How many questions are on the ISACA CRISC exam?

The ISACA CRISC exam has 150 questions, and the vendor's published description is: 150 questions, 4 hours.

How long do you have to complete the ISACA CRISC exam?

You get 240 minutes, which is about 96 seconds per question. The published format is: 150 questions, 4 hours.

What score do you need to pass the ISACA CRISC exam?

The passing score is 65% (450/800 scaled score).

What are the domains on the ISACA CRISC exam?

There are 4 domains: Governance, IT Risk Assessment, Technology and Security, Risk Response and Reporting. The official weights are Governance 26%, IT Risk Assessment 22%, Technology and Security 20%, Risk Response and Reporting 32%.

How should I use the domain weights when revising?

Weight by percentage, not by domain. 26% is the one where lost points cost you the most, and Certilum scores you per domain so you can see exactly where that is.

Does Certilum have practice questions for the ISACA CRISC exam?

Yes: 150 questions in our bank for this certification, each tagged to the exam domain it belongs to, with the official domain weights applied.

Exam format

ISACA CRISC Exam Format

CRISC

Everything the official exam blueprint specifies: question count, time limit, scoring and the weight each domain carries. The ISACA CRISC certification is a globally recognized credential for IT risk management and information systems control. It validates a professional ability to identify, assess, respond to, and report IT risks while ensuring that security controls align with enterprise objectives. The exam covers four interconnected domains, with a strong emphasis on Risk Response and Reporting. CRISC holders are equipped to design and implement risk-based solutions, communicate risk exposure to executives, and embed compliance and resilience into IT operations. They become trusted advisors who help organizations balance innovation with risk management and regulatory obligations.

150 questions

240 min

65% to pass

4 domains

certilum

Exam facts at a glance

The published specifications for this certification.

Specification	Value
Questions	150
Time limit	240 minutes (96s per question)
Passing score	65% — 450/800 scaled score
Domains	4
Level	Professional
Question bank here	150 questions
Published format	150 questions, 4 hours
Source	Official exam specification, published by the vendor

Official domain weights

The percentage of the exam each domain carries. Weight your revision by these numbers, not by what you find hardest.

Domain	Weight	Topics	Practice Qs
Governance	26%	Board and management responsibilities Corporate governance and organizational structure Enterprise risk management components +4 more	39
IT Risk Assessment	22%	Risk events and threats Vulnerability and control gaps Risk analysis and quantification +4 more	33
Technology and Security	20%	Security architecture principles Infrastructure and network controls Identity and access management +4 more	30
Risk Response and Reporting	32%	Risk response options and prioritization Control categories and design Control implementation and testing +4 more	48

The heaviest domain is Governance at 26%, and that is where lost points cost you the most. Certilum scores you per domain so you can see the difference between a knowledge gap and a formatting problem.

Note from the vendor record: Scale is 200-800, passing is 450 or higher; separate USD 50 application processing fee after passing. Official exam page