Almost a third of the CRISC exam is one domain. Risk Response and Reporting carries 32% of the 150 questions, so it is the domain with the most marks to lose. The book you buy decides how well you cover that domain, and Amazon still sells an edition ISACA withdrew a year ago.
ISACA put a new CRISC job practice on the exam on 3 November 2025. It is not a rewrite. It kept the same four domains, two of them lightly renamed, and only two points of weight moved. What changed underneath is the content: the Official Review Manual that came with it added AI and LLM risk, quantum, zero trust, and fourth and nth party supply chain risk. This guide checks every pick against that job practice. Prices, stock, and editions were verified against ISACA’s pages and live Amazon listings in October 2026.
Where the 150 CRISC questions come from
Start with the weights, because they should decide how you split your study time. These are the figures on ISACA’s CRISC exam content outline.
| Domain | 2025 weight | 2021 weight | About how many questions |
|---|---|---|---|
| Governance | 26% | 26% | 39 |
| Risk Assessment | 22% | 20% | 33 |
| Risk Response and Reporting | 32% | 32% | 48 |
| Technology and Security | 20% | 22% | 30 |
Two points moved from Technology and Security to Risk Assessment. That’s the whole re-weighting. The question counts are simple arithmetic on 150, so treat them as a guide, not a promise of the exact split you will see.
The rest of the format did not change. You get four hours, every question is multiple choice, and the score is scaled from 200 to 800 with a pass at 450. The exam costs US$575 for ISACA members and US$760 for everyone else. Passing doesn’t certify you on its own. You also need three years of risk and control work across at least two of the four domains, earned in the ten years before you apply. After that it is 20 CPE hours a year and 120 over each three year cycle.
Does a 2021 CRISC book still work?
Mostly, and that is where it differs from CISA. When ISACA updated CISA in 2024 it moved four points of weight, ended with two domains at 26% each, and rewrote much of its task list, which is why our CISA book guide rules out most books written for the old exam. CRISC moved half that, two points between two domains. A book written for the 2021 job practice still teaches roughly 98% of the weighting correctly.
What it can’t teach is the new material. ISACA’s changelog for the 8th edition lists what was added:
- LLM, AI, and quantum computing as sources of vulnerability, plus AI ethics under emerging technology.
- Fourth, fifth, and nth party risk in vendor and supply chain management.
- Zero trust under operations management.
- Lines of defense described by function rather than numbered first, second, and third.
- KPIs, KRIs, and KCIs merged into a single “risk and control metrics” topic.
The 2025 exam content outline also adds a supporting task on facilitating tabletop exercises, which the 2021 outline did not have. So the rule is simple. One current book goes on the list no matter what. An older book can sit next to it for depth or practice questions, but it cannot be your only source.
The CRISC shelf compared
Four of these are exam books. The other two are risk measurement books that make the Domain 2 and Domain 3 material concrete. These are books, so nothing was lab tested. Each claim below comes from publisher pages, ISACA, and the live Amazon listing, and each price is a band to check against the listing.
| Book | Role | Job practice | Practice questions | Price band |
|---|---|---|---|---|
| CRISC Official Review Manual, 8th ed (ISACA) | Official reference | 2025 | Chapter self-assessments | $120 to $140 |
| CRISC Study Guide (Sybex, Gregory) | Teaching book | 2025 | 2 online practice exams | $45 to $65 |
| CRISC All-in-One Exam Guide, 2nd ed (McGraw Hill) | Budget depth | 2021 | 300 in a test engine | $35 to $60 |
| ISACA CRISC Exam Guide (Packt, Mehta) | GRC primer | 2021 | Chapter quizzes, 2 practice quizzes | $45 to $60 |
| Measuring and Managing Information Risk, 2nd ed (FAIR) | Risk analysis | Practitioner | None | $40 to $60 |
| How to Measure Anything in Cybersecurity Risk, 2nd ed | Risk measurement | Practitioner | None | $35 to $60 |
Only two books on the shelf were written for the current cycle, and they are very different buys. The Review Manual is ISACA’s own reference. The Sybex guide is the one that teaches.
