ISACA · Current CRISC outline verified on 2026-10-11: the 2026 ISACA Certification Exams Candidate Guide labels Appendix B 'Effective 2025'; ISACA's issuer announcement establishes 3 November 2025 as the updated exam's launch date. The workbook label 'CRISC - Healthcare' maps to the general CRISC examination using healthcare learning scenarios. No separate healthcare CRISC examination or healthcare-specific blueprint was established. The assigned slug is preserved. Subtopic numbering follows the issuer's web outline. The candidate guide numbers Domain 4A differently: SDLC is web 4A4 / guide 4A3, and technology resilience and disaster response/recovery is web 4A7 / guide 4A6. Both codes are supplied on affected items.

This original 20-question sample covers selected topics across the outline. It does not reproduce official exam questions or cover every tested topic.

• CRISC Certification | Certified in Risk and Information Systems Control
• CRISC Exam Content Outline
• ISACA Certification Exams Candidate Guide, 2026, Appendix B: CRISC
• ISACA Updates CDPSE and CRISC Exams to Reflect Latest Risk and Privacy Priorities
• The NIST Cybersecurity Framework (CSF) 2.0
• NIST SP 800-30 Revision 1: Guide for Conducting Risk Assessments
• NIST SP 800-34 Revision 1: Contingency Planning Guide for Federal Information Systems
• NIST SP 800-53A Revision 5: Assessing Security and Privacy Controls in Information Systems and Organizations
• NIST SP 1305: CSF 2.0 Quick-Start Guide for Cybersecurity Supply Chain Risk Management
• NIST SP 800-218: Secure Software Development Framework, Version 1.1
• NIST Privacy Framework, Version 1.0
• The IIA's Three Lines Model, July 2020, updated September 2024
• NIST SP 800-39: Managing Information Security Risk
• NIST SP 800-137: Information Security Continuous Monitoring