- Apply principles of governance, risk management, and compliance using national and international frameworks such as NIST, COBIT, and ISO/IEC.
- Connect the system development life cycle and the information lifecycle to security and privacy requirements.
- Establish a compliance program and define roles and responsibilities for compliance activities.
- Work with compliance frameworks and laws including FedRAMP, PCI DSS, CMMC, FISMA, HIPAA, and GDPR.
ISC2 Certification Training Course
ISC2 CGRC® Certified in Governance, Risk and Compliance Certification Training Course
Build the governance, risk, and compliance expertise that system authorization depends on with Accumentum’s ISC2 CGRC® Certified in Governance, Risk and Compliance Certification Training Course, developed to help you guide information systems from scoping to authorization and ongoing compliance.
Course focus: Security and privacy governance, system scoping, control selection and implementation, assessment and audit, system compliance, and compliance maintenance.
Course Overview
Master the seven CGRC domains.
The ISC2 CGRC® Certified in Governance, Risk and Compliance Certification Training Course with Accumentum gives you a complete look at the CGRC credential. A CGRC professional advocates for security risk management in pursuit of information system authorization, in line with legal and regulatory requirements. This course covers all seven domains of the current CGRC exam outline, from building a compliance program and defining system scope through control selection, implementation, assessment, authorization, and continuous monitoring. You work with the frameworks named in the outline, including NIST, COBIT, ISO/IEC, FedRAMP, PCI DSS, and CMMC, and you learn how the updated outline brings AI systems into each phase of the Risk Management Framework. You leave ready to sit the CGRC exam and to lead authorization work with confidence.
Course Benefits
Build CGRC certification readiness and real-world capability.
01
Governance and Compliance Programs
Establish a compliance program, apply national and international frameworks, and map regulatory and privacy requirements to your systems.
02
System Scoping and Control Selection
Describe the system, determine the required compliance level, and select and tailor baseline, inherited, and enhanced controls.
03
Implementation and Assessment
Implement and document controls, prepare and conduct assessments, and build risk response plans from findings.
04
Authorization and Continuous Compliance
Assemble authorization packages, determine risk posture, manage change, and keep systems compliant through decommissioning.
Who Should Attend
- Information security practitioners who support system authorization and Assessment and Authorization (A&A) activity.
- Information system security officers, compliance officers, and risk analysts working with NIST RMF, FedRAMP, or CMMC.
- Auditors and assessors who evaluate security and privacy controls.
- Security professionals in government, defense, and regulated industries who want an ISC2 GRC credential.
Prerequisites
- ISC2 requires a minimum of two years cumulative work experience in one or more of the seven domains of the CGRC CBK.
- Candidates without the required experience can become an Associate of ISC2 by passing the CGRC exam and then have three years to earn the required experience.
- Familiarity with risk management frameworks and security control catalogs supports the advanced course topics.
- Willingness to work through documentation-heavy authorization scenarios in preparation for the CGRC exam.
Pathway Map
The CGRC training course spans the seven official ISC2 exam domains.
The curriculum covers Security and Privacy Governance, Risk Management, and Compliance Program (16%), Scope of the System (10%), Selection and Approval of Framework, Security, and Privacy Controls (14%), Implementation of Security and Privacy Controls (17%), Assessment/Audit of Security and Privacy Controls (16%), System Compliance (14%), and Compliance Maintenance (13%).
1
Security and Privacy Governance, Risk Management, and Compliance Program
2
Scope of the System
3
Selection and Approval of Framework, Security, and Privacy Controls
4
Implementation of Security and Privacy Controls
5
Assessment/Audit of Security and Privacy Controls
6
System Compliance
7
Compliance Maintenance
Course Content
- Document the system name, scope, purpose, and functionality.
- Identify the information types the system processes, stores, or transmits.
- Set security objectives for each information type and determine the risk impact level for the system.
- Determine applicable baseline and inherited controls.
- Tailor controls with enhancements, overlays, and mitigating controls.
- Document control selection, plan a continued compliance strategy, and secure stakeholder agreement on control allocation.
- Develop an implementation strategy that covers resourcing, funding, timeline, and effectiveness.
- Implement selected controls, including compensating or alternate controls.
- Document control implementation and residual risk using tools such as the POA&M and risk register.
- Prepare the assessment or audit plan, including scope, schedule, methods, and evidence.
- Conduct assessments using interview, examine, and test methods.
- Prepare initial and final assessment reports, assign risk responses, and develop a risk response plan.
- Compile, review, and submit the security and privacy documentation needed for a compliance decision.
