ISC2 CGRC Certification Guide

Governance, risk and compliance work is often learned on the job one framework at a time, which leaves practitioners able to fill in a control spreadsheet but not to take a system from scoping through authorisation and continuous monitoring. ISC2's Certified in Governance, Risk and Compliance (CGRC), formerly the Certified Authorization Professional (CAP), tests exactly that life cycle. This guide sets out what ISC2 publishes about the CGRC: the seven domains of the outline effective 15 June 2024, the two-year experience rule and Associate route, endorsement, fees, and continuing education, with a preparation plan and a view of where it fits among GRC credentials. It is for GRC analysts, assessors, authorising officials' staff and compliance leads, and for the managers who fund their training. Facts are as published by ISC2 and checked on 27 October 2026; confirm on the linked ISC2 pages before you book.

Key takeaways

• It is the system authorisation credential. The seven domains follow one system from programme and scope through control selection, implementation, assessment, compliance decision and ongoing maintenance, which mirrors the NIST Risk Management Framework.
• The experience bar is low for an ISC2 credential. ISC2 asks for two years of cumulative, full-time experience in one or more of the seven domains, related to system authorisation or applying security risk management.
• There is no degree waiver on the experience page. Unlike the CSSLP or CCSP pages, the CGRC experience page lists no degree substitution; the Associate route gives three years to earn the experience.
• Exam fee and renewal are lighter than the CISSP. The exam costs USD 599 (EUR 575.04, GBP 485.19) and renewal needs 60 CPE credits in three years with a USD 135 annual maintenance fee.
• Check the exam format before you book. The ISC2 web outline does not publish item count, duration, passing score or domain weights; get them from the downloadable outline or the booking page.

Who the certification is for

ISC2 describes the CGRC as demonstrating the knowledge and skills to integrate governance, performance management, risk management and regulatory compliance in an organisation, using frameworks to align security and privacy with organisational objectives. It is ANAB accredited under ISO/IEC 17024 and approved by the US Department of Defense under DoDM 8140.03. ISC2 renamed the CAP to CGRC and states the exam and education were not changed by the rename.

• Strong fit: people preparing authorisation packages (system security plans, assessment reports, plans of action and milestones) for US federal, defence or FedRAMP environments; control assessors; ISSOs and ISSMs.
• Good fit: GRC analysts in regulated industries who run control frameworks such as ISO/IEC 27001, PCI DSS or HIPAA and want a structured, life-cycle view.
• Weaker fit: enterprise risk managers who quantify and report risk at business level; ISACA CRISC is closer to that job. See the CRISC Certification Guide.
• Not the right tool: security leaders who need a management credential (see the CISM Certification Guide) or auditors who need an audit credential (see the CISA Certification Guide).

Exam format and domains

Format

We do not quote item counts or weights from third-party sites, as they are often out of date after an outline change.

The seven domains

Domain names are from ISC2's outline effective 15 June 2024. The RMF column is our mapping to NIST SP 800-37 Rev. 2 steps, not part of the outline.

ISC2's outline page also adds a paragraph on AI under each domain, such as AI in governance tools and audits. Those paragraphs are not in the numbered subtopic lists, so treat them as context, and check the official outline for whether they are examined.

Where identity fits: access control families dominate most control baselines, and in authorisation work the hardest evidence to produce is often for non-human accounts: service accounts, API keys and automation identities that need owners, least privilege and review just like people. See the Audit Readiness for AI Agents and NHIs.

Prerequisites and experience

Endorsement

• Endorser: an ISC2 certified professional in good standing (member ID and surname), or ISC2 itself with proof of employment.
• Deadline: submit the application within nine months of the exam date; drafts can be started early but submitted only after the pass notice.
• Audit: ISC2 audits a random selection of applications, so keep evidence of authorisation or risk work ready.

Preparation plan

This plan assumes eight to ten weeks of part-time study for someone already doing GRC work. ISC2 sells official self-paced (90 or 180 days) and instructor-led training, with or without an exam voucher.

