GRC and risk credentials look interchangeable on a job advert, but they test different jobs: running an enterprise IT risk process, authorising systems against a control framework, managing a security programme, quantifying risk in money, or operating an ISO/IEC 27005 risk process. This guide compares five options in one place: ISACA CRISC, ISC2 CGRC, ISACA CISM, The Open Group Open FAIR Foundation and the PECB ISO/IEC 27005 Risk Manager. It covers who each suits, exam format and domains, experience rules, preparation, cost and renewal, and where each sits on a risk career path. It is written for GRC analysts, risk managers and the security leaders who fund their development. Facts come from the certifying bodies' own pages, checked on 27 October 2026; where a page did not state a detail, this guide says so rather than filling the gap.
Key takeaways
- CRISC is the enterprise IT risk credential. Its 150-question exam weights Risk Response and Reporting at 32%, and certification needs three years of experience across at least two of four domains.
- CGRC is the authorisation and controls credential. Its seven domains follow a system from scoping and control selection to assessment, compliance and continuous maintenance, and it needs two years of experience.
- CISM is a management credential with a risk domain. Information Security Risk Management is 20% of the exam; choose it when you will run the programme, not only the risk process.
- Open FAIR and ISO/IEC 27005 teach a method. Open FAIR covers the Open Group risk taxonomy and analysis standards; the PECB courses cover the ISO/IEC 27005 process that supports ISO/IEC 27001.
- Renewal costs differ widely. ISACA charges USD 45 to 85 a year with 120 CPE hours per three years; ISC2 charges USD 135 a year with 60 CPE credits per three years for CGRC.
Who the certification is for
| Credential | Core job it tests | Typical holder |
|---|---|---|
| CRISC (ISACA) | Identifying, assessing, responding to and reporting IT risk, with governance and technology context | IT risk managers, risk and control analysts, second-line risk staff, auditors moving into risk |
| CGRC (ISC2) | Selecting, implementing, assessing and maintaining security and privacy controls for systems, including authorisation | Authorisation officials' staff, ISSOs, compliance analysts in government and regulated industries |
| CISM (ISACA) | Governance, risk management, the security programme and incident management | Security managers, heads of security and aspiring CISOs |
| Open FAIR Foundation (The Open Group) | Quantitative risk analysis using the Open FAIR taxonomy (O-RT) and analysis (O-RA) standards | Risk analysts, cyber risk quantification practitioners, risk managers presenting loss estimates |
| ISO/IEC 27005 Risk Manager (PECB) | Running an information security risk process aligned with ISO/IEC 27001 and ISO 31000 | ISMS managers, ISO 27001 implementers and consultants |
For the analyst role many of these support, see the GRC Analyst Career Guide and the Cybersecurity Risk Manager Career Guide.
Exam format and domains
| Credential | Exam facts published | Domains (weights where published) |
|---|---|---|
| CRISC | 150 questions; computer based at PSI test centres or remotely proctored | Governance 26%; Risk Assessment 22%; Risk Response and Reporting 32%; Technology and Security 20% |
| CISM | 150 questions; same ISACA delivery model | Information Security Governance 17%; Information Security Risk Management 20%; Information Security Program 33%; Incident Management 30%. ISACA updates the outline effective 3 November 2026 |
| CGRC | Exam outline effective 15 June 2024; question count and duration were not shown on the pages read, so check the ISC2 outline | Security and Privacy Governance, Risk Management and Compliance Program; Scope of the System; Selection and Approval of Framework, Security and Privacy Controls; Implementation of Security and Privacy Controls; Assessment/Audit of Security and Privacy Controls; System Compliance; Compliance Maintenance |
| Open FAIR Foundation | Open FAIR 2 Foundation (Part 1) examination, taken online proctored at home or at Pearson VUE; question count, time and pass mark not stated on the page read | Open FAIR 2 Foundation: O-RA 2.0.1 and O-RT 3.0.1. The original Open FAIR Foundation covered O-RA 1.0 and O-RT 2.0 |
| ISO/IEC 27005 Risk Manager | Three-day course agenda followed by an exam on four competency domains; exam format not stated on the page read | The ISO/IEC 27005 risk process: context, assessment, treatment, communication, monitoring and review, within an ISMS |
The weights tell you how each exam thinks. CRISC puts its largest share on what you do after the assessment: response, ownership and reporting. CISM spends 63% on running the programme and handling incidents, so it is a poor choice for a pure risk analyst. CGRC follows a system lifecycle, which reflects its roots in the NIST Risk Management Framework. See the NIST Risk Management Framework (SP 800-37) Guide.
Prerequisites and experience
| Credential | Experience to certify | Can you sit first? |
|---|---|---|
| CRISC | Three years of IS audit, control or security work across at least two of the four domains, within the ten years before applying | Yes; apply within five years of passing |
| CISM | Five years of CISM work across at least three of the four domains, within the ten years before applying | Yes; apply within five years of passing |
| CGRC | Two years cumulative full-time experience in one or more of the seven domains; part-time work (20 to 34 hours a week) and internships can count | Yes; pass and become an Associate of ISC2, with three years to gain the experience |
| Open FAIR Foundation | None stated on the page read | Not applicable |
| ISO/IEC 27005 Risk Manager | Provisional Risk Manager: none. Risk Manager: two years including one year of information security risk management and 200 hours of risk management activities | Yes; the provisional credential is issued first |
Choosing by experience: a GRC analyst with two years can certify for CGRC now, CRISC after one more year, and CISM only after five years with management scope. Open FAIR and the PECB provisional credential suit people earlier in a risk career who want to show method knowledge.
