Skip to content
CertGPS
Comparison

CISA or CGRC (formerly CAP): Auditing IT Controls or Authorizing a System

CISA audits whether an organization's IT is controlled; CGRC takes one system through authorization. Exams, experience rules, overlap and which to take first.

EJ
Emily Jackson
Compliance Specialist
Published
Updated
Read time
5 min
On this page

Related certifications

Topics

CISA or CGRC (formerly CAP): Auditing IT Controls or Authorizing a System

Both credentials sit on the assessing side of a security control, so the choice comes down to who reads your work. A CISA auditor reports to management on whether an organization's IT is governed and controlled. A CGRC holder, the credential ISC2 called CAP until February 2023, assembles the evidence an authorizing official needs to accept one system's risk. The rule that settles most choices is experience: CGRC asks for two years, CISA for five.

The two exams side by side

CISACGRC
IssuerISACAISC2
FormatMultiple choice, four options, one best answerFixed length; multiple choice and advanced item types
Questions150125
Time4 hours3 hours
Passing score450 on a scaled range of 200 to 800700 out of 1000
PriceUS$575 members, US$760 non-members, plus a US$50 application fee$599 (Americas)
ExperienceFive years of qualifying IS audit, control, assurance or security work; up to three years waived, with at least two years in a CISA domainTwo years in one or more of the seven domains; pass without it and become an Associate of ISC2
RenewalUS$45 (members) or US$85 a year; 20 CPE hours a year, 120 per three years$135 a year; 60 CPE credits per three years

Who each one is written for

CISA belongs to internal audit teams, audit firms and financial auditors moving into technology work. Its scope is the whole IT function: governance, acquisition and development, operations, resilience and security. If your deliverable is an audit report with findings and management responses, it names your job.

CGRC belongs to the people who write system security plans and authorization packages: information system security officers, security control assessors and GRC analysts, most often on US federal programs or their contractors. ISC2 also lists cybersecurity auditor among the roles it suits, which is where the overlap starts. The outline still follows the NIST Risk Management Framework, from categorizing a system through selecting, implementing and assessing its controls to authorization and continuous monitoring.

A rough test: if you're asked "is this company's IT under control?", you're doing CISA work. If you're asked "can this system go live, and what risk is the agency accepting?", you're doing CGRC work. Someone early in a federal compliance career will usually reach the CGRC's two years well before CISA's five.

Where the outlines meet and where they part

CGRC's Domain 5, Assessment/Audit of Security and Privacy Controls, is 16% of the exam in ISC2's outline and has the most objectives of any domain, from planning an assessment to the final report and risk response plan. That is the nearest thing in ISC2's catalog to CISA's audit process domain, which carries 18%. Both want you to plan by risk and back each finding with evidence. CISA adds the auditor's own discipline: sampling methods, judging whether evidence is sufficient, independence from the system under review, and following up after the report.

The rest diverges. ISACA weights operations and resilience at 26% and protection of information assets at 26%, so half of CISA covers job scheduling, database management, change and patch management, backups, disaster recovery, identity, network and endpoint security. CGRC spends its weight on one system's life: scope and boundary, picking and tailoring a control baseline, inherited and common controls, and keeping compliance once authorized. Its vocabulary is US federal even when a question names ISO/IEC or COBIT, so expect a Plan of Action and Milestones (POA&M), authorizing officials and examine, interview and test as assessment methods. CISA gives less attention to the mechanics of a system authorization package; CGRC gives less attention to auditing the wider IT function.

Doing both: experience, waivers and upkeep

Neither credential waives experience for the other. CISA allows specified work, education and credential substitutions, including CIMA and ACCA. CGRC has no waivers at all. The work itself transfers better. ISACA counts control, assurance and security work toward CISA's five years, which should take in most assessor and ISSO work, and two years of control assessment is CGRC experience in Domain 5. An assessor who starts with CGRC may find three more years of the same job carries them most of the way to CISA.

The two credentials differ in one place that matters to an ISC2 career. CGRC is on ISC2's list of credentials that waive a year of CISSP experience, and CISA isn't. Both count in US defense hiring: ISC2 lists CGRC as approved under DoDM 8140.03, and ISACA announced CISA's approval for the same program in May 2024.

Some continuing education counts twice. ISC2's maintenance handbook counts self-study for a certification exam as Group A credit when it covers your certification's domains, so CISA preparation can feed a CGRC cycle. ISACA's CPE policy gives two CPE hours per exam hour for passing a related professional examination aligned with the CISA outline, which would make a passed three-hour CGRC exam worth six. Fees don't overlap. Holding both costs $135 a year to ISC2 and US$45 or US$85 to ISACA. For the wider GRC picture, see our GRC career track, and CISM vs CISA if management is the other option you're weighing.

Our view

Take CGRC first if your work is authorizing systems on a federal program or contract: it names the job, it's reachable in two years, and it knocks a year off CISSP later. Take CISA first if you're in internal audit or an audit firm, or plan to be, because it's the credential those employers recognize and CGRC's RMF detail won't come up much in a financial-services IT audit. We'd only hold both if you assess controls for a federal agency and also audit them for a commercial client. For everyone else the second credential adds an annual fee and little new standing.

Sources