CIS – Risk and Compliance (CIS-RC)

Domain 1: GRC Overview — 11.67%

Governance, Risk, and Compliance creates a common structure for managing obligations, policies, risks, controls, issues, and evidence.

You’ll need to understand the major applications, core terminology, record relationships, personas, and the difference between governance intent and operational execution. The key idea is traceability: an authority source informs a policy, a policy maps to control objectives or controls, controls apply to scoped entities, and assessment results can create issues or risk decisions. Don’t memorize record names in isolation. Understand why each object exists and how information moves between them. A well-designed GRC framework reduces duplicate assessments and gives leadership a consistent view of exposure across the organization.

Domain 2: Implementation Planning — 5%

Implementation planning prevents a technically correct build from becoming an unusable governance program.

You’ll need to define business use cases, stakeholders, personas, groups, roles, data owners, integrations, prerequisites, and rollout phases before configuring workflows. The main challenge is translating governance language into records and responsibilities that people can realistically maintain. Don’t load every policy, regulation, control, and entity on day one. Start with a manageable scope, clear success measures, and dependable source data. Each implementation decision should answer four questions: who provides the input, who owns the record, what output is expected, and how exceptions are handled. Good planning makes later automation and reporting far more reliable.

Domain 3: Entity Framework — 20%

The entity framework defines what the organization is actually assessing. Get that wrong and every control test, risk score, and dashboard downstream becomes questionable.

You’ll work with entity types, entity classes, entities, filters, ownership, scoping, and the methods used to generate and maintain entity populations. Common failures include duplicate entities, filters that include the wrong records, owners who are no longer responsible, and scopes so broad that remediation becomes impossible. Know how entities are created and refreshed, not just how to open one. The goal is repeatable scope. A mature program should identify the correct business objects automatically and explain why each one belongs in a given assessment or risk process.

Domain 4: Policy and Compliance — 25%

Policy and Compliance is one of the largest exam areas, so expect questions about both lifecycle and record relationships.

You’ll need to distinguish authority documents, citations, policies, policy statements, control objectives, controls, indicators, attestations, and compliance assessments. These records are related, but they aren’t interchangeable. Study policy creation and publication, control assignment, evidence collection, testing, assessment activity, issue generation, and supporting workflows. Pay close attention to which record defines the requirement and which record proves whether the requirement is being met. Follow the chain from external obligation to internal policy, scoped control execution, collected evidence, and remediation. Strong compliance management turns failed controls into accountable work instead of forgotten reports.

Domain 5: Risk and Advanced Risk — 25%

Risk management turns uncertain events into governed decisions using consistent methods for likelihood, impact, exposure, ownership, and response.

You’ll need to understand risk statements, methodologies, assessment types, scoring, controls, indicators, treatment plans, and the difference between inherent and residual risk. Risk should be connected to entities, controls, issues, and business context rather than managed as a standalone number. Don’t confuse a failed control with the risk itself. A control failure is evidence about protection, while the risk describes the potential business harm and uncertainty. Study assessment generation, response strategies such as mitigate, accept, avoid, or transfer, and how advanced capabilities support aggregation and continuous monitoring across the enterprise.

Domain 6: Common Elements & Extended Capabilities — 8.33%

Extended capabilities connect the core GRC data model with external content, integrations, monitoring, notifications, reporting, and broader platform workflows.

You’ll encounter content packs, regulatory change, imported authority sources, indicators, continuous monitoring, dashboards, notifications, and shared platform features. The challenge is preserving data lineage while automation scales. Imported content isn’t automatically applicable just because it came from a trusted provider. Validate mappings, scope, ownership, update behavior, and the effects on existing policies and controls. Keep integrations modular so a changed regulation or source system doesn’t require rebuilding the entire program. A clean design brings in authoritative information, maps it correctly, generates the right work, and routes exceptions to accountable owners.

Domain 7: Audit and Advanced Audit — 5%

Audit is a smaller domain, but the workflow is structured enough to make these points manageable.

You’ll need to understand audit engagements, audit tasks, control testing, evidence requests, stakeholders, findings, issues, and the differences introduced by advanced audit capabilities. Audits break down when evidence arrives through scattered email threads, test criteria change during fieldwork, or findings have no assigned owner. Follow the engagement from planning through fieldwork, review, reporting, remediation, and closure. Don’t confuse an audit finding with a control, policy exception, risk, or issue. They may be related, but each serves a different purpose. The goal is defensible evidence and a clear trail from audit objective to remediation.