Validates knowledge of authorizing and maintaining secure systems, including scoping, control selection, implementation, assessment and ongoing compliance.
A good CGRC course teaches the seven domains and the NIST Risk Management Framework steps, including who is responsible for each task. We compared the official ISC2 course, a video course, the RMF source document and flash cards on coverage, format and price.
Most people should start with Cyvitrix's Udemy course and read NIST SP 800-37 alongside it. Choose ISC2's online course for the official eTextbook and assessments, and use ISC2's flash cards for terminology drills.
| Course | Best for | Format | Price |
|---|---|---|---|
 Build Security Authorization Skills | CGRC - Complete Course | Low-cost video course | Video | $20 |
 NIST SP 800-37 Rev. 2: Risk Management Framework | Free source document | Book | Free |
 CGRC Flash Cards | Free terminology cards | Interactive | Free |
ISC2's official course for the seven domains adapts to your assessment results. It includes the official eTextbook, a study questions eBook, domain quizzes and flashcards. If you fail your first attempt, you can retake the training free within a year.
Great fit if you want the official materials organized around the outline
Poor fit if you want a low-cost video course; choose Cyvitrix
About 14 hours of video in 92 lectures cover GRC foundations, governance and risk, then each NIST RMF step from categorize to monitor. It includes one practice test, 24 articles and NIST references.
Great fit if you want an inexpensive video course built around the RMF steps
Poor fit if you want ISC2's official eTextbook and assessments; choose the ISC2 course
NIST's Special Publication 800-37 Revision 2 is the source document for the RMF steps, tasks and roles that much of the exam is built on. It is a free PDF that works best read alongside a video course.
Great fit if you want to learn RMF roles and tasks from the source
Poor fit if you want ISO or COBIT coverage too; choose Cyvitrix's course
ISC2's official terminology cards for quick review between study sessions. They are free with a short registration form. They help you memorize terms but do not teach the material, so use them after a course.
Great fit if you want short terminology drills
Poor fit if you need scenario practice; use a question bank such as Pocket Prep
For most people, Cyvitrix's Udemy course with NIST SP 800-37, which covers the RMF steps for about $20. ISC2's online course is the official option.
Free resources cover part of it: NIST SP 800-37 explains the RMF, and ISC2 offers free flash cards and a 10-question knowledge check. Add a video course and practice questions for full coverage.
Cyvitrix's course runs about 14 hours of video. Plan for about 80 hours of preparation in total, from 50 to 120 depending on your RMF experience.
No. You need two years in a CGRC domain to become certified, but you can pass the exam first and become an Associate of ISC2.