CAP (ABRET)
CGRC – Governance, Risk and Compliance Certification
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The CGRC (Governance, Risk and Compliance Certification, formerly known as CAP) is an ISC2 credential that, in ISC2's words, "Shows advanced technical skills and knowledge to protect, authorize and maintain information systems within various risk management frameworks." It is aimed at IT, information security and information assurance practitioners working in GRC roles who need to understand, apply or implement a risk management program for IT systems. ISC2 lists typical job titles including cybersecurity auditor, compliance officer, GRC analyst, GRC manager, GRC architect, third-party risk manager, enterprise risk manager and information assurance manager. The exam is organized into seven domains: the governance, risk management and compliance program; scope of the system; selection and approval of framework, security and privacy controls; implementation of controls; assessment/audit of controls; system compliance; and compliance maintenance. ISC2 states that two years of required work experience apply, that the credential is ANAB accredited under ISO/IEC Standard 17024 and that it is approved by the U.S. Department of Defense under DoDM 8140.03. For preparation, ISC2 points candidates to official training (adaptive learning, online self-paced and online instructor-led options), self-study tools, authorized training partners and free resources such as the CGRC Ultimate Guide, a knowledge check and flash cards. This page is independent study material and is not affiliated with or endorsed by ISC2.
What you'll study
About CAP preparation
How is the CGRC exam structured?
ISC2 publishes a seven-domain CGRC exam outline covering governance and the GRC program, system scope, framework and control selection and approval, control implementation, assessment/audit, system compliance and compliance maintenance. The official source page does not state the number of items, the time limit or the passing score, so confirm those details against the current ISC2 exam outline before you book.
Do I need work experience to earn the CGRC?
Yes. ISC2 lists two years of required work experience alongside the exam outline. The source page does not break that experience down by domain or describe a waiver path, so check the current ISC2 certification requirements page for how experience is validated and what options exist if you do not yet meet it.
How long do I have to sit the exam after buying it?
An exam-only purchase must be scheduled and administered within 365 days of purchase and includes one attempt. If you buy the Peace of Mind Protection version, you get two attempts and 180 days from purchase to sit both, subject to the ISC2 Retake Policy. Training bundles vary: self-paced access runs 90 or 180 days while the exam window stays 365 days.
What happens if I fail on the first attempt?
A single exam-only purchase includes one attempt, so a retake means buying another exam. The Peace of Mind Protection option bundles two attempts at a lower cost than two single exams, with 180 days from purchase to sit both, in accordance with the ISC2 Retake Policy. The source does not state a waiting period between attempts, so verify that with ISC2.
Which study order works best for the seven domains?
Follow the natural workflow the domains describe. Start with the GRC program and system scope, since you cannot select controls without knowing the system boundary. Then move through framework and control selection and approval, implementation, and assessment/audit. Finish with system compliance and compliance maintenance, which depend on evidence produced by the earlier phases.
What trips candidates up most often?
Two patterns dominate. First, memorizing frameworks instead of learning how to choose and justify one for a given system, which is what the selection and approval domain tests. Second, treating assessment as a paperwork exercise rather than evidence gathering that feeds an authorization decision. Practicing how findings become compliance determinations and ongoing maintenance activities addresses both.
Is the CGRC recognized by employers and governments?
ISC2 states the credential is ANAB accredited under ISO/IEC Standard 17024 and approved by the U.S. Department of Defense under DoDM 8140.03. ISC2 also describes rising demand for GRC expertise. Those claims come from ISC2's own pages; evaluate them against the job market and any employer-specific requirements that apply to you.
What training options does ISC2 offer for the CGRC?
ISC2 lists CGRC Adaptive Learning, online self-paced training available in 90-day and 180-day access options, and online instructor-led training taught live by an ISC2 authorized instructor with full-time and part-time schedules. Instructor-led materials run 180 days from your first live session. ISC2 also offers free resources including the Ultimate Guide, a knowledge check and flash cards.
Who should pursue the CGRC rather than a broader certification?
ISC2 positions it for practitioners whose work is authorizing and maintaining systems within risk management frameworks, such as cybersecurity auditors, compliance officers, GRC analysts and managers, risk and controls analysts, third-party risk managers and information assurance managers. If your day-to-day work is engineering, operations or architecture rather than governance and authorization, a different ISC2 credential may fit better.