CGSP study plan

Map the Governance, Risk and Compliance (GRC) domain into a personal outline covering governance structures, risk management, compliance obligations, and the three lines model.

Define and distinguish key GRC terms (policy, standard, procedure, guideline, control, risk appetite, risk tolerance) in your own words with one worked example each.

Explain how an organization's governance framework assigns accountability for information and privacy, and describe at least three common governance bodies and their responsibilities.

Build a one-page comparison of major compliance regimes (e.g., GDPR, HIPAA, SOX, ISO 27001) covering scope, enforcement, and evidence expectations.

Complete a full risk assessment cycle for a fictional organization: identify assets and threats, estimate likelihood and impact, and rank risks.

Select and justify risk treatment options (mitigate, transfer, avoid, accept) for the top five risks, and map each to a control type (preventive, detective, corrective).

Explain the CIA triad and how confidentiality, integrity, and availability objectives translate into concrete controls.

Describe how security policies, standards, and procedures differ and where each fits in a governance hierarchy.

Explain identity and access management concepts: authentication factors, authorization models (RBAC, ABAC), least privilege, and segregation of duties.

Describe common security architectures and controls (network segmentation, encryption in transit and at rest, logging and monitoring) and the risk each addresses.

Outline the phases of incident response and the security team's role in each, distinguishing it from the audit/assurance perspective.

Identify key security metrics and explain how they support governance reporting.

Define personal data, processing, controller, processor, and data subject, and apply these definitions to three realistic scenarios.

Explain the core privacy principles (lawfulness, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality, accountability) and give one control example for each.

Describe data subject rights and the operational process an organization must have to honor them within required timeframes.

Explain lawful bases for processing and how consent differs from other bases in practice.

Explain the components of a data governance program: ownership, stewardship, stewardship roles, data quality dimensions, and metadata management.

Describe how a data inventory or record of processing activities is built and maintained, and why it underpins both privacy and data governance.

Explain data classification schemes and how classification drives handling, retention, and access decisions.

Describe cross-border data transfer mechanisms and the governance questions they raise.

Explain the data lifecycle (creation, storage, use, sharing, retention, destruction) and identify governance controls at each stage.

Describe the audit process end to end: scoping, planning, evidence collection, testing, reporting, and follow-up.

Distinguish the types of audit evidence and explain what makes evidence sufficient and appropriate.

Explain how findings are rated and how remediation is tracked through to closure.

Explain incident management from detection through post-incident review, including escalation, notification obligations, and evidence preservation.

Describe how assurance activities (audits, reviews, testing) differ from management's own monitoring and why independence matters.

Apply an ethical decision-making framework to at least three scenarios involving data use, surveillance, or conflicting stakeholder interests.

Explain professional conduct expectations: objectivity, confidentiality, competence, due care, and conflicts of interest.

Synthesize all six domains into a single concept map showing how governance, security, privacy, data governance, assurance, and ethics interconnect.

Complete a timed 100-question practice set and review every incorrect answer to identify the underlying concept gap.

Revisit your weakest two domains and rewrite the notes for those areas in your own words.

Produce a one-page exam-day reference sheet of key definitions and frameworks you must recall from memory.