CGRC
Certified in Governance, Risk and Compliance · ISC2
The CGRC (formerly CAP) certifies the ability to authorise and monitor information systems within a risk management framework: categorisation, selection and implementation of controls, assessment, authorisation and continuous monitoring. It is largely inspired by the US NIST Risk Management Framework and is valued mainly by US federal agencies and their contractors. Its strength is a very practical method for compliance work; its limit is that it is little known in France, where ISO 27001 and EBIOS Risk Manager prevail.
- Exam
- Linear exam: 125 multiple-choice questions in 3 h, pass mark 700/1,000. Exam outline in force since 15 June 2024.
- Exam price
- $599€575.04 in Europe.
- Required experience
- Two years of cumulative full-time experience in at least one of the seven domains. Without it, you become an Associate of ISC2 with three years to gain the experience.
- Validity and maintenance
- 3-year cycle: 60 CPE credits (20 per year) and an annual maintenance fee of US$135, a single fee however many ISC2 certifications you hold.
- Format
- Multiple choice
- Recognition
- ISO/IEC 17024 accredited · DoD 8140 approved
Who is it for?
GRC analysts, compliance officers and system security officers with two years of experience, especially those working for US government programmes or US-based groups.
Domains covered
- Information security risk management programme: 16%
- Scope of the information system: 10%
- Selection and approval of security and privacy controls: 14%
- Implementation of security and privacy controls: 17%
- Assessment and audit of security and privacy controls: 16%
- Authorisation of the information system: 14%
- Continuous monitoring: 13%
Belinda’s take
Information checked on 2 October 2026 against the official site. Prices exclude tax and training, and may change.
The certification names mentioned are trademarks of their respective owners. KrakenShield is not affiliated with any certification body and does not reproduce any exam question.