1. Confirm route (week 0): check that two years of your work map to the domains, or plan for the Associate route; identify your endorser.
2. Get the official outline (week 0): download the outline effective 15 June 2024 and note the item count, duration and weights it states. Use it as your checklist.
3. Anchor on one framework (weeks 1 to 2): read NIST SP 800-37 Rev. 2 end to end. Its steps give a frame for domains 2 to 7 even if you work under ISO/IEC 27001 or PCI DSS.
4. Controls and tailoring (weeks 3 to 4): work through SP 800-53 Rev. 5 baselines, inherited and common controls, tailoring and overlays. Practise writing control implementation statements.
5. Assessment (weeks 5 to 6): study assessment methods (examine, interview, test), assessment plans and reports, and how findings become POA&M entries.
6. Authorisation and monitoring (week 7): residual risk, risk acceptance criteria, authorisation decisions, change impact analysis and continuous monitoring strategy.
7. Governance and law (week 8): cover the frameworks and laws named in domain 1, focusing on what each requires rather than memorising every clause.
8. Rehearse (weeks 9 to 10): timed practice questions under the outline's conditions; review every wrong answer against the outline subtopic.

Measuring readiness

• Life-cycle fluency: you can explain, for one real system, each step from categorisation to monitoring and the artefact it produces.
• Domain spread: practice scores consistent across all seven domains, not only the ones you do at work.
• Documentation skill: you can draft a control implementation statement and a POA&M entry without notes.
• Application ready: endorser and evidence confirmed before exam day.

Small vs large organisations: in a small organisation one person may scope, implement and assess, which gives breadth but blurs the separation the exam expects between assessor and implementer. In large or federal environments, candidates often see one stage only and should ask to shadow assessments and authorisation boards.

Cost, renewal and continuing education

ISC2's Certification Maintenance Policy (version 7.0 when checked) defines Group A and Group B activities. Authorisation and assessment work itself, plus framework training, usually provides Group A credits.

Common failure patterns

• Studying only your own framework: candidates who know one framework deeply miss the generic life-cycle logic the domains test.
• Confusing roles: mixing up who categorises, who assesses and who authorises. Learn the role separation, especially assessor independence.
• Ignoring maintenance: domain 7 covers change management, continuous monitoring and decommissioning, which compliance-project experience often skips.
• Relying on old CAP material: check that resources follow the June 2024 outline and its seven domain names.
• Assuming a degree waiver: the CGRC experience page lists none.

Where it fits on the career path

• Before it: ISC2 CC or CompTIA Security+ for foundations. See the ISC2 Certified in Cybersecurity (CC) Guide.
• Alongside it: framework-specific training such as ISO/IEC 27001 lead implementer, or a CMMC assessor credential for defence supply chain work. See the CMMC Certified Professional and Assessor Guide.
• After it: CRISC for enterprise risk, CISM for management, or CISSP for breadth.
• Roles: GRC analyst, control assessor, ISSO or ISSM, compliance manager, and later cyber risk manager. See the GRC Analyst Career Guide and the Cybersecurity Risk Manager Career Guide.

ISC2 does not publish pass rates or salary figures on the pages checked, and we do not quote third-party estimates. For a side-by-side view, see the GRC and Risk Certifications Compared Guide and the Cybersecurity Certifications Guide.

Practitioner checklist

• Map two years of your work to the seven CGRC domains, or plan the Associate route.
• Download the official outline effective 15 June 2024 and note format and weights.
• Read NIST SP 800-37 Rev. 2 and use its steps as the spine of your revision.
• Practise writing control implementation statements, assessment findings and POA&M entries.
• Study role separation between system owner, assessor and authorising official.
• Choose an Exam Only or Peace of Mind package based on your confidence and timeline.
• Confirm your endorser before exam day and submit within nine months.
• Diarise the USD 135 AMF and about 20 CPE credits a year.

Standards and references

• ISC2: CGRC Certified in Governance, Risk and Compliance
• ISC2: CGRC Certification Exam Outline
• ISC2: CGRC Experience Requirements
• ISC2: Endorsement
• ISC2: Exam Pricing
• ISC2: Member Policies and Certification Maintenance
• NIST: SP 800-37 Rev. 2 Risk Management Framework

Related NHI Mgmt Group resources: Cybersecurity Certifications Guide · GRC and Risk Certifications Compared Guide · NIST Risk Management Framework (SP 800-37) Guide · GRC Analyst Career Guide