Overview
CGRC: Certified in Governance, Risk and Compliance is a ISC2 credential. Prepare for the ISC2 CGRC exam with training across all seven domains, from system scoping to authorization and compliance maintenance. This PathKey™ guide summarizes the domains, format, cost signals, eligibility, and renewal pattern so you can decide before you book. Accumentum is an Army CA and Air Force COOL Approved Vendor. We teach preparation for the ISC2 exam. ISC2 sets exam content, fees, and policies.
Accumentum is an Army CA and Air Force COOL Approved Vendor. We teach preparation for the ISC2 exam. ISC2 sets exam content, fees, and policies.
Who it is for
- Information security practitioners who support system authorization and Assessment and Authorization (A&A) activity.
- Information system security officers, compliance officers, and risk analysts working with NIST RMF, FedRAMP, or CMMC.
- Auditors and assessors who evaluate security and privacy controls.
Exam domains
Weights follow the official outline.
- 01
Security and Privacy Governance, Risk Management, and Compliance Program
Apply principles of governance, risk management, and compliance using national and international frameworks such as NIST, COBIT, and ISO/IEC, Connect the system development life cycle and the information lifecycle to security and privacy requirements, and Establish a compliance program and define roles and responsibilities for compliance activities.
- 02
Scope of the System
Document the system name, scope, purpose, and functionality, Identify the information types the system processes, stores, or transmits, and Set security objectives for each information type and determine the risk impact level for the system.
- 03
Selection and Approval of Framework, Security, and Privacy Controls
Determine applicable baseline and inherited controls, Tailor controls with enhancements, overlays, and mitigating controls, and Document control selection, plan a continued compliance strategy, and secure stakeholder agreement on control allocation.
- 04
Implementation of Security and Privacy Controls
Develop an implementation strategy that covers resourcing, funding, timeline, and effectiveness, Implement selected controls, including compensating or alternate controls, and Document control implementation and residual risk using tools such as the POA&M and risk register.
- 05
Assessment/Audit of Security and Privacy Controls
Prepare the assessment or audit plan, including scope, schedule, methods, and evidence, Conduct assessments using interview, examine, and test methods, and Prepare initial and final assessment reports, assign risk responses, and develop a risk response plan.
- 06
System Compliance
Compile, review, and submit the security and privacy documentation needed for a compliance decision, Determine system risk posture, residual risk, and risk acceptance criteria, and Document the compliance decision and share formal notification with stakeholders.
- 07
Compliance Maintenance
Perform system change management with documented approval and rollback plans, Carry out ongoing compliance activities, monitoring, incident response, and awareness training, and Support audits and decommission systems when applicable.
Exam format and cost
- Questions
- Confirm on the vendor site
- Duration
- Confirm on the vendor site
- Format
- Multiple choice and related item types (confirm on the vendor outline)
- Passing score
- Confirm the passing score on the vendor site
- Cost
- Confirm the current exam fee on the vendor site before you register
- Delivery
- Pearson VUE test center or online where the vendor offers it
- Languages
- Confirm available languages on the vendor site
Experience and eligibility
ISC2 requires a minimum of two years cumulative work experience in one or more of the seven domains of the CGRC CBK. Candidates without the required experience can become an Associate of ISC2 by passing the CGRC exam and then have three years to earn the required experience.
Renewal
Renewal rules for CGRC: Certified in Governance, Risk and Compliance are set by ISC2. Many credentials use a multi-year cycle with continuing education, a renewal fee, or a newer exam. Confirm the current cycle on the vendor site.
Roles this credential fits
- Security and privacy governance, system scoping, control selection and implementation, assessment and audit, system compliance, and compliance maintenance.
- Governance and Risk
- Teams standardizing on this credential for hiring or compliance
CGRC questions
Is CGRC worth it?
CGRC is worth it when employers or contracts in your market ask for ISC2 proof, or when the domains match work you already do or want next. Common roles include Security and privacy governance, system scoping, control selection and implementation, assessment and audit, system compliance, and compliance maintenance., Governance and Risk, and Teams standardizing on this credential for hiring or compliance. Read the roles and domains on this page, then decide against your timeline and budget.
How hard is CGRC?
You get Confirm on the vendor site in Confirm on the vendor site. Format: Multiple choice and related item types (confirm on the vendor outline). Passing score: Confirm the passing score on the vendor site. Delivery: Pearson VUE test center or online where the vendor offers it. ISC2 requires a minimum of two years cumulative work experience in one or more of the seven domains of the CGRC CBK. People who pass usually mix domain study with timed practice, not reading alone.
Does CGRC expire?
Renewal rules for CGRC: Certified in Governance, Risk and Compliance are set by ISC2. Many credentials use a multi-year cycle with continuing education, a renewal fee, or a newer exam. Confirm the current cycle on the vendor site.
How does Accumentum help with CGRC?
We offer Expert-led training mapped to the CGRC domains, PathPay® payment options, PathPass™ practice where the exam is in our catalog, a free ReadyScore™ so you can see where you stand before class, and military funding support where you qualify. We are an Army CA and Air Force COOL Approved Vendor. Our pass rate across Accumentum certification attempts since August 2022 is 98.8% (2,412 certified of about 2,441 attempts).
How much does the CGRC exam cost?
Published pricing for CGRC: Confirm the current exam fee on the vendor site before you register. Vendors change voucher prices without notice, so confirm on the official store before you buy. PathPay® can spread Accumentum course tuition when you train with us.
What are the CGRC prerequisites?
ISC2 requires a minimum of two years cumulative work experience in one or more of the seven domains of the CGRC CBK. Candidates without the required experience can become an Associate of ISC2 by passing the CGRC exam and then have three years to earn the required experience.
What should I take after CGRC?
After CGRC, pick the next credential that matches the job you want, not a generic ladder. Use the roles on this page and neighboring PathKey™ guides from the same vendor to plan the sequence. If you need a readiness check first, start with ReadyScore™ when we offer one for this exam.
Official sources
Always confirm fees, dates, and eligibility on the vendor site before you register. Vendors change outlines and prices without notice.