CGRC (Certified in Governance, Risk and Compliance)
The CGRC covers security risk management for information system authorization, from scoping a system and selecting controls to assessment and ongoing compliance. ISC2 aims it at practitioners responsible for risk management, governance and regulatory alignment.
Exam Details
Fixed-length English exam with multiple choice and advanced item types at Pearson VUE test centers.
Standard registration in the Americas, Asia Pacific, Middle East and Africa. ISC2 also lists EUR 575.04 for EMEA and GBP 485.19 for the UK. Currency and taxes depend on the exam location.
Requirements and Renewal
Prerequisites
Two years of cumulative work experience in one or more of the seven CGRC domains. A passing candidate without it can become an Associate of ISC2 and has three years to earn the experience.
Renewal
60 CPE credits per three-year cycle (45 Group A, 15 Group A or B) and a U.S. $135 annual maintenance fee.
Current Version
CGRC Exam Outline effective June 15, 2024, in effect since Jun 15, 2024.
Exam Domains
7 domains| Domain | Weight |
|---|---|
| Security and Privacy Governance, Risk Management, and Compliance Program | 16% |
| Scope of the System | 10% |
| Selection and Approval of Framework, Security, and Privacy Controls | 14% |
| Implementation of Security and Privacy Controls | 17% |
| Assessment/Audit of Security and Privacy Controls | 16% |
| System Compliance | 14% |
| Compliance Maintenance | 13% |
DoD 8140 Work Roles
5 work rolesThe DoD 8140 Qualification Matrix V2.1 lists CGRC as a foundational qualification option for these DoD Cyber Workforce Framework work roles, up to the proficiency level shown. Lower levels of the same work role are also covered.
Certification Lists
Related Tool Categories
Frequently Asked Questions
What was the CGRC called before?→
It was the Certified Authorization Professional (CAP). ISC2 announced the new name, Certified in Governance, Risk and Compliance (CGRC), on February 16, 2023, and stated that the exam outline and domains were not affected by the change.
How much experience does the CGRC require?→
Two years of cumulative work experience in at least one of the seven CGRC domains.
How many questions are on the CGRC exam?→
The exam has 125 items and a 3-hour limit. The passing grade is 700 out of 1000 points.
How much does the CGRC exam cost?→
ISC2 lists standard registration at U.S. $599 in the Americas and Asia Pacific, EUR 575.04 in EMEA and GBP 485.19 in the UK.
Sources
- CGRC - Certified in Governance, Risk and Compliance
- CGRC Certification Exam Outline
- CAP Is Now Certified in Governance, Risk and Compliance (CGRC)
- ISC2 Cybersecurity Certifications
- ISC2 Exam Pricing
- ISC2 Member Policies (CPE requirements)
- ISC2 Annual Maintenance Fees (AMF)
- Become an Associate of ISC2
- ISC2 Certification Maintenance Handbook
Exam details are checked against official ISC2 pages. Fees, exam versions, and renewal rules change; confirm with ISC2 before registering. CGRC is a trademark of its owner. This site is not affiliated with or endorsed by ISC2.