Domain 4: Information Technology and Security

CRISC · about 20% of the exam

The IT and security principles a risk practitioner needs, from architecture, operations, projects and data to resilience, emerging technology and privacy.

Revising? All of this domain's slides in one deck. When you're done, take the domain quiz.

Architecture and operations

• Enterprise Architecture and IT Risk How enterprise architecture gives the risk practitioner a map of business processes, data, applications and technology, and how architecture choices and technology roadmaps create or reduce IT risk.
• Change Management Risk Why uncontrolled change is one of the biggest sources of IT incidents, how a risk-based change process works, and what the risk practitioner looks for in emergency and standard changes.
• Assets, Configuration and Dependencies How IT asset management and configuration management keep an accurate picture of what exists, how it's configured and what depends on it, so risk can be assessed and changes made safely.
• Incident and Problem Management Oversight How incident management restores service and problem management removes root causes, and how the risk practitioner uses incident and problem data to keep risk assessments honest.

Projects and development

• Project Governance and IT Risk The risks IT projects carry, both to their own delivery and to the operations they change, and how project governance and risk checkpoints keep them visible and owned.
• Governing the Secure SDLC How security and control requirements are built into each stage of the system development life cycle, and the governance that makes sure they don't get dropped.
• DevOps, CI/CD and Agile Delivery Risk How fast, frequent delivery changes IT risk, and how agile and DevOps teams keep controls such as segregation of duties, testing and approval working inside the pipeline.
• Testing, Release and Deployment Risk How testing levels, release management and go-live decisions control the risk of putting new or changed systems into production, including data conversion and rollback.

Data lifecycle

• Data Classification, Ownership and Handling How data is classified by sensitivity, who decides the classification, and how clear handling rules for each level turn classification into everyday protection.
• Data Lifecycle: Integrity, Retention and Disposal How data is protected from creation to destruction: keeping it accurate and complete, retaining it as long as the law and business require, and disposing of it securely.

Resilience

• Business Continuity Planning and Governance How business continuity planning keeps critical processes running through disruption, from the BIA to strategies, plans, training and maintenance, and how it links to IT risk management.
• Disaster Recovery and Testing Recovery Capability How recovery objectives drive the choice of recovery sites and backup strategies, and how progressively realistic testing proves the organisation can actually recover.

Emerging technology

• Emerging Technology Risk: Cloud, IoT and OT The characteristic risks of cloud, IoT, operational technology and other emerging technologies, and how the risk practitioner assesses them before and after adoption.
• AI and Machine Learning Risk The risks of using and building artificial intelligence, from data leakage and inaccurate output to bias, misuse and regulation, and how to govern AI like any other risk.
• Setting Risk Boundaries for Innovation How the risk practitioner helps the business innovate safely, using appetite, guardrails, sandboxes and pilots instead of blanket bans or uncontrolled adoption.

Security principles

• Core Security Concepts: CIA, IAM, Cryptography and Network Security The security concepts a risk practitioner needs to discuss controls with confidence: confidentiality, integrity and availability, identity and access management, cryptography, and network and endpoint protection.
• Security Frameworks and Control Standards How security frameworks such as NIST CSF, ISO 27001 and the CIS Controls give structure to a security program, and how policies, standards and baselines turn them into enforced controls.
• Security Awareness Culture and Measuring Training How security awareness and training reduce people-related risk, how to tailor them by role, and how to measure whether behaviour actually changes.
• Privacy Governance and Data Protection Principles How privacy differs from security, the core data protection principles, and how a privacy program manages the risk of collecting, using and keeping personal data.
• Developing a Data Protection Control Strategy How to build a data protection strategy that finds sensitive data wherever it lives, protects it in proportion to its value, and monitors and responds when it's at risk.