The official reference: CRISC Official Review Manual, 8th Edition
This is ISACA’s own book for the 2025 job practice, released on 2 September 2025, and it’s the edition behind the “crisc official review manual 8th edition” searches. If you only want the source the exam questions are written against, this is it.
Its value is vocabulary. CRISC questions often turn on ISACA’s exact framing of a term like risk appetite, risk capacity, or control ownership. This manual is where that framing comes from. The 8th edition is printed in full color, adds a case study to every chapter, and carries the new AI, quantum, and zero trust sections. ISACA describes it as a comprehensive reference guide, with each chapter split into objectives, self-assessment questions, and reference material. That is a reference, not a course, and it assumes you already work near risk or audit.
Best for: anyone already in GRC who wants ISACA’s wording from the source. Pass on it if you are new to risk and need ideas explained from the ground up. Start with the Sybex guide instead. Amazon lists the 8th edition at roughly $120 to $140. ISACA sells it too, so compare its member price before you buy.
The teaching book for the current cycle: CRISC Study Guide (Sybex)
If you buy one book, buy this one. Peter H. Gregory wrote it for the 2025 job practice, Sybex published it on 5 May 2026, and the cover says “2025 job practice” in plain type.
It is the only CRISC book from an established publisher written for the current exam that we found on Amazon in October 2026. Wiley’s description uses the 2025 domain names, and the book comes with access to Sybex’s online learning environment: two custom practice exams, 100 electronic flashcards, and a searchable glossary. Wiley says “hundreds of practice questions” but does not publish an exact count, so we won’t guess one. Gregory has written CISA, CISM, and CRISC prep for years, including the McGraw Hill book below. This one is the newer of the two.
Who it suits: first time CRISC candidates who want one book that teaches the current domains and drills them. Pass on it if you want ISACA’s exact wording on every term. Pair it with the Review Manual for that. Around $45 to $65, so check the live price.
Budget depth with a question bank: CRISC All-in-One Exam Guide, Second Edition
Peter Gregory, Bobby Rogers, and Dawn Dunkerley are the authors of this McGraw Hill guide, published in April 2022. It is often the cheapest full teaching text on the shelf.
Neither the cover nor the description names a job practice year. It came out between August 2021 and November 2025, so it teaches the 2021 cycle. The domains still line up, and the cover promises 300 practice questions in a test engine, which is real drilling for the price. What it will not cover is the list above: AI and LLM risk, nth party supply chain, zero trust, and the renamed lines of defense.
Buy it as: a second book next to a current one, for another explanation and a cheap question bank. Do not make it your only book, because the 2025 additions are not in it. Around $35 to $60.
For engineers moving into GRC: ISACA CRISC Exam Guide by Shobhit Mehta
Packt published Mehta’s guide in September 2023. Its subtitle calls it a primer on GRC as well as an exam guide, and that’s the honest reason to buy it.
Packt names GRC and risk professionals as its first audience, then SOC analysts, penetration testers, and security analysts. That second group is where we think it earns its place. Engineers from security work know controls but not the governance language around them, and the primer chapters cover exactly that. Each chapter ends with a self-assessment, there are two practice quizzes, and the print edition includes a free PDF. Like the All-in-One, it is a 2021 cycle book, and it shows. Its contents still use the “three lines of defense” heading that the 8th edition reframed.
Who it suits: engineers who need GRC explained before they can study for the exam. Leave it on the shelf if you already work in risk, because the primer chapters will cover ground you know. Around $45 to $60.
Risk analysis depth: Measuring and Managing Information Risk, Second Edition
This is not an exam book. Jack Jones and Jack Freund wrote the reference book on FAIR, the Factor Analysis of Information Risk model that Jones created, and the second edition came out in December 2025.
