Governance, Risk and Audit Program. Audit it, measure the risk, get it authorized.
Expert-led instruction
Why this path
Three certs for the people who sign off
CISA proves you can audit systems and controls. CRISC proves you can identify and manage IT risk. CGRC proves you can take a system through authorization using frameworks like the NIST Risk Management Framework.
Audit
CISA is ISACA's cert for IT auditors, covering the audit process, governance, systems, operations and asset protection.
Risk
CRISC covers governance, risk assessment, risk response and reporting, and technology and security controls.
Authorization
CGRC covers the risk management program and authorizing and monitoring systems, the core of RMF work.
Sources: ISACA and ISC2 certification pages, checked October 2026.
Pathway map
Your three steps to Governance, Risk and Audit
Take the full program or start at the step that fits what you already know. Each course also stands on its own.
Step 1: Audit systems and controls
ISACA CISA (CISA)
You can plan and run an IT audit. The audit process, IT governance, systems acquisition and development, operations and resilience, and protecting information assets.
Roles it opensIT auditor, compliance analyst, internal auditor
The exam150 questions, 240 minutes
Passing score450 (scaled 200 to 800)
Step 2: Manage IT risk
ISACA CRISC (CRISC)
You can find, assess and respond to IT risk and tie it to business goals. Governance, risk assessment, response and reporting, and controls.
Roles it opensIT risk analyst, risk manager, control assessor
The exam150 questions, 240 minutes
Passing score450 (scaled 200 to 800)
Step 3: Authorize and monitor systems
ISC2 CGRC (CGRC)
You can take a system through authorization and keep it compliant. Security and privacy risk programs, categorization, control selection and assessment, and continuous monitoring.
Roles it opensISSO, security control assessor, RMF analyst, GRC lead
The exam125 questions, 180 minutes
Passing score700 of 1,000
Exam facts
The three exams at a glance
| Cert | Exam code | Questions | Time | Passing score |
|---|---|---|---|---|
| CISA | CISA | 150 | 240 minutes | 450 (scaled 200 to 800) |
| CRISC | CRISC | 150 | 240 minutes | 450 (scaled 200 to 800) |
| CGRC | CGRC | 125 | 180 minutes | 700 of 1,000 |
Figures from ISACA and ISC2 exam pages, October 2026. ISACA reports scaled scores from 200 to 800. Confirm details on the vendor sites before you schedule.
DoD 8140
Work roles this pathway supports
These certs are listed for the work roles below under DoDM 8140.03.
Security Control Assessor (612)
CISA and CGRC
Information Systems Security Manager (722)
CGRC
Other risk and governance roles
ISACA lists CRISC in the DoD 8140 schedule. Ask us for the exact role and level.
Sources: ISACA and ISC2 DoD 8140 announcements and the DoD 8140 Foundational Qualification Matrix V2.1, checked October 2026.
Funding
Using military education benefits?
Accumentum is an Army CA and Air Force COOL Approved Vendor. Tell us your branch and we'll show you what applies to each step.
Tell us where you are and we'll map out your pathway
Where to start, how long it should take you and whether funding applies. You'll hear back from a real person, usually within one business day. Prefer email? info@accumentum.net
Thanks, it's in.
We'll reach out shortly with your Governance, Risk and Audit plan. Want to skip ahead? You can register now.
Go to RegistrationFAQ
Questions people ask before they start
Who is this pathway for?
People who audit, assess or approve systems. That includes IT auditors, compliance staff, ISSOs and anyone doing RMF work for a federal agency or contractor.
What experience do these certs require?
ISACA asks for five years of audit, control or security work for CISA and three years of risk work for CRISC. ISC2 asks for two years in CGRC domains. You can pass the exams first and earn the experience after.
Can I take them in a different order?
Yes. Each course stands on its own. If your job is RMF heavy, CGRC first can make sense. We'll help you decide.
Is CGRC the same as the old CAP?
Yes. ISC2 renamed CAP to CGRC in 2023.
Can I use military education benefits?
Yes. Accumentum is an Army CA and Air Force COOL Approved Vendor. Tell us your branch and we'll walk you through what applies to each course in the pathway.
How long does the whole pathway take?
It depends on your experience and test dates. An advisor will map each step to your schedule and work hours.
Ready to own audit and risk?
Tell us where you're starting and we'll build the schedule with you.
CISA and CRISC are trademarks of ISACA. CGRC is a registered mark of ISC2, Inc.