What topics are on the CGRC exam?

Security and Privacy Governance, Risk Management, and Compliance Program 16%

1.1

Principles of Governance, Risk Management, and Compliance

2 subtopics

1.1.1Governance Structures and Frameworks

1.1.2Risk Management Frameworks

Learning Objectives

Understand and apply governance principles
Select appropriate risk management frameworks
Integrate privacy requirements into GRC programs

1.2

RMF Prepare Step

2 subtopics

1.2.1Organization-level Preparation

1.2.2System-level Preparation

Learning Objectives

Execute the RMF Prepare step at organizational and system levels
Establish foundational risk management activities
Define system boundaries and requirements

Domain Hands-on Skills

Developing GRC program documentationCreating risk management strategiesPerforming framework gap analysis

Common Mistakes to Avoid

Skipping the Prepare step
Inadequate stakeholder engagement
Misalignment between frameworks

Scope of the System 10%

Selection and Approval of Framework, Security, and Privacy Controls 14%

Implementation of Security and Privacy Controls 17%

Assessment/Audit of Security and Privacy Controls 16%

System Compliance 14%

Compliance Maintenance 13%

How do I earn the Certified in Governance, Risk, and Compliance certification?

Official Pathway Guidance

Track: Governance, Risk and Compliance

Prerequisites

CCCertified in CybersecurityOptional
Security+CompTIA Security+Optional

Next Steps

CISSPCertified Information Systems Security Professional
CISSP-ISSAPInformation Systems Security Architecture Professional
CISSP-ISSMPInformation Systems Security Management Professional

Current Level

CGRCCertified in Governance, Risk and CompliancePrimary

Alternative Paths

Complementary Certifications

Career Progression

Entry Level Roles

Junior GRC Analyst
Compliance Analyst
Security Control Assessor (Junior)
IT Auditor

Mid Level Roles

GRC Manager
Security Control Assessor
Risk Analyst
Compliance Manager
Information System Security Officer (ISSO)

Senior Level Roles

Chief Risk Officer
GRC Director
Authorizing Official
Chief Compliance Officer
Enterprise Risk Manager

Consulting Opportunities

RMF Consultant
GRC Implementation Specialist
Federal Compliance Advisor
Security Assessment Lead

Certification Maintenance

Recertification Options:
Complete 90 CPEs over 3 yearsRetake and pass current examEarn a higher-level ISC2 certification

How do I study for the CGRC Exam?

Practice the Certified in Governance, Risk, and Compliance with our Exam Simulator

Free practice questions, exam guides, and real exam‑style explanations in our Planet Cert simulator.

Official Resources

Free Resources

Risk Management Framework for Information Systems and OrganizationsPDF Security and Privacy ControlsPDF Assessing Security and Privacy ControlsPDF Control BaselinesPDF NIST RMF Introductory CoursesNIST ISC2 CGRC Study GroupISC2 Community Reddit r/ISC2Reddit NIST OSCAL ToolsOpen Source

Learn more about this exam

NIST Risk Management Framework: A Comprehensive GuideGovernment Publications CGRC Prep Exam based on NIST SP 800-37Udemy RMF-CGRC Certification TrainingTrainACE CGRC Intensive BootcampInfoSec Train Federal RMF Bootcamp with CGRC PrepBAI Inc

What's changed on this exam?

Upcoming Events

2025-10-13

ISC2 Security Congress 2025

CGRC track and networking opportunities

2025-09-15

Federal Identity Forum

Zero Trust and identity management in RMF

Technology Coverage

Cloud Security in RMFFedRAMP Rev 5

Increased emphasis on cloud-specific controls

Released: 2024-03-01

Supply Chain Risk ManagementNIST SP 800-161 Rev. 1

New focus on C-SCRM in RMF Prepare step

Released: 2022-05-05

Privacy ControlsNIST SP 800-53 Rev. 5

Integrated privacy controls throughout all domains

Released: 2020-09-23

Continuous Diagnostics and Mitigation (CDM)CDM Program Phase 4

Enhanced continuous monitoring requirements

Released: 2024-01-01

Industry Trends

Increased demand for GRC professionals in federal contracting
Growing emphasis on privacy alongside security
Shift from periodic assessments to continuous monitoring
Integration of AI/ML governance into traditional GRC
Zero Trust becoming mandatory in federal systems
Supply chain security as critical component
Cloud-first strategies requiring adapted RMF approaches

Who should take this exam?

Recommended Experience

Minimum 2 years experience in one or more CGRC domains
Understanding of NIST Risk Management Framework
Familiarity with security control implementation
Knowledge of governance and compliance concepts

Experience Level: Intermediate

How do I register & what's the exam fee?

Exam Cost	$599 USD
Testing Centers	Pearson VUE
Online Proctoring	Available
Retake Policy	First Retake Wait: 30 days Second Retake Wait: 60 days Third Retake Wait: 90 days Max Attempts Per Year: 4

How long is the certification valid?

Valid For	3 years
Recertification	Earn 90 Continuing Professional Education (CPE) credits over 3 years Minimum 30 CPEs per year Retake and pass the current exam

Certified in Governance, Risk, and Compliance

What's Included

Complete Exam Package

Multiple Exam Modes

Lifetime Updates

Money Back Guarantee

Exam Details