- Apply principles of governance, risk management, and compliance using national and international frameworks such as NIST, COBIT, and ISO/IEC.
- Connect the system development life cycle and the information lifecycle to security and privacy requirements.
- Establish a compliance program and define roles and responsibilities for compliance activities.
- Work with compliance frameworks and laws including FedRAMP, PCI DSS, CMMC, FISMA, HIPAA, and GDPR.
ISC2 Certification Training Course
ISC2 CGRC® Certified in Governance, Risk and Compliance Certification Training Course
Build the governance, risk, and compliance expertise that system authorization depends on with Accumentum’s ISC2 CGRC® Certified in Governance, Risk and Compliance Certification Training Course, developed to help you guide information systems from scoping to authorization and ongoing compliance.
Course focus: Security and privacy governance, system scoping, control selection and implementation, assessment and audit, system compliance, and compliance maintenance.
Course Overview
Master the seven CGRC domains.
The ISC2 CGRC® Certified in Governance, Risk and Compliance Certification Training Course with Accumentum gives you a complete look at the CGRC credential. A CGRC professional advocates for security risk management in pursuit of information system authorization, in line with legal and regulatory requirements. This course covers all seven domains of the current CGRC exam outline, from building a compliance program and defining system scope through control selection, implementation, assessment, authorization, and continuous monitoring. You work with the frameworks named in the outline, including NIST, COBIT, ISO/IEC, FedRAMP, PCI DSS, and CMMC, and you learn how the updated outline brings AI systems into each phase of the Risk Management Framework. You leave ready to sit the CGRC exam and to lead authorization work with confidence.
Course Benefits
Build CGRC certification readiness and real-world capability.
01
Governance and Compliance Programs
Establish a compliance program, apply national and international frameworks, and map regulatory and privacy requirements to your systems.
02
System Scoping and Control Selection
Describe the system, determine the required compliance level, and select and tailor baseline, inherited, and enhanced controls.
03
Implementation and Assessment
Implement and document controls, prepare and conduct assessments, and build risk response plans from findings.
04
Authorization and Continuous Compliance
Assemble authorization packages, determine risk posture, manage change, and keep systems compliant through decommissioning.
Who Should Attend
- Information security practitioners who support system authorization and Assessment and Authorization (A&A) activity.
- Information system security officers, compliance officers, and risk analysts working with NIST RMF, FedRAMP, or CMMC.
- Auditors and assessors who evaluate security and privacy controls.
- Security professionals in government, defense, and regulated industries who want an ISC2 GRC credential.
Prerequisites
- ISC2 requires a minimum of two years cumulative work experience in one or more of the seven domains of the CGRC CBK.
- Candidates without the required experience can become an Associate of ISC2 by passing the CGRC exam and then have three years to earn the required experience.
- Familiarity with risk management frameworks and security control catalogs supports the advanced course topics.
- Willingness to work through documentation-heavy authorization scenarios in preparation for the CGRC exam.
Pathway Map
The CGRC training course spans the seven official ISC2 exam domains.
The curriculum covers Security and Privacy Governance, Risk Management, and Compliance Program (16%), Scope of the System (10%), Selection and Approval of Framework, Security, and Privacy Controls (14%), Implementation of Security and Privacy Controls (17%), Assessment/Audit of Security and Privacy Controls (16%), System Compliance (14%), and Compliance Maintenance (13%).
1
Security and Privacy Governance, Risk Management, and Compliance Program
2
Scope of the System
3
Selection and Approval of Framework, Security, and Privacy Controls
4
Implementation of Security and Privacy Controls
5
Assessment/Audit of Security and Privacy Controls
6
System Compliance
7
Compliance Maintenance
Course Content
- Document the system name, scope, purpose, and functionality.
- Identify the information types the system processes, stores, or transmits.
- Set security objectives for each information type and determine the risk impact level for the system.
- Determine applicable baseline and inherited controls.
- Tailor controls with enhancements, overlays, and mitigating controls.
- Document control selection, plan a continued compliance strategy, and secure stakeholder agreement on control allocation.
- Develop an implementation strategy that covers resourcing, funding, timeline, and effectiveness.
- Implement selected controls, including compensating or alternate controls.
- Document control implementation and residual risk using tools such as the POA&M and risk register.
- Prepare the assessment or audit plan, including scope, schedule, methods, and evidence.
- Conduct assessments using interview, examine, and test methods.
- Prepare initial and final assessment reports, assign risk responses, and develop a risk response plan.
- Compile, review, and submit the security and privacy documentation needed for a compliance decision.
- Determine system risk posture, residual risk, and risk acceptance criteria.
- Document the compliance decision and share formal notification with stakeholders.
- Perform system change management with documented approval and rollback plans.
- Carry out ongoing compliance activities, monitoring, incident response, and awareness training.
- Support audits and decommission systems when applicable.
Course Features
Designed for practical training and CGRC exam preparation.
