The easiest way to get CRISC, and a seat at the table where risk decisions get made
Pre-sale: save $200 until Sunday, Nov 15
Taught by Kelly Handerhan and Rob Witcher. CRISC proves you can decide which risks matter to the business. This MasterClass adapts to your schedule and to what you already know, so you get there with as little wasted study time as possible.
Pre-sale price until Sunday, Nov 15, 11:59pm PT. Access starts Monday, Nov 16.
Many employers pay for certification training, so it's worth asking yours
“I passed the CRISC this week, Kelly did a great job in my opinion. Thanks!”
See What Our Students Have to Say
“I went through Kelly's 3 day CRISC boot camp. Aside from the instruction delivery, I think the most effective part were the practice questions. followed by the overall learning portal and personalized study guide. On the practice questions -- Compared to the official QAE (too difficult and demotivating), your practice questions were much more realistic. I was nervous ignoring the QAE, but after taking the exam I'm glad I did. Thank you for that. Overall it was a fantastic experience and you've helped me conclude a 3.5 year journey. Now i'm about to pick up and jump into your CISM masterclass and the AAISM masterclass. Thanks again and I look forward to the next one.”
Daniel “I did the ISACA CRISC bootcamp and passed the CRISC last year, and that was a good bootcamp and I learned a lot there. But the CISSP Destination Certification bootcamp I feel didn't just prepare me for passing the exam, it prepared me for being a professional system security professional. I am better off having completed this bootcamp!”
Zachary H
Key Takeaways
Pre-sale: save $200 until Nov 15. Access starts Nov 16.
CRISC moves you from implementing controls to deciding which risks matter to the business.
The exam tests business judgment. Strong technical instincts often pick the wrong answer, and judgment is what this course trains.
Taught by Kelly Handerhan and Rob Witcher.
Every missed assessment question routes you to the right lesson, notes, flashcards, MindMaps and references.
Your study plan fits your schedule, and your review time goes to your weakest topics.
Everything you need is included, and we support you until you're certified.
Why CRISC is worth your time
Somewhere in your organization, someone decides which risks get fixed this quarter, which get accepted, and which get a budget. CRISC is the credential that says you belong in that conversation.
It changes what people bring to you.
CRISC is the best-known IT risk certification. It turns "I've worked around risk for years" into something a hiring manager can trust on paper, which matters because many promotion decisions happen on paper.
It pays
CRISC is consistently among the highest-paying IT certifications.
The work gets more interesting
You stop receiving decisions to implement and start shaping them. There's real satisfaction in making a risk clear enough that leadership acts on it. The skill compounds, too: every new system, every scope increase and every budget conversation draws on it.
You can see the risk. The decision gets made somewhere else.
Maybe you work on the implementation side. You configure the controls and patch the systems, and decisions about risk get made in meetings you're not in. Some of those calls make sense. Others ignore something you could have flagged in two minutes.
Or maybe you already do risk work. You run the assessment, build the register, write the report. Then very little changes, because the business never treated the risk as its own decision.
Either way, CRISC builds the skills that close that gap:
- Framing risk in the business terms decision-makers respond to
- Getting risk owners to own their risks
- Choosing controls that match the organization's risk appetite
- Reporting that leads to action
That's the career move: from the person who documents or implements risk responses to the person leadership calls before it decides.
Hold CISSP? About 20 to 25% of CRISC will feel familiar. The rest goes deeper into how organizations decide what to do about risk.
Why train for CRISC with DestCert
Built around judgment
CRISC questions often have several reasonable answers. Kelly and Rob teach how a risk practitioner weighs them: who owns the risk, what the appetite allows, what the business needs first. You'll recognize the right answer because you understand why it's right.
Hard concepts made clear
Which assessment approach fits which situation. How risk appetite and risk tolerance relate. When a KRI is the right measure. Each idea gets its own short video with real examples, so you can find it again in seconds.
Exam strategy
Knowing the material and knowing how ISACA asks about it are separate skills. Dedicated exam strategy videos teach the second one, drawing on our team's work with ISACA certifications and feedback from thousands of students.
Respect for your experience and your time
The review guide adapts to what you already know, so you don't relearn what you've mastered. If you hold CISSP, that saves you real hours.
Adaptive training system
Let's say you get an assessment question wrong. Here's what you get:
An explanation of the correct answer
The video lesson for that exact topic
Notes
Flashcards
The MindMap video
that shows how the topic connects to the rest of CRISC
ISACA references
A direct link to ask about it in the student chat
That topic also moves up in your review guide, so your time goes where you need it.
A study plan that fits your life
Tell the MasterClass when you're starting, when you plan to sit the exam, and which days you can study. It builds a daily plan and adjusts as you go. Each day you open it and see exactly what to study.
