PrepForCerts
Get started
Menu

CRISC / RENEWAL GUIDE Keep your credential current.
Make renewal a steady habit.

Review CRISC credits, fees, and deadlines. Choose useful learning and keep the records you need.

Plan your renewalTry free practice

Published by PrepForCerts · Editorial responsibility and sources

Does CRISC Expire? Complete Renewal & CPE Guide 2026

Earned your ISACA CRISC? Understanding its validity period is crucial for maintaining your CRISC credential and planning your professional development.

With a 3 years validity period, proactive planning ensures your CRISC credential remains active. This guide covers renewal methods, costs, and strategies to maintain certification without interruption.

Plan your next step

CRISC requires at least 20 CPE hours each year and 120 over three years. Annual maintenance is US$45 for ISACA members or US$85 for non-members, separate from membership dues. Report relevant activities, keep evidence, comply with audits if selected, and follow professional ethics.

Validity
3 years
CEUs Required
20
Renewal Cost
US$45 member / US$85 non-member
Renewal Method
CPE and maintenance

Provider reference: CRISC requires a scaled score of 450 on the 200–800 scale. This is not 56.25% raw accuracy, and no fixed number of questions you can miss is published. Study schedules and practice percentages are planning examples, not official requirements or pass predictions. Confirm current fees and eligibility before purchase. Exam details · Maintenance policy

Yes, the Certified in Risk and Information Systems Control (CRISC) certification expires every 3 years. Like all ISACA certifications, CRISC requires 120 CPE hours per certification cycle, a minimum of 20 CPE hours annually, and payment of the annual maintenance fee. IT risk professionals must plan their continuing education throughout each cycle to keep their credential active.

Cycle
3 Years
CPE Hours
120
Annual Min.
20 Hrs
Member Fee
$85/yr

CRISC Renewal Requirements

CRISC covers four domains: IT Risk Identification, IT Risk Assessment, Risk Response and Reporting, and Information Technology and Security. As enterprise risk management practices evolve with new technologies, regulatory changes, and emerging threats, ISACA requires CRISC holders to demonstrate ongoing professional development in these areas.

CPE activities must relate to IT risk management, information security, governance, or related disciplines. ISACA provides flexibility in how you earn CPE hours, accepting everything from formal training courses to self-study, teaching, publishing, and professional contributions. Each CPE hour must be documented and is subject to potential audit by ISACA.

Plan eligible professional education throughout each year. Ordinary work tasks do not automatically qualify; check the activity category, relevance, credit limit, and evidence requirements.

How to Earn CRISC CPE Hours

CRISC vs Other Risk Certifications: Renewal Comparison

CertificationCycleCE RequiredAnnual Fee
CRISC3 years120 CPE hoursUS$45 member / US$85 non-member
CISM3 years120 CPE hoursUS$45 member / US$85 non-member
CISSP3 years120 CPE creditsUS$135
CompTIA Security+3 years50 CEUsUS$150 total per three-year CE cycle

What Happens If CRISC Lapses

If you don't meet CPE or fee requirements, ISACA revokes your CRISC certification. You cannot use the CRISC designation professionally until you either reinstate (within a limited ISACA-defined window) or retake and pass the full exam. The CRISC exam consists of 150 questions over 4 hours with a passing score of 450 out of 800.

If ISACA requires a new certification application, check its current experience requirements and retain evidence of relevant risk-management and control work. Maintaining CPEs and fees avoids the uncertainty and cost of a revoked credential.

Pro Tips for Efficient CRISC Renewal

If you hold multiple ISACA certifications, strategically choose CPE activities that qualify for several credentials simultaneously. Risk management conferences and GRC training often count toward CRISC, CISM, and CISA. Document each activity thoroughly, noting which domains it covers and retaining certificates of completion.

Consider joining your local ISACA chapter. Chapter meetings typically offer 1-2 CPE hours per event, and most chapters host monthly events. Over a year, regular attendance alone can generate 12-24 CPE hours while also expanding your professional network in the GRC community.

ISACA CRISC Certification Validity Period

Your ISACA CRISC certification is valid for 3 years under the certification cycle shown in your provider account. After this period, your certification status changes to "expired" unless you complete renewal requirements.

Key Dates to Track:

What "Expired" Means: When your certification expires, you can no longer claim active certification status. You cannot use the credential on your resume as current, and verification services will show your certification as inactive. However, expiration doesn't erase your achievement—you can still mention that you "previously held" the certification.

Grace Periods and Extensions

Failure to meet maintenance requirements can revoke the credential. Contact ISACA about an appeal and provide evidence. Approved reinstatement requires outstanding maintenance fees plus the published US$50 reinstatement fee; an unsuccessful appeal requires the current exam and application process. The safest approach is completing renewal before your expiration date.

How to Renew Your Certification

Keep records of eligible activities and report credits through the provider’s portal. Check credit categories, limits, and evidence requirements before counting training, conferences, publishing, or other certifications.

