Skip to content
CertGPS

Certified in Governance, Risk and Compliance

ISC2's credential, called CAP until 2023, for taking an information system through control selection, assessment, authorization and monitoring

AdvancedISC2

The exam

Exam cost
$599
Study time
4-6 months
Passing score
700 out of 1000
Valid for
3 years

Before you book

  • Required: two years of cumulative full-time experience in one or more of the seven CGRC domains
  • Part-time work and internships may count toward the experience
  • Without the experience: pass to become an Associate of ISC2, with three years to qualify

What it covers

Security domains

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where people with it work

  1. Entry level

  2. Mid level

  3. Senior level

Where it leads

  1. Certified Information Systems Security Professional

    Expert

    Comes before. Covers the whole security program, where CGRC follows one system through authorization

  2. Certified in Governance, Risk and Compliance

    You are here

Study guide

Last updated

CGRC (formerly CAP) Study Guide: The Exam, the Seven Domains and an RMF Plan

ISC2 renamed the Certified Authorization Professional (CAP) on February 15, 2023. It's now the Certified in Governance, Risk and Compliance (CGRC), with the same exam and eligibility, and existing CAP badges switched over automatically. The credential tests whether you can take one information system through authorization: scoping, choosing and tailoring controls, assessment, risk acceptance and ongoing monitoring. You need two years of experience in its domains.

Who the CGRC suits, and who should look elsewhere

The CGRC fits the people who write system security plans, run control assessments and assemble authorization packages. Think of information system security officers, security control assessors, and GRC analysts on US federal programs or their contractors. ISC2's own list adds GRC managers, third-party risk managers and cybersecurity auditors. ISC2 renamed CAP to reach GRC staff outside US government, and the outline now cites ISO/IEC, COBIT, PCI DSS and GDPR next to NIST. The order of the domains still follows the NIST Risk Management Framework (RMF), from prepare and categorize through select, implement, assess, authorize and monitor.

If you run a security program rather than individual systems, CISM is the better fit. Enterprise IT risk work points to CRISC, and audit work to CISA. If you want a broad credential first and have five years of experience in at least two of its eight domains, take CISSP.

CGRC exam facts

Exam factDetail
FormatFixed length; multiple choice and advanced item types
Questions125
Time3 hours
Passing score700 out of 1000
Price (Americas)$599; $50 to reschedule, $100 to cancel
DeliveryPearson VUE test centers, English only
ExperienceTwo years of cumulative full-time work in one or more of the seven domains; part-time work and internships can count
Without the experiencePass and become an Associate of ISC2, with three years to earn the two
RenewalThree-year cycle, 60 CPE credits, $135 annual maintenance fee

What the seven domains test

Average weights from the outline effective June 15, 2024:

  • Security and Privacy Governance, Risk Management, and Compliance Program: 16%
  • Scope of the System: 10%
  • Selection and Approval of Framework, Security, and Privacy Controls: 14%
  • Implementation of Security and Privacy Controls: 17%
  • Assessment/Audit of Security and Privacy Controls: 16%
  • System Compliance: 14%
  • Compliance Maintenance: 13%

Implementation carries the most weight at 17%, but assessment and audit has the most objectives. It has six, running from planning the assessment through the initial report and risk response to the final report and a risk response plan. Domains 4 to 7 add up to 60%, so most of the exam is about what happens to a system after its controls are chosen.

Much of the vocabulary comes from US federal practice, whichever framework a question names. Expect a Plan of Action and Milestones (POA&M), authorizing officials, inherited and common controls, overlays, a Change Control Board, and examine, interview and test as assessment methods. Candidates from ISO 27001 or SOC 2 work should learn those terms early. Domain 1 also asks for familiarity with FedRAMP, CMMC, FISMA and HIPAA.

ISC2's Exam Guidance for Artificial Intelligence, last updated September 1, 2026, maps topics such as the NIST AI Risk Management Framework and ISO/IEC 42001 onto all seven domains. The June 2024 outline itself doesn't mention AI. ISC2 asked CGRC holders for job task analysis input in early 2025, the step that comes before a new outline, but it hadn't announced a new outline or date by October 2026.

How to prepare with the RMF documents

ISC2 publishes no official CGRC textbook. It offers online self-paced training in 90- and 180-day versions, instructor-led classes and free flash cards. Your core reading is free from NIST:

  • SP 800-37 Revision 2, the RMF itself
  • SP 800-53 Revision 5, the control catalog (release 5.2.0 came out in August 2025)
  • SP 800-53A Revision 5, the assessment procedures behind Domain 5

Arun Kumar Chaudhary's Ultimate Guide to CGRC Certification (BPB, 2025) is a third-party book if you want a single text. Check its chapters against the outline before you rely on it.

Practise by doing the paperwork once. Take a real system you know, or invent a small one, and write its description and authorization boundary. List its information types and give each a security objective. Pick a baseline, tailor it, and note which controls are inherited from a cloud provider. Write implementation statements for a dozen controls, then assess three of them using examine, interview and test, and record each gap as a POA&M entry with a risk response. That one exercise covers Domains 2 to 6 and teaches the order of events the outline follows.

We'd put about half your time into the NIST documents and the outline, a quarter into the paperwork exercise, and the rest into timed practice at 125 questions in three hours. If you've only worked one stage of the lifecycle, such as assessment, weight your reading toward the stages you haven't done.

Renewal, retakes and next steps

After passing, you complete an endorsement application signed by an ISC2-certified professional in good standing (ISC2 can endorse you if you don't know one) and pay the first annual maintenance fee (AMF) of $135. That fee covers all your ISC2 certifications. Each three-year cycle needs 60 continuing professional education (CPE) credits, at least 45 of them Group A, with a suggested 20 a year. Associates pay $50 a year instead and must log 15 Group A credits every year.

A failed attempt means waiting 30 days before the second try, 60 before the third and 90 after that, with a limit of four attempts in 12 months.

Next steps:

  • CISSP to cover the whole security program around the systems you authorize.
  • CRISC to move from system risk to enterprise IT risk.
  • CISA if assessment and audit is the work you enjoy most.

Our view

The CGRC describes one job closely. If that job is yours, the exam matches your daily work, and ISC2 lists it as approved by the US Department of Defense under DoDM 8140.03. Outside authorization and federal compliance, we think employers know it less well than CISM or CRISC, and the 2023 rename hasn't changed that much yet because the content is still RMF-shaped. At $599 it's worth it for an ISSO, assessor or GRC analyst on a federal contract who wants a credential that names their work. A GRC generalist in the private sector will usually get more from an ISACA certification.

Sources