Preparation plan
- Write down the job you want next: enterprise risk (CRISC), system authorisation (CGRC), security management (CISM), quantification (Open FAIR) or ISMS risk (ISO/IEC 27005).
- Read the primary standard behind the exam: the ISACA outline for CRISC or CISM, NIST SP 800-37 and SP 800-53 for CGRC, the Open Group O-RT and O-RA standards for Open FAIR, and ISO/IEC 27005 itself for the PECB route. See the ISO/IEC 27005 Information Security Risk Guide.
- Apply the method to your own estate: build three risk scenarios from your own risk register, score them, and write the treatment and indicators. See the Risk Register Template.
- Practise the question style: ISACA questions ask for the best next step for the role; expect to choose escalation to the risk owner over a technical fix. Time yourself on full sets.
- Book inside the window: ISACA eligibility lasts six months from registration with appointments up to 90 days ahead; an ISC2 exam-only purchase gives a 365-day window with one attempt.
- Prepare the application in parallel: map each past role to domains and line up verifiers before you sit, so certification follows soon after the pass.
Cost, renewal and continuing education
| Credential | Exam fee | Annual fee | Continuing education |
|---|---|---|---|
| CRISC | USD 575 members, USD 760 non-members; USD 50 application fee | USD 45 members, USD 85 non-members, due 1 January | 120 CPE hours per three years, at least 20 each year |
| CISM | Same ISACA fee structure | Same ISACA fee structure | Same ISACA CPE rule |
| CGRC | USD 599 (EUR 575.04, GBP 485.19) | USD 135 for members; USD 50 for Associates of ISC2 | 60 CPE credits per three years, 20 suggested annually |
| Open FAIR Foundation | Not stated on the page read | Not stated | Not stated |
| ISO/IEC 27005 Risk Manager | Course based; price set by training partners | Not stated on the page read | The course carries 21 CPD credits; one free retake within 12 months for course participants |
ISACA states that a new CPE policy takes effect on 1 January 2027, so holders of CRISC or CISM should read it before planning their next cycle.
Where it fits on the career path
| Stage | Common choice | Reason |
|---|---|---|
| Entry GRC analyst | Open FAIR Foundation, PECB ISO/IEC 27005 (provisional), or CGRC as an Associate of ISC2 | Shows method knowledge before experience gates |
| GRC analyst, 2 to 3 years | CGRC, then CRISC | Formal recognition for control and risk work |
| Risk manager | CRISC plus a quantification method | Enterprise risk language plus the ability to express risk in money. See the Cyber Risk Quantification Guide |
| Security manager or head of GRC | CISM | Programme management scope beyond the risk process |
Decision guidance by organisation
- Small organisations: one person often owns risk, compliance and security management together. CISM covers the widest scope once the experience is there; before that, CRISC gives the risk language that auditors and insurers expect.
- ISO/IEC 27001 certified organisations: the ISMS risk process is the audit focus, so the PECB ISO/IEC 27005 route maps directly onto clause-level evidence, and pairs well with CRISC for enterprise reporting.
- US federal and defence suppliers: CGRC follows the authorisation lifecycle those programmes run, and ISC2 lists it as approved under DoDM 8140.03.
- Large enterprises with an ERM function: second-line cyber risk teams benefit from CRISC for process and Open FAIR for quantification, so that cyber risks can be expressed in the same loss terms as other enterprise risks. See the NIST IR 8286 Cybersecurity and ERM Integration Guide.
Where identity fits: access risk is one of the most common entries on any risk register, and machine credentials such as service accounts, API keys and tokens often sit outside the scope of access reviews. Whichever credential you choose, practise writing risk scenarios for non-human identities with measurable indicators. See the Key Risk Indicators for Cyber Risk Guide.
For individual deep dives, see the CRISC Certification Guide, the ISC2 CGRC Certification Guide, the CISM Certification Guide and the Open FAIR Foundation Certification Guide. For the wider landscape, see the Cybersecurity Certifications Guide.
Practitioner checklist
- Name the risk job you are targeting before choosing a credential.
- Map your experience against each body's rule: two years (CGRC), three across two domains (CRISC), five across three domains (CISM).
- Check the current outline date: CISM changes on 3 November 2026; CGRC's outline dates from 15 June 2024.
- Read the primary standard behind the exam, not only a study guide.
- Build practice scenarios from your own risk register, including at least one for machine identities.
- Compare three-year renewal cost: ISACA annual fee plus 120 CPE hours against ISC2 USD 135 a year plus 60 CPE credits.
- Confirm Open FAIR and PECB exam details directly with the provider before booking, since they were not published on the pages read.
- Read ISACA's CPE policy effective 1 January 2027 if you already hold CRISC or CISM.
Standards and references
- ISACA: CRISC Exam Content Outline
- ISACA: Get CRISC Certified
- ISACA: CISM Exam Content Outline
- ISC2: CGRC Certification Exam Outline
- ISC2: CGRC Experience Requirements
- ISC2: Member Policies
- The Open Group: Open FAIR Certification
- PECB: ISO/IEC 27005 Risk Manager
Related NHI Mgmt Group resources: Cybersecurity Certifications Guide · GRC Analyst Career Guide · Risk Management Guide · Security Leadership Certifications Compared Guide