2 years in a CGRC domain
RequiredCumulative, full-time paid work in one or more of the seven domains. Part-time work and internships can count. Experience is checked through endorsement after you pass.
Certified in Governance, Risk and Compliance (CGRC) Exam Guide
Validates knowledge of authorizing and maintaining secure systems, including scoping, control selection, implementation, assessment and ongoing compliance.
CGRC tests whether you can take a system through authorization and keep it compliant: define its scope, choose and tailor controls, oversee implementation and assessment, decide on risk and maintain compliance through change. Learn the NIST RMF steps and who owns each task, then practise choosing the best of several plausible answers.
Understand the exam
Syllabus
1Security and privacy governance, risk management, and compliance program16%
- 1.1Demonstrate knowledge in security and privacy governance, risk management, and compliance program
- 1.2Demonstrate knowledge in security and privacy governance, risk management and compliance program processes
- 1.3Demonstrate knowledge of compliance frameworks, regulations, privacy, and security requirements
2Scope of the system10%
- 2.1Describe the system
- 2.2Determine security compliance required
Example scenario: A new HR system shares data with a payroll provider. What belongs inside the authorization boundary, and how would you categorize it?
3Selection and approval of framework, security, and privacy controls14%
- 3.1Identify and document baseline and inherited controls
- 3.2Select and tailor controls
Example scenario: Your system runs on a cloud platform that already holds an authorization. Which controls can you inherit, and what must you still document?
4Implementation of security and privacy controls17%
- 4.1Develop implementation strategy
- 4.2Implement selected controls
- 4.3Document control implementation
5Assessment/audit of security and privacy controls16%
- 5.1Prepare for assessment/audit
- 5.2Conduct assessment/audit
- 5.3Prepare the initial assessment/audit report
- 5.4Review initial assessment/audit report and plan risk response actions
- 5.5Develop final assessment/audit report
- 5.6Develop risk response plan
Example scenario: An assessor finds two controls only partly implemented a month before the authorization decision. What goes into the report and the remediation plan?
6System compliance14%
- 6.1Review and submit security/privacy documents
- 6.2Determine system risk posture
- 6.3Document system compliance
7Compliance maintenance13%
- 7.1Perform system change management
- 7.2Perform ongoing compliance activities based on requirements
- 7.3Engage in audits activities based on compliance requirements
- 7.4Decommission system when applicable
Official CGRC exam outline · Effective June 15, 2024
Format
- Questions
- 125
- Duration
- 3h
- Passing score
- 700 / 1000
- Delivery
- Test centre
- Languages
- English
Question types
Choose the single best answer from the listed options; one is correct and the others are distractors.
CertUp example
A new system will process employee health data. What should the team do first to choose the right security and privacy controls?
Show answer
Categorize the system by impact. The impact level decides which baseline controls apply, so it comes before selecting controls.
Drag each item to its correct position or category; the item counts only when every placement is right.
CertUp example
Drag each risk management activity into the order it normally happens for a new system.
Show answer
Categorize, select, implement, assess, authorize, monitor. Each activity depends on the output of the one before it.
Click the area of a diagram, table or screen that answers the question; there are no written options.
CertUp example
A system boundary diagram shows an HR application, a payroll provider's API, a cloud hosting platform that already holds its own authorization, and a public website. Click the component whose security controls your system can inherit.
Show answer
The cloud hosting platform. Controls covered by its existing authorization are inherited, so you document them rather than implement them again.
Eligibility and booking
Create an ISC2 account, buy the exam and schedule with Pearson VUE. After passing, submit your endorsement and pay the first annual fee.
Make a study plan
Map your RMF and compliance work to the seven domains first. Learn who is responsible for each RMF task before going deep on controls.
Most candidates spend 50–120 hours. Plan for the low end if you already work in GRC or authorization and know NIST RMF; plan for the high end if RMF or the risk standards are new to you.
- 1Understand the examRead the syllabus and format, check you’re eligible and pick a target date.4 h
- 3Learn the core conceptsWork through one main course or book, topic by topic.48 h
- 4Practice with mock examsTake timed practice tests and review every mistake.24 h
- 5Prepare for exam dayBook the exam and check the ID and delivery rules.4 h
Learn the core concepts
Use one main course and the NIST RMF publication as your core. Skim the control catalogs to understand families and selection rather than memorizing them.
Best official courseCGRC Online Self-Paced Training
Best paid video courseBuild Security Authorization Skills | CGRC - Complete Course
Best free referenceNIST SP 800-37 Rev. 2: Risk Management FrameworkKnow who does what. Many questions ask who is primarily responsible for an RMF task. Learn it both ways: from role to task and from task to role.
Practice with mock exams
Use a question bank to find weak domains, and check that you can explain why the best answer is better than the other plausible options.
See all 3 CGRC practice tests →
Are you ready?
- You can walk through the RMF steps and name the role responsible for each task.
- You can explain how controls are selected, tailored, inherited and assessed.
- You can finish 125 questions in three hours at a steady pace.
Prepare for exam day
CGRC is taken at a Pearson VUE test centre.
- Bring the accepted identification listed in your Pearson VUE confirmation, with a name that matches your booking.
- Arrive early for check-in and security checks, including palm-vein scanning where used.
- Pace yourself at under a minute and a half per question across 125 questions. Breaks use your exam time.
- Collect your provisional result, then follow ISC2’s instructions for endorsement or Associate status.
Advice from exam takers
Learn RMF roles in both directions.
Passers say a large share of questions test who is primarily responsible for an RMF task under SP 800-37.
Include ISO terminology.
One passer said ISO 31000 and 27001 language, such as “interested party” for stakeholder, appeared often enough that a NIST-only focus cost points.
Combine sources.
Candidates note there is less CGRC material than for CISSP and combine the official training with NIST documents, community notes and more than one question bank.