thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

ISC2 · Governance, Risk & Privacy · Professional

ISC2 CGRC exam guide

Exam CGRC

The ISC2 CGRC (Certified in Governance, Risk and Compliance, formerly CAP) validates the ability to authorize and maintain information systems using risk management frameworks such as NIST RMF. It is heavily used in US federal and defense work, where system authorization (ATO) is a core job function.

Questions125
Time limit180 minutes
Passing score700 out of 1000
Exam fee$599 USD
Valid for3 years
DeliveryPearson VUE test center

Format: Linear multiple choice and advanced item types. Fee note: Standard Americas price; varies by test location.

Who it's for

GRC analysts, ISSOs, assessors and authorization specialists with at least two years of experience in security and privacy governance and compliance.

What the exam covers

Security and Privacy Governance, Risk Management, and Compliance Program16%
Scope of the System10%
Selection and Approval of Framework, Security, and Privacy Controls14%
Implementation of Security and Privacy Controls17%
Assessment/Audit of Security and Privacy Controls16%
System Compliance14%
Compliance Maintenance13%

Eligibility & prerequisites

Required: At least 2 years of cumulative paid work experience in one or more of the 7 CGRC domains. Candidates without experience can become an Associate of ISC2. Endorsement is required.

Recommended: Experience with NIST RMF, ISO 27001 or similar frameworks and system authorization packages.

Keeping it active

3-year cycle: earn 60 CPE credits and pay the ISC2 annual maintenance fee.

Skills & careers

Skills it validates

  • Running RMF steps from categorization to continuous monitoring
  • Defining system boundaries and categorizing systems
  • Selecting and tailoring NIST SP 800-53 controls
  • Assessing controls and writing POA&Ms
  • Preparing authorization packages (ATO)
  • Continuous monitoring and compliance maintenance

Job roles

Information System Security Officer (ISSO)GRC AnalystSecurity Control AssessorAuthorizing Official Designated RepresentativeCompliance ManagerCybersecurity Risk Analyst

DoD 8140

Recognized in the DoD 8140 qualification matrix for authorization and risk management work roles (formerly 8570 IAM I/II). Open the DoD Workforce Navigator

Where it fits in your path

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

  1. Week 1: Read NIST SP 800-37 Rev. 2 and map RMF steps to the 7 CGRC domains.
  2. Week 2: Governance program, system scope and categorization (FIPS 199, SP 800-60).
  3. Week 3: Control selection and implementation with SP 800-53 and 800-53B baselines.
  4. Week 4: Assessment (SP 800-53A), authorization decisions and POA&Ms.
  5. Week 5: Continuous monitoring (SP 800-137) and timed practice tests.

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam-day tips

  • Know RMF step order and the outputs of each step.
  • Know who does what: system owner, ISSO, AO, assessor, common control provider.
  • Implementation and assessment together are 33% of the exam.
  • Questions are framework-generic, but NIST RMF knowledge answers most of them.
  • Privacy is integrated into controls; know privacy roles and documents too.

Key terms for this exam

All 81 terms Study with thinQcards™

Commonly confused on this exam

Frequently asked questions

Is CGRC the same as CAP?

Yes. ISC2 renamed CAP to CGRC in 2023.

How much does CGRC cost?

$599 USD at the standard Americas price.

How many questions are on CGRC?

125 questions in 3 hours.

How do I maintain CGRC?

Earn 60 CPE credits every 3 years and pay the annual maintenance fee.

CGRC vs CRISC?

CGRC focuses on system authorization and RMF; CRISC focuses on enterprise IT risk management.

Official page: www.isc2.org. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.