Interactive Learning
Participate in training sessions, discussions, and applied exercises with experienced instructors.
Comprehensive Study Materials
Access extensive resources, including e-books, video lectures, and practice exams.
Real-World Applications
Engage in practical exercises and case studies to apply CGRC concepts.
Certification Preparation
Receive guidance and tips to successfully prepare for the ISC2 CGRC® Certified in Governance, Risk and Compliance Certification exam.
Certification Exam
Prepare for the official ISC2 CGRC certification exam.
CGRC Exam Readiness
Accumentum’s CGRC Training Course prepares learners to apply the seven CGRC domains in real work and on exam day.
Upon completing the ISC2 CGRC® Certified in Governance, Risk and Compliance Certification Training Course with Accumentum, you will be equipped to pursue the Certified in Governance, Risk and Compliance (CGRC) exam. The official exam is 3 hours, includes 125 items in multiple choice and advanced item types format, and requires a passing grade of 700 out of 1000 points. It is offered in English at Pearson VUE testing centers. CGRC is listed in the DoD 8140 Foundational Qualification Matrix V2.1 (effective September 19, 2025), so it can support qualification for applicable DoD cyber workforce roles. Confirm your work role and proficiency level with your supervisor. CGRC shows that you can carry a system through authorization and keep it compliant, which supports roles in risk management, compliance, and security assessment across government and industry.
Exam Outline
The full CGRC exam outline.
This is the official ISC2 CGRC exam outline: 7 domains and 23 objectives, in ISC2's own wording. Our course maps lessons and practice to each one.
Domain 1: Security and Privacy Governance, Risk Management, and Compliance Program
Average weight 16%
- 1.1 Demonstrate knowledge in security and privacy governance, risk management, and compliance program
- 1.2 Demonstrate knowledge in security and privacy governance, risk management and compliance program processes
- 1.3 Demonstrate knowledge of compliance frameworks, regulations, privacy, and security requirements
Domain 2: Scope of the System
Average weight 10%
- 2.1 Describe the system
- 2.2 Determine security compliance required
Domain 3: Selection and Approval of Framework, Security, and Privacy Controls
Average weight 14%
- 3.1 Identify and document baseline and inherited controls
- 3.2 Select and tailor controls
Domain 4: Implementation of Security and Privacy Controls
Average weight 17%
- 4.1 Develop implementation strategy (for example resourcing, funding, timeline, effectiveness)
- 4.2 Implement selected controls
- 4.3 Document control implementation
Domain 5: Assessment/Audit of Security and Privacy Controls
Average weight 16%
- 5.1 Prepare for assessment/audit
- 5.2 Conduct assessment/audit
- 5.3 Prepare the initial assessment/audit report
- 5.4 Review initial assessment/audit report and plan risk response actions
- 5.5 Develop final assessment/audit report
- 5.6 Develop risk response plan
Domain 6: System Compliance
Average weight 14%
- 6.1 Review and submit security/privacy documents
- 6.2 Determine system risk posture
- 6.3 Document system compliance
Domain 7: Compliance Maintenance
Average weight 13%
- 7.1 Perform system change management
- 7.2 Perform ongoing compliance activities based on requirements
- 7.3 Engage in audits activities based on compliance requirements
- 7.4 Decommission system when applicable
Exam Facts
How the CGRC exam works.
Format
- Length of exam: 3 hours
- Number of items: 125
- Item format: Multiple choice and advanced item types
- Passing grade: 700 out of 1000 points
- Exam language availability: English
Domain weights
- Security and Privacy Governance, Risk Management, and Compliance Program, 16%
- Scope of the System, 10%
- Selection and Approval of Framework, Security, and Privacy Controls, 14%
- Implementation of Security and Privacy Controls, 17%
- Assessment/Audit of Security and Privacy Controls, 16%
- System Compliance, 14%
- Compliance Maintenance, 13%
Requirements
What ISC2 asks of CGRC holders.
ISC2 asks for at least two years of cumulative, full time experience in one or more CGRC domains. Part time work and internships can count. If you pass without the experience, you become an Associate of ISC2 and have three years to earn it.
Once certified, ISC2 requires continuing professional education (CPE) credits and an Annual Maintenance Fee to keep the credential active.
Study Plan
A practical path to CGRC.
We start with the domain map. CGRC has 7 domains, and the heaviest is Implementation of Security and Privacy Controls (17%). It gets the longest blocks and the most practice questions.
Each domain follows the same pattern. We teach the concepts, walk through a scenario, then work questions in the ISC2 style, where more than one answer looks right and you pick the best one for the situation.
Expect advanced item types as well as multiple choice. We practice those formats so the question style isn't new on test day.
The last stretch is review. You take a full length practice exam under the real time limit, then we go back over the domains where you dropped points.
Career Outlook
Where CGRC can take you.
CGRC fits people who run authorization and compliance work. Typical titles include ISSO, ISSM, security control assessor, compliance analyst and GRC analyst. Much of this work sits in federal agencies and the contractors that support them.