Complete Cost of Renewal

The total cost of renewing ISACA CRISC includes both direct fees and the value of time invested in continuing education:

Direct Costs:

Time investment: Spread eligible learning across the full cycle. Credit awards depend on the activity and provider rules; do not budget only 40–60 hours for a 120-credit requirement. Plan regular sessions, keep evidence, and review your reported total each quarter.

Cost-Effective Strategies: 1. Many activities you already do count toward credits (reading, attending meetings, on-the-job training) 2. Free webinars and online resources often qualify for credits 3. Contributing to the community (blogging, mentoring, speaking) earns credits while building your reputation

What Happens If Your Certification Expires

If your CRISC credential is no longer active, show its status clearly on a resume or application. Earlier achievement remains part of your history.

Prevention Strategy: Set reminders at 12, 6, and 3 months before your cycle ends. Collect evidence as you learn and review your account before the deadline.

More study tips

Review ISACA's glossary to ensure you understand terms exactly as ISACA defines them.

ISACA exams test policies and procedures, not just technical controls.

Understand the ISACA code of professional ethics—questions may reference it.

Set calendar reminders at 12, 6, and 3 months before expiration to track your CRISC renewal progress.

Log CEU activities immediately after completing them—don't rely on memory at renewal time.

Consider earning a higher-level certification to automatically renew CRISC.

Mistakes to check

Waiting until the last month before expiration to start accumulating CEUs.

Not tracking activities throughout the certification cycle and forgetting eligible credits.

Assuming all training automatically qualifies for CEUs without checking vendor requirements.

Letting the certification expire and then needing to retake the exam.

Not considering higher-level certifications that would automatically renew current credentials.

Failing to budget for renewal costs and being surprised by fees.

Prepare for Your ISACA CRISC Journey

Whether you're pursuing initial certification or preparing for renewal, practice questions help you stay sharp.

Start Free Practice Test

Frequently Asked Questions

Does ISACA CRISC certification expire?

Yes, ISACA CRISC certification expires every 3 years. You must complete renewal requirements before expiration to maintain active certification status.

How long is ISACA CRISC certification valid?

ISACA CRISC certification is valid for 3 years from your certification date. After this period, you must renew to maintain active status.

How much does ISACA CRISC renewal cost?

CRISC requires at least 20 CPE hours each year and 120 over three years. Annual maintenance is US$45 for ISACA members or US$85 for non-members, separate from membership dues. Report relevant activities, keep evidence, comply with audits if selected, and follow professional ethics.

Optional training, conferences, and study materials can add to the fee. Eligible free activities can reduce the learning cost; check the provider’s credit rules.

How many CEUs do I need for ISACA CRISC renewal?

CRISC requires at least 20 CPE hours each year and 120 over three years. Annual maintenance is US$45 for ISACA members or US$85 for non-members, separate from membership dues. Report relevant activities, keep evidence, comply with audits if selected, and follow professional ethics.

Eligible activities can include relevant training, professional education, and other approved methods. Check activity categories, limits, and supporting records before reporting credits.

Can I renew CRISC by retaking the exam?

Do not assume another certification or retaking an exam automatically renews this credential. Meet its CPE, annual fee, and reporting requirements.

What happens if my ISACA CRISC certification expires?

Failure to meet maintenance requirements can revoke the credential. Contact ISACA about an appeal and provide evidence. Approved reinstatement requires outstanding maintenance fees plus the published US$50 reinstatement fee; an unsuccessful appeal requires the current exam and application process.

Can I renew ISACA CRISC early?

Yes, you can renew ISACA CRISC at any time during your certification cycle. Early renewal typically extends your certification by 3 years from your original expiration date (not from when you renewed).

What activities count toward ISACA CRISC CEUs?

Self-study, training, publishing, mentoring, or speaking engagements. Most learning activities, professional contributions, and career development efforts qualify for continuing education credits.

Does CRISC expire?

Yes, CRISC expires every 3 years. Renewal requires 120 CPE hours (20/year minimum) and the US$45 annual maintenance fee for ISACA members (US$85 for non-members).

How many CPE hours does CRISC require?

120 CPE hours over 3 years, minimum 20 per year. Activities must relate to IT risk management, governance, or information security.

What happens if my CRISC certification lapses?

ISACA can revoke the credential for unmet maintenance requirements. Contact ISACA to appeal with evidence. An approved appeal requires outstanding maintenance fees and a US$50 reinstatement fee. If the appeal is denied, follow the current exam and certification application process.

Keep your knowledge current

Use practice questions to review your knowledge. This site does not certify that answering its questions earns continuing-education credits; check the provider’s activity and evidence rules.

Start Free CRISC Practice Test →

ISACA accepts a variety of activities for continuing education credits:

Training and Education:

Professional Activities:

Self-Study:

Work Experience:

Track all activities throughout the year rather than scrambling before expiration. Most vendors provide online portals where you log activities and track progress toward requirements.

Related CRISC resources

Practice and exam format

Study and requirements

Renewal and next steps