessments
  5. Addressing Risk Exclusions
  6. 2B2. Business Impact Analysis
  7. Business Continuity and Organizational Resiliency
  8. Regulatory and Contractual Obligations
  9. Strategic Investments
  10. Beyond Business Impact
  11. Business Impact Analysis and Risk Assessment
  12. 2B3. Risk Register
  13. 2B4. Risk Analysis Methodologies
  14. Quantitative Risk Assessment
  15. Qualitative Risk Assessment
  16. Semiquantitative/Hybrid Risk Assessment
  17. 2B5. Inherent, Residual, and Current Risk
  18. Inherent Risk
  19. Residual Risk
  20. Current Risk
  21. Key Exam Reminders for Domain 2B

Domain 3A: Risk Response

  1. 3A1. Risk Response Options
  2. Aligning Risk Response With Business Objectives
  3. Risk Response Options
  4. Choosing a Risk Response
  5. 3A2. Risk and Control Ownership
  6. Ownership and Accountability
  7. 3A3. Vendor/Supply Chain Risk Management
  8. Understanding Supply Chain Parties
  9. 3A4. Issues, Findings, and Exception Management
  10. Configuration Management
  11. Release Management
  12. Exception Management
  13. Change Management
  14. Issue and Finding Management
  15. Key Exam Reminders for Domain 3A

Domain 3B: Control Design and Implementation

  1. 3B1. Control Frameworks, Types, and Standards
  2. Control Standards and Frameworks
  3. Administrative, Technical, and Physical Controls
  4. Capability Maturity Models
  5. 3B2. Control Design, Selection, Implementation, and Analysis
  6. Control Design and Selection
  7. Control Implementation
  8. Postimplementation Review
  9. Control Documentation
  10. 3B3. Control Testing Methodologies
  11. Good Practices for Control Testing
  12. Updating the Risk Register
  13. Key Exam Reminders for Domain 3B

Domain 3C: Risk Monitoring and Reporting

  1. 3C1. Risk Action Plans
  2. Risk Action Planning Flow
  3. Response Selection Parameters
  4. Project Management Approach
  5. Consultative Role
  6. Decision Factors
  7. Cost-Benefit Focus
  8. Risk Register Update
  9. 3C2. Data Collection, Aggregation, Analysis, and Validation
  10. Data Sources
  11. Data Aggregation
  12. Data Validation
  13. Data Analysis Methods
  14. Data Collection and Extraction Tools and Techniques
  15. 3C3. Risk and Control Metrics
  16. Key Performance Indicators (KPIs)
  17. Key Risk Indicators (KRIs)
  18. Using KPIs With KRIs
  19. Key Control Indicators (KCIs)
  20. Comparing KPIs, KRIs, and KCIs
  21. Metric Design Principles
  22. 3C4. Risk and Control Monitoring Techniques
  23. Monitoring Controls
  24. Assurance Independence
  25. Ownership and Assignment
  26. Stakeholder Engagement
  27. Business Alignment
  28. Process Setup
  29. Lifecycle and Change Management
  30. Resource Allocation
  31. Control Assessment Types
  32. 3C5. Risk and Control Reporting Techniques
  33. Reporting Principles
  34. Heat Maps
  35. Scorecards
  36. Dashboards
  37. 3C6. Monitoring and Reporting of Emerging Risk
  38. Vulnerabilities Associated with Controls
  39. Impact of Emerging Technologies on Controls
  40. Artificial Intelligence and Emerging Risk
  41. Key Exam Reminders for Domain 3C

Domain 4A: Information Technology and Security

  1. 4A1. Technology Roadmaps and Enterprise Architecture
  2. Maturity Models
  3. 4A2. Operations Management
  4. Hardware
  5. Software and Operating Systems
  6. Environmental Controls
  7. Networks and Protocols
  8. Technology Refresh and Legacy Risk
  9. IT Operations and Management Evaluation
  10. Virtualization and Cloud
  11. 4A3. System Development Life Cycle (SDLC)
  12. 4A4. Data Life Cycle Management
  13. Data Management
  14. Data Loss Prevention
  15. 4A5. Portfolio and Project Management
  16. Project Risk
  17. Project Closeout
  18. 4A6. Technology Resilience and Disaster Response/Recovery
  19. Resilience Strategies
  20. Recovery Metrics
  21. Recovery Site Types
  22. 4A7. Emerging Technologies
  23. Omnipresent Connectivity
  24. Internet of Things Devices
  25. Massive Computing Power
  26. Blockchain
  27. Artificial Intelligence
  28. Key Exam Reminders for Domain 4A

Domain 4B: Information Security and Data Privacy Principles

  1. Legacy Systems and Compensating Controls
  2. System Ownership and Enterprise Security
  3. 4B1. Security Concepts, Frameworks, and Standards
  4. CIA Triad
  5. System Authorization
  6. Separation of Duties
  7. Cross-Training and Job Rotation
  8. Access Control
  9. Encryption
  10. 4B2. Security/Risk Awareness and Training
  11. 4B3. Data Privacy and Data Protection Principles
  12. Key Concepts of Data Privacy
  13. Risk Management in a Privacy Context
  14. Key Exam Reminders for Domain 4B

The Leanpub 60 Day 100% Happiness Guarantee

Within 60 days of purchase you can get a 100% refund on any Leanpub purchase, in two clicks.

See full terms...

Earn $8 on a $10 Purchase, and $16 on a $20 Purchase

We pay 80% royalties on purchases of $7.99 or more, and 80% royalties minus a 50 cent flat fee on purchases between $0.99 and $7.98. You earn $8 on a $10 sale, and $16 on a $20 sale. So, if we sell 5000 non-refunded copies of your book for $20, you'll earn $80,000.

(Yes, some authors have already earned much more than that on Leanpub.)

Learn more about writing on Leanpub

Free Updates. DRM Free.

If you buy a Leanpub book, you get free updates for as long as the author updates the book! Many authors use Leanpub to publish their books in-progress, while they are writing them. All readers get free updates, regardless of when they bought the book or how much they paid (including free).

Most Leanpub books are available in PDF (for computers) and EPUB (for phones, tablets and Kindle). The formats that a book includes are shown at the top right corner of this page.

Finally, Leanpub books don't have any DRM copy-protection nonsense, so you can easily read them on any supported device.

Learn more about Leanpub's ebook formats and where to read them

Write and Publish on Leanpub

You can use Leanpub to easily write, publish and sell in-progress and completed ebooks and online courses!

Leanpub is a powerful platform for serious authors, combining a simple, elegant writing and publishing workflow with a store focused on selling in-progress ebooks.

Leanpub is a magical typewriter for authors: just write in plain text, and to publish your ebook, just click a button. (Or, if you are producing your ebook your own way, you can even upload your own PDF and/or EPUB files and then publish with one click!) It really is that easy.

Learn more about writing on Leanpub