CAP (ABRET) study guide
CAP · Work through your exam, one topic at a time.
The CGRC (Governance, Risk and Compliance Certification, formerly known as CAP) is an ISC2 credential that, in ISC2's words, "Shows advanced technical skills and knowledge to protect, authorize and maintain information systems within various risk management frameworks." It is aimed at IT, information security and information assurance practitioners working in GRC roles who need to understand, apply or implement a risk management program for IT systems. ISC2 lists typical job titles including cybersecurity auditor, compliance officer, GRC analyst, GRC manager, GRC architect, third-party risk manager, enterprise risk manager and information assurance manager. The CAP study guide has 7 sections and about 2,738 words.
01Security and Privacy Governance, Risk Management, and Compliance Program
The first domain tests whether you understand why an authorization decision exists at all: the laws, policies, and organizational machinery that force a system to be categorized, documented, assessed, and formally accepted. Expect questions on statutory roles, the three-tiered risk model, and who may accept which kind of risk.
413 words, about 2 min02Scope of the System
The scope domain tests whether you can draw a defensible line around a system and categorize it correctly, because everything downstream - baseline selection, assessment, authorization - depends on that line. NIST SP 800-37 treats a system as a discrete set of information resources with a defined boundary.
420 words, about 2 min03Selection and Approval of Framework, Security, and Privacy Controls
The third domain tests control selection and the approval that legitimizes it: choosing a framework, selecting and tailoring a baseline, and getting the AO to approve the resulting set before implementation. The framework is the organized set of controls and assessment guidance the organization adopts - most commonly the NIST RMF with SP 800-53 Rev.
406 words, about 2 min04Implementation of Security and Privacy Controls
The implementation domain tests whether you can turn an approved control set into documented, operating practice - and prove it. The core artifact is the System Security Plan (SSP), which must be accurate enough that an independent assessor can test against it.
368 words, about 2 min05Assessment/Audit of Security and Privacy Controls
The assessment domain tests the independent evaluation of controls and the quality of evidence behind each conclusion. The Security Control Assessor (SCA) must be independent of the system owner and implementers, and reports findings to the AO.
366 words, about 2 min06System Compliance
System compliance is where the authorization decision is made and defended. The exam expects you to assemble the authorization package, reason about residual risk, and choose the right decision type.
384 words, about 2 min07Compliance Maintenance
Compliance maintenance tests whether you can keep an authorization valid: monitoring controls continuously, managing change, closing POA&Ms, and reauthorizing when the risk posture shifts. NIST SP 800-137 defines an information security continuous monitoring (ISCM) program with six steps: define the strategy, establish the program, implement it, analyze and report findings, respond, and review and update.
381 words, about 2 min