How much does CRISC cost in 2026?

What does CRISC cost, line by line?

USD, from ISACA's CRISC page, its certification cost article (updated September 22, 2026), the 2026 exam candidate guide, and the ISACA store listings for the review manual, question database, and online review course, all read in November 2026. The exam fee is identical for every core ISACA exam, so if you have priced CISA or CISM you already know this number. Check the live pages before you pay, because ISACA reprices without notice.

Two fees you will only meet if something goes wrong: a $75 exam rescore, and a $50 reinstatement fee per certification if CRISC is revoked for missed CPE or dues and your appeal is approved. Both are on ISACA's cost article.

What will your first year of CRISC actually cost?

Every total below includes the exam, the $50 application fee, and the first maintenance fee, which ISACA bills by 1 January of the year after you certify, so it lands inside your first twelve months for most people. Member totals include the $145 in ISACA dues and exclude chapter dues, which ISACA sets by chapter and adds at checkout. Study material is ISACA list price. Figures are from the sources above, as of November 2026.

The spread is wide, $815 to $2,949, and almost none of it is the exam. Membership status moves $185. Study choices move up to $1,200. One retake moves $575 to $760 and pushes your pass date out at least 30 days. The cheapest reliable path is the second row: official manual, question database, first-time pass, at $1,223 plus chapter dues as a member.

Does ISACA membership pay for itself on CRISC?

In the year you test, yes, and by more than most cost pages say. ISACA's professional membership is $145 a year plus local chapter dues, and ISACA requires you to join your local chapter if one exists. Against that, the member exam price saves $185 and the member maintenance rate saves $40, so the exam and the first maintenance fee alone put you $80 ahead before chapter dues. Add the official manual ($30 less) and the question database ($100 less) and the member discounts total $355 against $145 in dues. Unless your chapter charges more than $210 a year, joining before you register is the cheaper path.

After you certify, the math changes. The recurring member saving is $40 a year on maintenance plus whatever CPE you would otherwise pay for; ISACA members earn CPE free through its webinars and Journal quizzes. If you already get CPE from your employer or a community, dropping membership after year one costs $40 a year and saves $145 plus chapter dues. The full dues breakdown, including student and recent-graduate rates, is in how much ISACA membership costs.

What does it cost to keep CRISC?

ISACA's CRISC maintenance page sets two requirements. The fee is $45 a year for members and $85 for non-members, due by 1 January. The CPE requirement is 120 hours over each three-year reporting cycle with a minimum of 20 reported every year. Miss either and ISACA revokes the designation; getting it back means a written appeal with CPE documentation, all back fees, and the $50 reinstatement fee, or retaking the exam if the appeal is denied.

Over a three-year cycle that is $135 for a member or $255 for a non-member in fees, plus whatever your 120 CPE hours cost, which is where renewal budgets go wrong. Paid CPE from training vendors can run several hundred dollars a year; free webinars, chapter meetings, and self-reported learning hours keep it at zero. If you stack certifications, ISACA charges full maintenance on your first two and drops the third and later to $25 for members or $50 for non-members, capped at $125 and $240 a year for four or more. One CPE activity can count toward every ISACA certification it applies to, so a CRISC plus CISA holder pays double fees but not double hours.

What does CRISC require besides money?

Three years of experience. To become CRISC certified you need three or more years of professional work across at least two of the four CRISC domains, gained within the ten years before you apply. ISACA lists no degree or certification waivers for CRISC. You can register and sit the exam before you have the experience, and candidates have five years from the pass date to apply, but until the application is approved you hold a score, not a credential.

The exam itself, per ISACA's 2026 candidate guide, is 150 multiple-choice questions in four hours, scored on a 200 to 800 scale with 450 to pass, covering the four domains on the CRISC exam content outline: Governance (26%), Risk Assessment (22%), Risk Response and Reporting (32%), and Technology and Security (20%). Registration is open year-round, your eligibility window is six months from the day you register, you can schedule as early as 48 hours after paying, and you can reschedule free up to 48 hours before the appointment. Let the six months lapse without testing and the fee is forfeited; a one-time $75 extension buys six more.