The U.S. Bureau of Labor Statistics reports that the median annual wage for information security analysts was $129,180 in May 2025. BLS also projects employment of information security analysts to grow 21 percent from 2025 to 2035, much faster than the average for all occupations. That figure is a national midpoint. Where you live, how long you've been in the field and who you work for all move the number. Source: BLS Occupational Outlook Handbook.
Funding and PathPay
Ways to pay for CGRC training.
Accumentum is an Army CA and Air Force COOL Approved Vendor. If you're serving, start with your education center and read our Army CA and Air Force COOL pages for the steps.
Paying on your own? CGRC prep is eligible for PathPay, our monthly payment plan. Terms of 3, 4 and 6 months carry no added fee. 9, 12 and 18 month terms add 5%, 10% and 15%. Course access opens when your first payment clears.
Our funding page has every other option, and you can talk with us or email info@accumentum.net before you enroll.
Frequently Asked Questions
Understand how Accumentum’s ISC2 CGRC® Certified in Governance, Risk and Compliance Certification Training Course supports certification preparation, eligibility, course content, delivery, and career advancement.
Certified in Governance, Risk and Compliance (CGRC) is an ISC2 certification. A CGRC professional advocates for security risk management in pursuit of information system authorization, in line with legal and regulatory requirements.
Information security practitioners who support system authorization and Assessment and Authorization (A&A) activity. Information system security officers, compliance officers, and risk analysts working with NIST RMF, FedRAMP, or CMMC. Auditors and assessors who evaluate security and privacy controls. Security professionals in government, defense, and regulated industries who want an ISC2 GRC credential.
ISC2 requires a minimum of two years cumulative work experience in one or more of the seven domains of the CGRC CBK. Candidates without the required experience can become an Associate of ISC2 by passing the CGRC exam and then have three years to earn the required experience.
The curriculum covers the seven official CGRC domains: Security and Privacy Governance, Risk Management, and Compliance Program, Scope of the System, Selection and Approval of Framework, Security, and Privacy Controls, Implementation of Security and Privacy Controls, Assessment/Audit of Security and Privacy Controls, System Compliance, and Compliance Maintenance.
Yes. Accumentum’s CGRC Training Course is designed to prepare you for the official ISC2 CGRC certification exam and the competencies it assesses.
Yes. Participate in training sessions, discussions, and applied exercises with experienced instructors. Engage in practical exercises and case studies to apply CGRC concepts.
Access extensive resources, including e-books, video lectures, and practice exams.
Seven domains, with weights of 16%, 10%, 14%, 17%, 16%, 14%, and 13% respectively, per the current ISC2 CGRC Certification Exam Outline.
Accumentum is an Army CA and Air Force COOL Approved Vendor for ISC2. Talk with our team to confirm eligibility for your branch and credential before you enroll.
Enroll in the ISC2 CGRC® Certified in Governance, Risk and Compliance Certification Training Course with Accumentum via Accumentum’s registration page linked below, or explore PathPay Enrollment options.
CGRC shows that you can carry a system through authorization and keep it compliant, which supports roles in risk management, compliance, and security assessment across government and industry.
ISC2 lists the exam at 3 hours with 125 items.
ISC2 sets the passing grade at 700 out of 1000 points.
ISC2 publishes these average weights:
- Security and Privacy Governance, Risk Management, and Compliance Program, 16%
- Scope of the System, 10%
- Selection and Approval of Framework, Security, and Privacy Controls, 14%
- Implementation of Security and Privacy Controls, 17%
- Assessment/Audit of Security and Privacy Controls, 16%
- System Compliance, 14%
- Compliance Maintenance, 13%
Implementation of Security and Privacy Controls carries the most weight at 17%.
ISC2 asks for at least two years of cumulative, full time experience in one or more CGRC domains. Part time work and internships can count. If you pass without the experience, you become an Associate of ISC2 and have three years to earn it.
Once certified, ISC2 requires continuing professional education (CPE) credits and an Annual Maintenance Fee to keep the credential active.
Accumentum is an Army CA and Air Force COOL Approved Vendor. Start with your education center, and we'll help with the rest.
Yes. CGRC prep is eligible for PathPay. Terms of 3, 4 and 6 months add no fee. 9, 12 and 18 month terms add 5%, 10% and 15%.
Enrollment
Enroll in the ISC2 CGRC® Certification Training Course with Accumentum.
Enroll in the ISC2 CGRC® Certified in Governance, Risk and Compliance Certification Training Course with Accumentum to advance your expertise and earn a globally recognized ISC2 credential. Accumentum is an Army CA and Air Force COOL Approved Vendor, and our team can walk you through funding options before you register.
Advance your cybersecurity career with CGRC training.
Prepare for the ISC2 CGRC certification exam and build the security and privacy governance, risk management, and compliance program and compliance maintenance skills that employers look for.