CGSP study guide
CGSP · Work through your exam, one topic at a time.
The Certified Governance, Security and Privacy Professional (CGSP) is a vendor-neutral credential for practitioners who sit where compliance, security and privacy overlap: GRC analysts and managers, privacy officers, security architects, data stewards, internal auditors and consultants advising on these topics. It signals that the holder can reason across the three disciplines rather than treat them as separate silos, which is exactly what regulators and business partners now expect. The CGSP study guide has 6 sections and about 2,699 words.
01Governance, Risk and Compliance
GRC items test whether you can connect three things usually managed in separate silos: the direction set at the top (governance), the uncertainty that threatens it (risk), and the external rules that constrain it (compliance). Expect scenarios where a control exists but the governance around it does not, and items that ask which risk response is appropriate rather than which control is technically strongest.
468 words, about 2 min02Information Security
Items test the security programme as a system: how confidentiality, integrity and availability objectives become controls, how identity is managed, and how vulnerabilities become risks. You are usually asked for the next action or the most appropriate control, so scope, ownership and asset criticality matter more than tooling brand names.
434 words, about 2 min03Privacy
Privacy items test whether you can apply principles to a concrete data flow: what the lawful basis is, what notice was given, how long data is kept, where it travels, and what happens when it goes wrong. The exam expects GDPR-shaped reasoning even where another regime applies.
473 words, about 2 min04Data Governance
Data governance items test whether you can assign accountability for data and keep it fit for purpose across its lifecycle. The exam separates governance (decision rights and rules) from management (execution), and it strongly favours questions about who owns what.
431 words, about 2 min05Audit, Assurance and Incident Management
Two linked areas: how assurance is obtained and how incidents are handled. Expect items on audit evidence, report types and coverage periods, and on the correct sequence of incident response steps.
444 words, about 2 min06Ethics and Professional Conduct
Ethics items are scenario-based: a stakeholder applies pressure, a conflict emerges, or a finding is inconvenient. The exam rewards the answer that protects integrity, documents the decision and escalates through the correct channel - not the answer most loyal to the employer.
449 words, about 2 min