Your review time goes to your weakest topics
Every question you miss moves that topic up in your review guide. Every one you get right moves it down. So when it's time to review, you open the guide and start with what you still need, instead of rereading chapters you already know.
The CRISC exam tests business judgment
Most technically strong people pick the answer that fixes the problem fastest. On CRISC, that answer is often wrong. The exam wants the risk practitioner's answer: the one that respects who owns the risk and what the business has agreed to accept.
Here's an example.
Question 1
A business unit owner wants to accept a risk that sits above the organization's risk appetite. The IT team wants to remediate it immediately. What should the risk practitioner do first?
- A.Start remediation, since the risk exceeds appetite
- B.Record the acceptance, since the business owner owns the risk
- C.Escalate the risk analysis to senior management so they can decide on the acceptance
- D.Ask the IT team for a remediation cost estimate
Show answer
Answer: C. Escalate the risk analysis to senior management so they can decide on the acceptance
Correct answer: C
Option A feels responsible, but it takes the decision away from the business. Option B skips the fact that accepting a risk above appetite needs a higher level of authority. Option D helps later and leaves the real question open: who decides. Option C puts the decision with the people who set the appetite, along with the information they need.
This question tests whether you can:
- Tell who has the authority to accept a risk
- Treat risk appetite as a business decision
- Hold the technical fix until the decision is made
The whole MasterClass trains this kind of thinking, topic by topic.
Everything the CRISC exam tests, in one place
The MasterClass teaches all four CRISC domains, so you don't need to piece together extra books, videos or question banks. We teach them in the order that makes them easiest to understand, which isn't always the order ISACA lists them.
Domain 1 Governance
- Organizational governance: strategy, goals and objectives; organizational structure, roles and responsibilities; organizational culture and ethics; policies and standards; business processes and resilience; organizational asset management
- Risk governance: enterprise risk management; lines of defense; risk profile; risk appetite and risk tolerance; risk frameworks, and legal, regulatory and contractual requirements
Domain 2 Risk Assessment
- Risk identification: risk events; threat modeling and the threat landscape; vulnerability management; risk scenario development and evaluation
- Risk analysis: risk assessment concepts and standards; business impact analysis; the risk register; risk analysis methodologies; inherent and residual risk
Domain 3 Risk Response and Reporting
- Risk response: risk response options; risk and control ownership; vendor and supply chain risk management; issue, finding, exception and exemption management
- Control design and implementation: control frameworks, types and standards; control design, selection, implementation and analysis; control testing methodologies
- Risk monitoring and reporting: risk action plans; data collection, aggregation, analysis and validation; key risk indicators (KRIs), key control indicators (KCIs) and key performance indicators (KPIs); monitoring and reporting techniques such as heat maps, scorecards and dashboards; monitoring and reporting of emerging risks
Domain 4 Technology and Security
- Technology principles: technology roadmaps and enterprise architecture; operations management, such as change management, assets, DevOps, problems and incidents; system development life cycle; data lifecycle management; portfolio and project management; technology resilience and disaster response and recovery; emerging technologies
- Information security principles: security concepts, frameworks and standards; security and risk awareness and training; data privacy and data protection principles
Everything Included
MasterClass Videos
75 video lessons from Kelly and Rob
Knowledge Assessments
694 assessments that send you to what you missed
Digital Workbook
Flashcard App
1,032 cards
Our CISSP Guidebook
Coming soon!
Practice Exam
75 questions
Weekly live Q&A calls
MindMap Review Videos
25 videos
Student Discord
The CRISC training that adapts to your life
No matter how much you can study each day or week, the CRISC training adjusts to your schedule and keeps you on track to pass.
1 Week
Go all in and finish your CRISC prep in one week
If you can put the rest of your life on hold for a while, you can get through the risk material very quickly. A week covers all four domains. It's intense, and completely doable when you can focus.
4-10 Weeks
Study while juggling work and family
If you can't tell your spouse to handle everything while you study, this is the ideal pace for busy professionals. You'll typically need 4 to 10 weeks to build the risk judgment the exam tests and pass.
A Few Months
Study when your schedule allows
If you're in the middle of major projects and can't change your schedule much, the CRISC training adapts to whatever time you have. It will take a few months, and you can still get there at this pace.
Learn from Kelly Handerhan and Rob Witcher
Kelly Handerhan
CISSP, CCSP, CISM, CISA, CRISC, CEH, PMP, Security+, Network+
If you studied for CISSP, there's a good chance you've already learned from Kelly. Her free "Why you will pass the CISSP" video comes up again and again in "how I passed" posts. She has over 20 years in IT and cybersecurity, including more than 10 years managing IT projects in the public and private sectors. She's recognized as one of the Top 100 Trainers worldwide and teaches our CRISC Bootcamp.