- Determine system risk posture, residual risk, and risk acceptance criteria.
- Document the compliance decision and share formal notification with stakeholders.
- Perform system change management with documented approval and rollback plans.
- Carry out ongoing compliance activities, monitoring, incident response, and awareness training.
- Support audits and decommission systems when applicable.
Course Features
Designed for practical training and CGRC exam preparation.
Interactive Learning
Participate in training sessions, discussions, and applied exercises with experienced instructors.
Comprehensive Study Materials
Access extensive resources, including e-books, video lectures, and practice exams.
Real-World Applications
Engage in practical exercises and case studies to apply CGRC concepts.
Certification Preparation
Receive guidance and tips to successfully prepare for the ISC2 CGRC® Certified in Governance, Risk and Compliance Certification exam.
Certification Exam
Prepare for the official ISC2 CGRC certification exam.
CGRC Exam Readiness
Accumentum’s CGRC Training Course prepares learners to apply the seven CGRC domains in real work and on exam day.
Upon completing the ISC2 CGRC® Certified in Governance, Risk and Compliance Certification Training Course with Accumentum, you will be equipped to pursue the Certified in Governance, Risk and Compliance (CGRC) exam. The official exam is 3 hours, includes 125 items in multiple choice and advanced item types format, and requires a passing grade of 700 out of 1000 points. It is offered in English at Pearson VUE testing centers. CGRC is listed in the DoD 8140 Foundational Qualification Matrix V2.1 (effective September 19, 2025), so it can support qualification for applicable DoD cyber workforce roles. Confirm your work role and proficiency level with your supervisor. CGRC shows that you can carry a system through authorization and keep it compliant, which supports roles in risk management, compliance, and security assessment across government and industry.
Frequently Asked Questions
Understand how Accumentum’s ISC2 CGRC® Certified in Governance, Risk and Compliance Certification Training Course supports certification preparation, eligibility, course content, delivery, and career advancement.
Certified in Governance, Risk and Compliance (CGRC) is an ISC2 certification. A CGRC professional advocates for security risk management in pursuit of information system authorization, in line with legal and regulatory requirements.
Information security practitioners who support system authorization and Assessment and Authorization (A&A) activity. Information system security officers, compliance officers, and risk analysts working with NIST RMF, FedRAMP, or CMMC. Auditors and assessors who evaluate security and privacy controls. Security professionals in government, defense, and regulated industries who want an ISC2 GRC credential.
ISC2 requires a minimum of two years cumulative work experience in one or more of the seven domains of the CGRC CBK. Candidates without the required experience can become an Associate of ISC2 by passing the CGRC exam and then have three years to earn the required experience.
The curriculum covers the seven official CGRC domains: Security and Privacy Governance, Risk Management, and Compliance Program, Scope of the System, Selection and Approval of Framework, Security, and Privacy Controls, Implementation of Security and Privacy Controls, Assessment/Audit of Security and Privacy Controls, System Compliance, and Compliance Maintenance.
Yes. Accumentum’s CGRC Training Course is designed to prepare you for the official ISC2 CGRC certification exam and the competencies it assesses.
Yes. Participate in training sessions, discussions, and applied exercises with experienced instructors. Engage in practical exercises and case studies to apply CGRC concepts.
Access extensive resources, including e-books, video lectures, and practice exams.
Seven domains, with weights of 16%, 10%, 14%, 17%, 16%, 14%, and 13% respectively, per the current ISC2 CGRC Certification Exam Outline.
Accumentum is an Army CA and Air Force COOL Approved Vendor for ISC2. Talk with our team to confirm eligibility for your branch and credential before you enroll.
Enroll in the ISC2 CGRC® Certified in Governance, Risk and Compliance Certification Training Course with Accumentum via Accumentum’s registration page linked below, or explore PathPay Enrollment options.
CGRC shows that you can carry a system through authorization and keep it compliant, which supports roles in risk management, compliance, and security assessment across government and industry.
Enrollment
Enroll in the ISC2 CGRC® Certification Training Course with Accumentum.
Enroll in the ISC2 CGRC® Certified in Governance, Risk and Compliance Certification Training Course with Accumentum to advance your expertise and earn a globally recognized ISC2 credential. Accumentum is an Army CA and Air Force COOL Approved Vendor, and our team can walk you through funding options before you register.
Advance your cybersecurity career with CGRC training.
Prepare for the ISC2 CGRC certification exam and build the security and privacy governance, risk management, and compliance program and compliance maintenance skills that employers look for.