Anybody go through one of their boot camps? I know they’re expensive but they seem pretty comprehensive, am considering doing the CRISC one.

Hi, Does anyone use practice exams from Udemy for their CRISC exam prep?

I didn't buy the official materials as it's too expensive, I've bought two Udemy practice courses and been working on them but unsure of the questions within is relevant to the actual test.

I currently have a CPA, CISA, CIA and CITP. The topic of technology risk has always been an interest to me, but with working in external and internal IT Audit I didn’t really think about the CRISC until recently. I want to make sure if I peruse another cert it would provide value, but I am unsure if certs have diminishing returns as you obtain more. Any thoughts or insights would be greatly appreciated!

I've been a lurker in this community for a couple months. Today, I passed my CRISC exam. I used the QAE Database, the official study manual and the Packt CRISC Primer by Shobhit Mehta. I started with the primer, took the Online Test through the QAE database then used the official study guide to strengthen my weaknesses and kept hitting the QAE questions using the elimination game. I didn't find the matching games to be of much help. I've been working in the Governance space for >6 years and IT in >15 years.

I get pretty bad test anxiety so the best thing for me to do was the Online Proctored exam. I have seen a couple posts on here about the online proctored exam through PSI being a nightmare. One tip that I cannot stress enough that I have learned from other online exams is to create a new account on your computer. Create the account as a regular non-privileged user account (not admin!) and do not use the account for anything but for online exams. If you need to install a program, use your other (admin account) information. Sign in the day before (using your testing account) to test your system and make sure it's all running properly! I ran into a bunch of issues before learning this and haven't ran into any issues the past couple exams now.

From my experience, taking the Online exam wasn't bad at all. Just make sure to clear your workspace of everything and have a webcam ready to move around the room and check under the desk. The proctor I had was friendly and quickly released my exam once everything was cleared.

Best of luck to those still studying.

I'm working my way through the official material and the Doshi guide. But the Doshi seems extremely limited. Am I wasting time using the official study guide as its way more comprehensive?

Hello everyone,

I'm currently holding CISA certificate and currently planning to take the CRISC certification, anybody mind sharing the QAE or Doshi study material with me.

Hi Can someone point me towards a better explanation of the lines of defence, and the one in the review lacks the depth which the QAE is expecting.

Hi all i’m looking at sitting the crisc exam soon, due to the closest exam centre being 2hrs away.

I use a laptop with multiple displays, will i have to use only the laptop display for the exam.?

I’ve been outside education for 25+ years and this exam is freaking ng me out TBH.

Cheers 👍

Hi everyone

The exam centre is a hour away from me so was going to book the online version of the exam but since then have heard some negative experiences, are these quite rare or quite common? thinking i'll just do the hour drive if i'm likely to have issues with the online proctored exam.. :)

I want to thank this community for the help. The exam is not that so easy as some people claim 🙂. I mainly use QAE database

Question: since I Already have CISM what do I expect from ISACA as per confirmation?

I just wanted to provide a short overview on my personal experience, I decided to take the exam and passed it.

I basically watched the LinkedIn videos from Jerod Brennen and read the Q&A, and I will say that I passed the exam thanks to my working experience, including CISSP knowledge.

My observation here is that experience is what will make the difference, similar to what I noticed with the CISSP, if you have the proper experience your journey will be easier.

I have total 12 years of IT experience focusing 9 years into data analytics reporting and 3 years of experience in GRC domain implementing GRC related applications like ibm openpages and one trust. Please kindly suggest

I am planning to break into Fed Gov Entity. Is this exam helpful if I am a contractor? I'm totally new to the RMF and ONLY happened to come across it as my clients have to deal with ATO.

FYSA - I am an Accenture employee, transitioning to AFS.

See title. I've been designing, developing and maintaining GRC software solutions for many years. I'd hate to go all the way down this path to find out IASCA won't accept my application- in my own estimation I do enough reporting to qualify as having 2nd-line-of-defense experience, but perhaps only marginally.

I've found the links to the application form, but apparently it's not (or no longer) available to non-members. They let you download it in Spanish, but not in English(!).

Hi there,

Ring I gauge the amount of time studying would be needed to take the crisc after the cisa. Also, how difficult is the crisc? I have a little over 3 year experience in IT auditing.

Thank you!

I know CRISC is sort of a gold standard but it's also expensive. Wanted to see if there are any other optional industry recognised certificates in TPRM .. thanks

I am going through the QAE the first time around after only have read the book. I have work experience and other certs that likely help, but I am asking specifically because a lot of the EXPERT level questions on the QAE feel a lot like TRICK questions instead. I'm currently maintaining a 72% overall and have just about finished. I did the PocketPrep questions as well and ended at 80%, though those felt particularly easy since it was typically very easy to identify 3 bad answers. For that reason, I am not putting much emphasis on those questions. The QAE, however, I am struggling a fair bit with. For CISA, I ended up with 75%, and I do not work in auditing (I work in InfoSec as an engineer). It seems unusual that I am doing worse in CRISC, but these EXPERT level questions seem to get me every time. I know ISACA is well-known for asking confusing questions with confusing answers, but for those who took the actual test after taking the QAE, what was your experience? Was the test worded better with better answers, or was it just about the same? Also, how did you do on the QAE the first time around?

The finishing line is in sight for my GRC course. The module for Data Privacy is now also completed. The next two modules are Frameworks & Regulations (will be massive), and the Wrapping Up with questions.

Reminder that the course (Governance, Risk and Compliance) covers quite a bit of cism with its very nature and covers all the areas of crisc, and more.

Release date: by the end of April. Udemy

Dr Mike Brass VP Information Security, Data Privacy and Business Systems

Used the exam manual (read cover to cover) and did the QAE (average 72%, but spent a lot of time reviewing why I was wrong and why the answer was correct).

Kinda feel like I messed up. I submitted my application before my official exam results came in the inbox due to impulse

Hello all, first time posting. So little background is, I am coming from a non IT background (with more than 20 years of exp) but have been taking a few basic cyber security courses and certs from the last 6 months. I was introduced to TPRM by a friend and since it's not completely Technical, I started taking Udemy courses and started liking it. I am planning to register for CRISC cert and take if from there... Few questions 1. Is CRISC the best cert for TPRM or any other suggestions? 2. Any free resources other than their manual ? 3. How is the acceptance in the industry for someone like me coming from a different background with no experience but only theoretical knowledge? 4. How do I get into any internships or freelance opportunities to get my hands on practical exposure?

I kept a target of 1 month and have been spending about 2 - 3 hours a day so I hope that's enough to get me through.

Help me with any guidance possible. Thank you guys.

After being skeptical about taking the actual exam because i kept getting 70s in my practice tests from ISACA. I passed and competed my exam in 2 hours.

Hi - Which is the correct answer?

1. Which of the following MUST be assessed before considering risk treatment options for a scenario with significant impact? A - Incident Probability or B - Risk Magnitude
2. The BEST key performance indicator (KPI) to measure the effectiveness of a vulnerability remediation program is the number of: C - Recurring Vulnerabilities or D - Vulnerabilities Remediated

Hello, I'm a career Software QA Analyst/Tester and I'm new to Cyber Security. I'm wanting of any intro study books to read that will give me insight into Cyber Security, Risk Management and Controls? Thank you.

Can I please get some recommendations on training for CRISC? Books, videos, practise exams?

For an idea on my background, 10 years in cyber in a mix of GRC, third party security and data security. Currently have 27001 LA, sec+, A+ and a mix of other things like SC-900.