Rob Witcher
Co-founder & Master Instructor
Read full bioAAISM, CCSP, CISSP, CCSK, CISM, CISA, CSX-P, CIPM,MCSE: Security, PMP
Rob was the CIO of a global mining company, so he's sat on the side of the table where risk decisions get made. He taught official ISC2 CISSP and CCSP classes for about three years while at Deloitte.
CRISC MasterClass Pricing
Three plans to match where you are and what you need. All three give you full access to the AAISM MasterClass, study materials, and everything required to pass the exam.
Pre-sale: save $200 until Sun, Nov 15
CRISC MasterClass
Taught by Kelly Handerhan and Rob Witcher
- 75 short video lessons, each on one topic
- Knowledge assessments that send you to what you missed
- Adaptive review guide and daily study plan
- Exam strategy videos on how ISACA writes questions
- 75-question practice exam
- Flashcards, practice questions and MindMaps in the DestCert app
- Digital workbook (PDF)
- Weekly live Q&A and student Discord
- 1 year of access
Payment Plan
6 × $197Pre-sale ends Sunday, Nov 15, 11:59pm PT.
Your access starts Monday, Nov 16.
6 × $157/mo
First payment today, then 5 monthly payments
One-time Payment (Save ~15%)
$997Pre-sale ends Sunday, Nov 15, 11:59pm PT.
Your access starts Monday, Nov 16.
$797
One payment
Your access starts Monday, Nov 16
Prices are in USD
- Payment Plan: Enjoy the convenience of our payment plan to split the MasterClass fee over six monthly payments. It’s an easy way to manage your budget!
- One-time payment: One-time payment provides a ~15% discount!
Your employer may pay for this. Many companies cover certification training, and approval is easier when the training comes from an established provider.
We're done when you're certified
Let's be real: nobody can guarantee you'll pass. What we guarantee is support for as long as you're seriously working toward CRISC. Our students have a 93.6% first-attempt pass rate, and nearly all who need a second attempt pass on that one.
If your first attempt doesn't go to plan, you get:
- A personal recovery roadmap
A mentor analyzes your exam results, maps out where to focus, and gets on a 1:1 strategy call with you before your next attempt. - Precision review
The knowledge assessments pinpoint your gaps, so you study what you need and skip what you know. - Answers when you're stuck
Bring your toughest questions to the student Discord. - No expiration date
Full access to the materials and support for as long as you need, at no extra cost.
Frequently Asked Questions
What's included?
Video lessons, knowledge assessments, an adaptive review guide, a daily study plan, exam strategy videos, a practice exam, the workbook, a digital guidebook, Theory in Practice walkthroughs with a worked risk register example, and the student Discord. Flashcards, practice questions and MindMaps are in the DestCert app.
When do I get access?
If you enroll during the pre-sale (until Sunday, Nov 15, 11:59pm PT), your access starts Monday, Nov 16. From Nov 16 on, access starts when you enroll.
How long do I have access?
1 year. If you need more time, email support@destcert.com and we'll extend your access.
Does it include everything I need to pass?
Yes. Many of our students pass without any other books, videos or question banks.
Is the exam voucher included?
No. You register and pay for the exam directly with ISACA.
How do I register for the exam?
Through ISACA's website. You create a MyISACA account, register and pay for the exam, then schedule it with PSI, ISACA's testing provider. You can test at an authorized PSI testing center or take the exam remotely with a proctor. Scheduling opens as early as 48 hours after you pay.
What support do I get?
The student Discord for your questions, and our guarantee: we support you for as long as you're seriously working toward CRISC.
What's the exam format?
150 multiple-choice questions in 4 hours, across four domains: Governance (26%), Risk Assessment (22%), Risk Response and Reporting (32%), and Technology and Security (20%).
What experience do I need?
Three years of cumulative work experience in IT risk management and control, across at least two of the four CRISC domains. You can sit the exam before you have the experience and become certified once it's in place.
I hold CISSP. How much will be new?
About 20 to 25% of CRISC will feel familiar. The rest focuses on how organizations decide what to do about risk, and the review guide adapts so you don't relearn what you already know.
Should I take CRISC or CISM?
CISM proves you can run a security program. CRISC proves you can identify, assess and respond to IT risk in a way the business acts on. If you want to lead the security function, start with CISM. If you want to own risk decisions and work with the business on them, start with CRISC. Plenty of people end up with both.
Will my employer pay for this?
Many employers pay for certification training, especially from an established provider.
Get CRISC the easiest way
The pre-sale ends Sunday, Nov 15 at 11:59pm PT. Enroll now to save $200, and your access starts Monday, Nov 16.