Retakes follow the same guide. You get four attempts in a rolling 12-month period, each at the full registration fee. After a failed first attempt you wait 30 days; after the second and third, 90 days each. ISACA publishes no pass rate for CRISC, so plan your budget on the first-time-pass row and keep a retake in reserve rather than the other way around.

How does CRISC compare with CISA, CGRC, and CGE-P on cost?

CRISC is priced identically to CISA, so the choice between them is about experience and the job, which CRISC vs CISA covers in detail. CGRC from ISC2 is the closest non-ISACA alternative for GRC work. CGE-P is the Club's own practitioner certification and is listed here on the same terms, not as a pitch. CISA and CGRC figures are as of September 2026 from each vendor's fee page; CRISC figures are November 2026.

The full eight-credential table, with first-year ranges, is in GRC certification cost, and the same credentials ranked from cheapest up are in cheapest GRC certifications. If you are weighing security-side credentials instead, the sibling pages on SSCP cost and SANS and GIAC cost use the same first-year method.

Is CRISC worth the money for a GRC role? Pick by your situation

Price the credential against the job you do now, not against a salary figure on a training vendor's page. At $815 to $1,433 for a first-time pass, CRISC is not expensive by certification standards. The question is whether it certifies the work you actually do and whether you can hold it this year.

• GRC analyst with three or more years in risk and controls. Worth it. Risk assessments, control ownership, vendor risk reviews, and risk reporting map to all four CRISC domains, you qualify outright, and CRISC is the ISACA credential most GRC analysts can hold soonest. Join ISACA for the exam year and self-study with the manual and question database; that is the $1,223 row.
• GRC analyst with one to two years. Wait, or test early with your eyes open. You can sit the exam now and apply when you reach three years, but the $625 to $810 sits idle until then and a passing score alone does not clear an HR filter. If you want a credential you can hold this year, CGRC needs two years, and CGE-P needs none.
• IT auditor. Not first. CISA costs exactly the same, your experience maps to its requirement, and audit employers screen on it. Add CRISC later if you move into a second-line risk role. The side-by-side is in CRISC vs CISA and the CISA line items are in CISA certification cost.
• Security or GRC engineer who builds controls. Only if your role owns risk decisions. Technology and Security is one CRISC domain out of four, so expect to study governance and reporting from scratch. If your work is building and operating controls rather than deciding which risks to accept, no ISACA exam tests your actual job, and CGE-P covers it more directly at a fraction of the cost.
• Federal or RMF work. CGRC first. ISSO, ISSM, and control assessor postings name CGRC far more often than CRISC, it needs two years of experience, and it costs less in year one. The case is in is CGRC worth it. Add CRISC if you move into enterprise risk.
• Employer is paying. Take it, and ask for the membership and question database in the same request. Many risk and compliance employers reimburse the exam voucher after a pass; fewer pay for the $795 to $895 online course, and the question database does most of the same work.

Where does the GRC Engineering Club fit?

CRISC certifies that you can assess risk and pick the right control. It does not ask you to build one. A growing share of GRC roles expect you to collect evidence with code, write policy checks that run in a pipeline, and keep a risk register fed from live cloud data instead of a quarterly spreadsheet. That is the gap CGE-P (Certified GRC Engineer, Practitioner) covers, through hands-on labs, an open-book exam, and a capstone you submit on GitHub, with no experience requirement and no renewal fee.

On cost the two are not close: CGE-P is $350 standalone or included in a $70 a year Club membership that also logs 48 CPE hours a year you can self-report toward a CRISC renewal. The honest tradeoff is recognition: CGE-P is new and does not clear HR filters the way an ISACA credential does, which is why most practitioners pair it with CRISC rather than replacing it. The full pairing is in CGE-P vs CRISC.

Frequently asked questions