Skip to content
Domain

Governance, Risk & Compliance

GRC is where security meets business strategy. You'll manage security policies, assess risks, ensure regulatory compliance, and align security with business objectives. This domain focuses on the 'why' and 'what' of security, not just the 'how'.

GRC16 certifications

Why GRC matters

Every security breach has compliance implications. GRC professionals ensure security programs align with business goals and regulatory requirements. With regulations like GDPR and increasing board-level security oversight, GRC skills are more valuable than ever.

Key areas

  • Security policy development and enforcement
  • Risk assessment and management frameworks
  • Regulatory compliance (GDPR, HIPAA, SOX, PCI-DSS)
  • Security awareness training programs
  • Third-party risk management
  • Business continuity and disaster recovery planning

Career path in GRC

  1. Entry level
    Start as GRC Analyst or Junior Auditor, learning compliance frameworks
  2. Mid level
    Progress to Security Manager or Compliance Officer, leading programs
  3. Senior level
    Advance to CISO or VP of Compliance, setting organizational strategy

Essential skills

Policy writingRisk frameworks (NIST, ISO 27001)Compliance auditingBusiness acumenCommunication skills

Typical roles

Pay and outlook for these roles

US figures from the Bureau of Labor Statistics for the closest BLS occupation to each role. BLS doesn't report pay by specialty and counts most of these roles only within a wider occupation, so each card covers every job in it.

Certifications for GRC

Entry3

CompTIA

Entry

CompTIA Security+

Vendor-neutral proof of core security administration skills, tested partly through performance-based tasks and mapped by CompTIA to DoD 8140 work roles

Exam
$439
Study
3-6 months

ISC2

Entry

ISC2 Certified in Cybersecurity

Proves you understand core security concepts with no work experience required, on an adaptive exam rewritten in September 2026 with AI topics

Exam
$199
Study
2-3 months

Intermediate3

ISC2

Intermediate

Systems Security Certified Practitioner

Proves a year of hands-on security administration, from access control to cryptography, on a two-hour adaptive exam across seven evenly weighted domains

Exam
$249
Study
3-6 months

ISC2

Intermediate

Associate of ISC2 (CISSP Pathway)

The designation ISC2 grants for passing the CISSP exam before you have five years of experience, with six years to qualify

Exam
$749
Study
4-8 months

GIAC

Intermediate

GIAC Security Essentials

Proves hands-on defensive skill across Windows, Linux, networks and cloud in a four-hour open-book exam that includes CyberLive virtual machine tasks

Exam
$999
Study
4-6 months

Advanced6

ISC2

Advanced

Certified in Governance, Risk and Compliance

ISC2's credential, called CAP until 2023, for taking an information system through control selection, assessment, authorization and monitoring

Exam
$599
Study
4-6 months

CompTIA

Advanced

CompTIA SecurityX

CompTIA's senior engineering and architecture exam, formerly CASP+, scored pass/fail and built almost entirely on scenario and requirements-based objectives

Exam
$544
Study
6-12 months

Expert4

ISACA

Expert

Certified Information Security Manager

Verifies that you can run an information security program, and ISACA checks five years of security management experience before granting it

Exam
$760
Study
6-12 months

ISACA

Expert

Certified Information Systems Auditor

Proves you can plan and run risk-based IT audits, and it is granted only after five years of verified audit, control or security work

Exam
$760
Study
6-12 months

ISACA

Expert

Certified in the Governance of Enterprise IT

Recognizes enterprise IT governance leaders, covering frameworks, investment benefits, resources and risk, after five verified years in governance roles

Exam
$760
Study
6-12 months