CRISC Requirements 2026: Who Can Sit the Exam and What It Costs
Before you can book a seat you have to clear ISACA’s eligibility gates. Here is exactly what they check, in the order they check it.
- 150Questions
- 4hTime limit
- $575Exam fee from
Table of Contents
What the CRISC credential is
ISACA CRISC - Certified in Risk and Information Systems Control is awarded by ISACA. It is not a course certificate you can buy your way into — ISACA decides whether you are allowed to sit the exam at all, and that decision is made before you ever see a question. Candidates who treat the application as a formality are the ones who lose a testing window to a paperwork problem.
The eligibility gates, in order
ISACA checks these in sequence, and failing any one of them stops the application. Work through them top to bottom before you pay a fee.
Gate 1
You may sit the exam at any time - the experience requirement applies to certification, not to testing
Gate 2
A minimum of three years of professional experience in the CRISC job practice areas is required to be certified
Gate 3
That experience must have been gained within the ten years before you apply for certification
Passing the exam and being certified are two separate milestones. Candidates routinely pass and then discover their experience does not yet qualify them, which is why the exam-first order matters: the pass is valid while you accrue the years.
What it costs
The published fee is $575 for ISACA members, $760 for non-members. Budget past that number: most candidates also pay for a review course or a question bank, and a retake is charged separately in almost every programme. The cheapest way to sit this exam once is to over-prepare for the first attempt.
What the exam itself looks like
| Questions | 150 |
| Time limit | 240 minutes |
| Passing standard | A scaled score of 450 or higher passes |
| Fee | $575 for ISACA members, $760 for non-members |
How long the process takes
Three clocks run at once and candidates usually notice only two. The first is the experience clock: the hours or years in the gates above have to be accrued, and in most programmes accrued recently, so time spent in the wrong role does not count no matter how long you spent there. The second is the approval clock: transcripts, licence verification and reference checks are done by people rather than scripts, and they run in weeks rather than days. The third is the eligibility window: once approved you have a fixed period to sit the exam, and letting it lapse means reapplying and paying again.
Plan backwards from the date you want the credential in hand, not forwards from the day you decide to start. The paperwork is the part that is outside your control, so it should go first.
Why applications get sent back
The failure modes are boring and they repeat. Hours logged in a role that does not match the definition in the handbook. A transcript sent by the candidate instead of by the school. A licence that is current but carries a restriction. Experience that is genuine but falls outside the lookback window. None of these are judgement calls you can argue your way past — they are checkboxes. Read the eligibility page as though it were a contract, because for the purposes of your application it is one.
Once you are approved, the work is question volume. Practise CRISC questions free and find out where you actually stand before you book a date.
FAQ
Who is eligible to sit the CRISC exam?
You may sit the exam at any time - the experience requirement applies to certification, not to testing A minimum of three years of professional experience in the CRISC job practice areas is required to be certified That experience must have been gained within the ten years before you apply for certification
How much does the CRISC exam cost?
$575 for ISACA members, $760 for non-members
How many questions are on the CRISC exam?
150 questions.
How long does CRISC approval take?
Verification is manual, so allow weeks rather than days between submitting an application and being cleared to schedule. Once you are approved a fixed eligibility window starts running, and letting it expire means paying to apply again.
Sources
Every figure on this page comes from the certifying body, not from a third-party summary:
- https://www.isaca.org/credentialing/crisc
- https://support.isaca.org/s/article/What-are-the-requirements-to-become-CRISC-certified
Checked September 2, 2026. Fees and eligibility rules change; confirm against ISACA before you pay anything.