Ready for the 8th Edition? 4 Ways the CRISC Exam Has Changed in 2025

The rules of risk management have changed. Here is your guide to the massive AI and supply chain updates in the new CRISC syllabus.

If you work in IT Risk, Governance, or Cybersecurity, the landscape just shifted beneath your feet. The launch of ISACA’s Certified in Risk and Information Systems Control (CRISC) 8th Edition syllabus is not just a routine administrative update. It represents a fundamental modernization of what it means to be a risk professional in an era defined by accelerating digital transformation.

I recently had the honor of attending “**New ISACA CRISC” webinar hosted by the ISACA Melbourne Chapter, is a vital panel discussion designed to review and analyze the significant changes implemented in the CRISC certification program. The discussion centers on everything attendees should know about the transition to the updated syllabus and the fully revised CRISC Review Manual 8th Edition, which forms the basis for the exam content effective 3 November 2025. This expert panel features CRISC-qualified professionals, including moderator Don Tibbits, and panelists Bharat Bajaj, Jeannette Ngau, and Mahesh Thiyagarajan, along with special guest Gokhan Polat** (me :)

The value of CRISC

The CRISC certification serves as an essential management tool for the business world and professionals who should handle digital risks in their daily life. As a solid proof of this, CRISC has received significant recognition, validating its value:

• In 2020, it was ranked the 4th Highest-Paying IT Certification by Global Knowledge, with an average salary of US$146,480.
• In 2024, it was recognized as an SC Awards Finalist and included in Skillsoft’s list of top-paying IT certifications.

These accolades demonstrate the strong market demand and financial return for professionals holding the CRISC credential.

Here are the four critical shifts every risk practitioner needs to know about the new framework.

1. The Timeline is Definitive

For those currently studying or planning to certify, you need to switch gears immediately. The transition to the 8th Edition is now fully in effect.

• Effective Date: The updated syllabus and exam content officially went live on 3 November 2025.
• Obsolete Materials: If you are using the 7th Edition Review Manual, put it aside. It is now officially obsolete, and exams based on that content are no longer available.
• New Resources: The 8th Edition Review Manual and the revised Questions, Answers, and Explanations (QAE) Database launched in September 2025.
• Exam Changes: The practice item count in the QAE has increased from 766 to 833 questions, reflecting the broader scope of the new syllabus.

2. The “Big Shift”: AI, Machine Learning, and Quantum

The single greatest conceptual leap in this edition is the comprehensive integration of emerging technology risks. The syllabus has moved beyond standard IT infrastructure to address the distinct vulnerabilities introduced by generative technologies.

Three major areas of expansion:

1. Vulnerability Sources (Domain 2): You are now expected to understand specific vulnerabilities related to Large Language Models (LLMs), Artificial Intelligence (AI), and Quantum Computing. As organizations race to embrace Machine Learning (ML) to accelerate processes, security professionals must adapt risk frameworks to match.
2. Non-Technical AI Risks: Domain 4 has expanded to include the “human” side of tech risk, specifically the ethics and human rights implications associated with AI implementation.
3. Risk Profile Modernization: The Risk Profile in Domain 1 now explicitly addresses factors influenced by modern technology reliance, including third-party dependencies and the absolute necessity of resilience building.

3. Domain Weighting: A Strategic Pivot

While the exam still consists of 150 questions, the weighting has shifted. ISACA has increased the emphasis on Risk Assessment (identifying and analyzing the problem) while slightly decreasing the weight on Technology & Security (the tools).

This signals a move toward proactive risk identification rather than just reactive security management.

CRISC Domain Weighting Changes

Critical Content Restructuring:

• Domain 1 absorbs COBIT: Risk Frameworks have been relocated here to emphasize that COBIT applies to information processing across the entire enterprise, not just the IT department.
• Domain 2 adds “Evaluation”: The section on risk scenario development has been renamed to explicitly include “and Evaluation,” formalizing the analysis stage. This underscores the need for effective threat modeling.
• Domain 3 targets the Supply Chain: “Third-Party Risk Management” has been renamed to “Vendor/Supply Chain Risk Management.” This change reflects the reality of modern business: when you outsource to the cloud, you are still accountable for the data.

4. The Conceptual Key to Passing

Regardless of the new AI content, the core challenge of the CRISC exam remains the same, and it is one that trips up many technical professionals.

You must think like a Risk Advisor, not a decision-maker.

Your role is to provide the best possible advice on risk to the business. You do not make business decisions; you enable the business to make them intelligently. The certification validates your ability to manage risk at the intersection of enterprise objectives, control design, and business resilience.

To succeed in this new framework, candidates must move beyond memorization. You must achieve a deep conceptual understanding of how a technical risk — like a Quantum computing breach — links directly to enterprise business objectives.

The Bottom Line

The 8th Edition CRISC is modernized for the era of digital transformation. It equips you not just to manage known threats, but to anticipate and govern the ethical and technological risks inherent in rapid innovation.

More…

[embed]Blockchain Node Management: The Unseen Costs Turning Dreams into Nightmares While nodes are the absolute bedrock of Web3, the shocking costs and technical burdens of self-management have made…medium.com

[embed]The 49% Problem: Half of Companies Can’t Prove Their AI ROI This article is an adaptation of the presentation I delivered as a panelist at the Turkic States InsurTech Summit in…medium.com

[embed]Risk Assessment Methodologies for ISO 31000 Practitioners As a risk expert, I see this content bridging the gap between ISO 31000’s risk management strategy and ISO 31010’s…medium.com