CRISC CPE Requirements Explained: 20 Hours a Year, 120 Over Three Years and the 2027 Changes

The CRISC CPE requirements are at least 20 CPE hours every year and at least 120 over your three-year reporting period, plus an annual maintenance fee to ISACA. From January 1, 2027, at least 90 of those 120 hours must align with the CRISC exam content outline, and up to 30 can come from broader professional development, according to ISACA’s CPE 2027 page.

Two details are easy to miss. ISACA’s CPE hour is 50 minutes, not 60, and from 2027 every hour you log needs a label: aligned with CRISC or professional. The rules below come from ISACA’s own pages as of November 1, 2026.

The CRISC requirement at a glance

From ISACA’s Maintain CRISC Certification page and its CPE Policy (PDF):

• Every year: report at least 20 CPE hours that map to the CRISC exam content outline (ECO).
• Every three years: report at least 120 CPE hours.
• Annual maintenance fee: US$45 for ISACA members, US$85 for non-members. Once you hold more than two ISACA certifications, the third and later cost US$25 for members and US$50 for non-members.
• Deadline: the policy says fee payment and CPE reporting are due by December 31.
• Audit: comply with the annual CPE audit if you are selected.

The annual reporting period starts on January 1. Your three-year period varies, and ISACA shows it on your annual invoice and compliance letter. If you are newly certified, reporting starts on January 1 of the following year, although hours earned between your certification date and December 31 can be reported in that first period.

What changes on January 1, 2027

The 120-hour total stays the same. What changes is the split:

• At least 90 hours must align with the ECO of the certification you are renewing. You can still make all 120 aligned.
• Up to 30 hours can come from other professional development, such as leadership, soft skills, volunteering or mentoring.
• Vendor sales or marketing demos no longer qualify. Vendor presentations that are case studies still can.
• ISACA volunteer work is split into ECO-aligned and non-aligned groups, each with its own limit.

ISACA says no system changes happen in the 2026 cycle and the audit process stays the same. If your three-year period runs into 2027, plan the hours you still need under the new split.

What counts as CRISC-aligned

The CRISC certification page lists four domains: Corporate IT Governance, Risk Assessment, Risk Response & Reporting, and Technology and Security. If an audit asks why an hour is aligned, the agenda should show which domain it covers.

These can count as aligned when the content fits those domains:

• A course or webinar on IT risk assessment, risk registers or control monitoring.
• An ISACA conference or virtual summit. ISACA says it will award all ISACA conference CPE as ECO-aligned; other conferences depend on the session topics.
• Teaching, presenting or publishing on risk response and reporting.
• Passing a related professional exam, at two CPE hours per exam hour, if the exam aligns with the CRISC ECO.

ISACA’s own examples of professional, not aligned, CPE: a communication skills class, mentoring a young professional, serving as a chapter officer and attending leadership conferences.

Some activities don’t count at all. ISACA’s How to Earn CPE page says on-the-job activities don’t qualify unless they fall into a qualifying category, and basic office software training such as Word or Excel doesn’t qualify. The policy also says blog writing is not eligible.

How ISACA counts an hour

ISACA’s CPE hour is 50 minutes, not 60. The policy says one CPE hour is earned for every 50 minutes of active participation, excluding lunches and breaks, reported in quarter hours.

Worked example: a two-day risk conference with 6.5 hours of sessions each day is 780 minutes. Divide by 50 and you get 15.6, which rounds to the nearest quarter hour: 15.5 CPE hours toward CRISC. ISC2 typically credits one CPE per hour, so the same sessions would usually be about 13 CPE toward a CISSP (see our ISC2 CPE guide). Same event, two different numbers.

Other rules from the policy: university courses earn 15 CPE hours per semester credit hour or 10 per quarter credit hour; a presentation earns five times the presentation time for the first and second delivery, and nothing after that; and a self-study course needs a completion certificate from the provider that states the CPE hours.

Limits to watch

Activity (2027 policy)	Limit
ISACA and non-ISACA professional education, teaching, publishing, exam item writing, related exams	No limit
ISACA volunteer group aligned with the ECO	20 hours a year per certification (60 per cycle)
ISACA volunteer group not aligned with the ECO	20 hours a year per certification (30 per cycle)
Contributions to the profession	20 hours a year in total
Mentoring or being mentored	10 hours a year, and it can’t be applied to multiple certifications

A three-year CRISC plan you can copy

The 20-hour minimum is a floor, not a pace. Twenty a year gets you to 60, half of what you need. A steadier plan:

1. Year 1: report at least 20 aligned hours by December 31, aiming for 40. Pay the maintenance fee.
2. Year 2: reach about 80 in total. Count how many of your hours are professional.
3. Year 3: reach 120, with at least 90 aligned and no more than 30 professional. Report and pay by December 31.

For each activity, record the date, the provider, the title, a short description, the minutes of active participation, the CPE hours, and whether it is aligned or professional. From 2027, that last column decides whether an hour can count toward your 90.

Keep your proof too. ISACA’s Maintain CRISC page says to keep documentation for 12 months after the end of each three-year cycle, while the revised policy PDF says a minimum of three years. Keep it until both periods have passed.

Tracking CRISC alongside other certifications

If you also hold CISM or CISA, the same hours can count toward each one when the activity maps to each ECO (see our CISM and CISA CPE guide). MyCertRenewal has ISACA credit rules built for CISA, CISM and CRISC, as well as ISC2, CompTIA and EC-Council (see supported certifications). You log an activity once and see where it can count toward each certification you hold, each by its own certifying body’s rules. You still report hours in MyISACA yourself, and ISACA decides what it accepts. See how it works. You attach the certificate to the activity once, and every claim it supports uses the same file (see audit-ready evidence).

If you hold CRISC and want one place to see what is left before each renewal, Start free. The Free plan covers one person and up to 2 certifications, with no card needed.

Frequently asked questions

Certification rules change. Always confirm current requirements with the certifying body. MyCertRenewal is not affiliated with ISACA or ISC2.