Certified in Governance, Risk and Compliance credential artwork

Certified in Governance, Risk and Compliance (CGRC)

Validates knowledge of authorizing and maintaining secure systems, including scoping, control selection, implementation, assessment and ongoing compliance.

Summary

CGRC, formerly CAP, is ISC2's credential for governance, risk and compliance work built around system authorization under the NIST Risk Management Framework. It covers scoping a system, selecting and assessing controls and keeping it compliant, and is most valued in US federal and defense work.

Good fit if

  • You work on system authorization, ATO packages or continuous monitoring
  • You support federal, defense or FedRAMP programs that ask for CGRC
  • You want to formalize GRC work you already do

Look elsewhere if

  • You work in private-sector IT risk: CRISC
  • Your focus is IT audit: CISA
  • You want a broad senior security credential: CISSP

Salary & jobs

Prerequisites

Experience required for certification

2 years in a CGRC domain

Required

Cumulative, full-time paid work in one or more of the seven domains. Part-time work and internships can count. Experience is checked through endorsement after you pass.

You can sit the exam first. Without the experience you become an Associate of ISC2 and have three years to earn it. After passing, submit your endorsement within nine months.

Cost

USD · US exam pricing · new ISC2 member
$599
$135
The $135 annual fee recurs and covers all your ISC2 certifications, so a current ISC2 member pays no extra. Rescheduling costs $50 and cancelling $100. Each retake is charged at the full exam fee.

What holders say

Renewal

CGRC renews every three years through continuing education and an annual fee.

Renewal cycle
3 years
Continuing education
60 CPE credits
Maintenance fee
$135 / year USD

At least 45 credits must be Group A, related to the CGRC domains; the other 15 can be Group A or professional-development Group B. One annual fee covers every ISC2 certification you hold.

ISC2 member policies ↗

Alternatives

Certified in Risk and Information Systems Control credential artwork
Certified in Risk and Information Systems Control (CRISC)$810 required · Advanced

IT risk management, more widely recognized in the private sector.

Certified Information Systems Auditor credential artwork
Certified Information Systems Auditor (CISA)$810 required · Advanced

IT audit and assurance.

Certified Information Systems Security Professional credential artwork
Certified Information Systems Security Professional (CISSP)$884 required · Advanced

Broad senior security credential across eight domains.

FAQ

What was CGRC called before?

Certified Authorization Professional (CAP). ISC2 renamed it CGRC on February 15, 2023, and existing CAP holders became CGRC holders.

How much experience do you need for CGRC?

Two years of paid work in one or more of the seven domains. You can take the exam first and become an Associate of ISC2, with three years to earn the experience.

How much does CGRC cost?

The exam is $599 in the US. After endorsement, the first $135 annual fee completes certification.

CGRC or CRISC?

CGRC follows NIST RMF and suits US federal and defense authorization work. CRISC is ISACA’s broader IT risk credential and is more widely recognized in private-sector GRC.

Is the CGRC exam adaptive?

No. Everyone answers 125 questions in up to three hours, scored on a 700-of-1,000 scale.

Last updated October 2026