It earns a place because of the weights. Risk Assessment and Risk Response and Reporting make up 54% of the exam, and both expect you to understand how risk gets analyzed and reported, not just named. Exam books cover risk analysis methods in a chapter. FAIR spends a whole book showing how a loss scenario breaks into frequency and magnitude, and why that beats a gut feel score. The first edition from 2014 is still listed, so make sure the cover says second edition.
Best for: candidates who want the analysis domains to make sense rather than just stick. Pass on it if your exam is weeks away. It is career reading, not cramming. Around $40 to $60, and stock has been thin.
Risk measurement on the job: How to Measure Anything in Cybersecurity Risk, Second Edition
Douglas Hubbard and Richard Seiersen’s second edition came out in April 2023. It is a widely cited book on putting numbers on security risk.
Read it with one warning in mind. Hubbard argues hard against the qualitative heat map, the red, amber, and green risk matrix. CRISC answers often follow ISACA’s more traditional framing, so do not answer an exam question from this book. Read it for the job after the exam, when a board wants a number and a register full of “high” ratings won’t do. It also has a foreword by Jack Jones, so it pairs naturally with the FAIR book.
Read it if you are building or defending a risk register. Pass on it if you want exam prep only. Around $35 to $60. The Failure of Risk Management by Hubbard alone covers enterprise risk thinking in the same spirit. It is a reasonable third read if this one clicks.
CRISC editions to avoid, and where the questions really are
Several older CRISC titles are still sold new on Amazon. Most of them do not show the job practice year where you would notice it.
- CRISC Official Review Manual, 7th Edition Revised (2023). Still sold new at around $108, which is not far below the 8th edition. It teaches the 2021 job practice, and ISACA took it off sale on 3 September 2025. Saving $15 here gets you the wrong edition.
- CRISC Review Manual, 7th Edition (2021). The original 2021 printing, now mostly sold by third parties. Same old job practice.
- CRISC All-in-One, First Edition (2015). Two job practices behind, and often priced above the second edition.
- CRISC Review Questions, Answers and Explanations Manual, 5th Edition (2017). The last printed question manual. It predates the 2021 job practice.
- Self-published “CRISC 2026” study guides. Many have no established publisher and no author track record. Look for a named imprint before you buy one.
That last printed manual matters, because ISACA no longer sells a print question book for CRISC. The official question bank is the CRISC Review Questions, Answers and Explanations Database, 8th Edition. It is a six month online subscription with 833 questions, up from 766 in the previous database, and ISACA sells it directly, not through Amazon. If you are paying for one official product beyond a book, this is the one that tests you in ISACA’s own question style.
A word on the “CRISC review manual PDF” searches. ISACA sells the 8th edition as an official eBook through its store. Free PDFs of the current manual circulating online are pirated copies.
Split your CRISC study time by the weights
The weights tell you where the hours should go. A budget of 100 study hours makes the split easy to read, because each weight becomes its hours. Scale it up or down to your own total.
| Domain | Weight | Hours of 100 | Lean on |
|---|---|---|---|
| Risk Response and Reporting | 32% | 32 | Sybex, Review Manual chapter 3, FAIR for metrics |
| Governance | 26% | 26 | Review Manual chapter 1 for ISACA’s terms |
| Risk Assessment | 22% | 22 | Sybex, then FAIR on analysis methods |
| Technology and Security | 20% | 20 | Review Manual for the new AI and zero trust sections |
Work through it in three passes:
- Read each domain in the Sybex guide first, so the ideas make sense before the formal wording hits.
- Read the matching Review Manual chapter next, and note every term ISACA defines differently from how your workplace uses it.
- Drill questions last. Use the Sybex practice exams, then the official database if you bought it. In the final week, run at least one full 150 question set in four hours, which is 1.6 minutes per question.
Keep a running list of every question you miss. Tag each one by domain. If the misses cluster in Domain 3, go back to it first. It’s worth 48 questions, more than any other domain.
For the certs around CRISC, see the CISM study books and the CISSP study guides. If you are coming from the analyst side, our CySA+ book picks cover that exam. For reading beyond any exam, there is a broader list of cybersecurity books worth reading.
