Domain 1: Governance
Organizational Governance
- Strategy, Goals, and Objectives
- Organizational Structure, Roles, and Responsibilities
- Organizational Culture and Ethics
- Policies and Standards
- Business Processes and Resilience (e.g., DRP, BCP)
- Organizational Asset Management
Risk Governance
- Enterprise Risk Management (ERM)
- Lines of Defense
- Risk Profile
- Risk Appetite and Risk Tolerance
- Risk Frameworks, Legal, Regulatory, and
- Contractual Requirements
Domain 2: Risk Assessment
Risk Identification
- Threat Modeling and Threat Landscape
- Vulnerability Management
- Risk Scenario Development and Evaluation
Risk Analysis
- Risk Assessment Concepts and Standards
- Business Impact Analysis (BIA)
- Risk Register
- Risk Analysis Methodologies
- Inherent and Residual Risk
Domain 3: Risk Response and Reporting
Risk Response
- Risk Response Options
- Risk and Control Ownership
- Vendor/Supply Chain Risk Management
- Issues, Findings, Exceptions and Exemptions Management
Control Design and Implementation
- Control Frameworks, Types, and Standards
- Control Design, Selection, Implementation, and Analysis
- Control Testing Methodologies
Risk Monitoring and Reporting
- Risk Action Plans
- Data Collection, Aggregation, Analysis, and Validation
- Risk and Control Metrics (e.g., KRIs, KCIs, KPIs)
- Risk and Control Monitoring Techniques
- Risk and Control Reporting Techniques (e.g., heatmap, scorecards, dashboards)
- Monitoring and Reporting of Emerging Risks
Domain 4: Technology and Security
Technology Principles
- Technology Roadmaps and Enterprise Architecture (EA)
- Operations Management (e.g., change management, assets, DevOps, problems, incidents)
- System Development Life Cycle (SDLC)
- Data Lifecycle Management
- Portfolio and Project Management (e.g. Agile)
- Technology Resilience and Disaster Response/ Recovery
- Emerging Technologies
Information Security Principles
- Security Concepts, Frameworks, and Standards
- Security/Risk Awareness and Training
- Data Privacy and Data Protection Principles