CGRC
ISC2 CGRC - Governance, Risk and Compliance Certification
More study resources
Cheat sheet
Keep the key ideas within reach.
ExploreKey terms
Get comfortable with the vocabulary.
ExploreStudy plan
Give each week a clear focus.
ExploreCommon mistakes
Understand the traps and how to avoid them.
ExploreCase studies
Put your knowledge to work in context.
ExploreExam-day guide
Prepare for the day ahead.
ExploreAbout this exam
The CGRC (Governance, Risk and Compliance Certification) is an ISC2 credential for practitioners who protect, authorize and maintain information systems inside risk management frameworks. ISC2 positions it for IT, information security and information assurance professionals working in GRC roles - auditors, compliance officers, GRC analysts, architects and managers, third-party risk managers and enterprise risk managers - who need to understand, apply or implement a risk management program for organizational IT systems. The exam is organized into seven published domains: the governance, risk management and compliance program itself; scoping the system; selecting and approving frameworks plus security and privacy controls; implementing those controls; assessing and auditing them; system compliance; and ongoing compliance maintenance. ISC2 lists two years of required work experience alongside the exam, and the credential is ANAB-accredited under ISO/IEC 17024 and approved under U.S. DoD 8140.03. Preparation options published by ISC2 include the official exam outline, an adaptive learning tool, self-paced online training in 90-day and 180-day access versions, live online instructor-led training, and published guides and flashcards. This page is independent study material and is not affiliated with or endorsed by ISC2.
What you'll study
About CGRC preparation
How many questions are on the CGRC exam and how long do I get?
ISC2's public certification page does not state a question count or a time limit. Treat any specific number you see elsewhere as unverified and confirm the current structure in the official CGRC Exam Outline before you build a timing strategy around it.
What score do I need to pass?
The passing score is not published on the ISC2 page used for this guide, so no numeric target is given here. ISC2 exams are typically scored against a scaled passing standard rather than a raw percentage, so aim to be consistently strong across all seven domains instead of chasing a cutoff.
Do I need work experience before I can take the exam?
ISC2 lists two years of required work experience for the CGRC. You can still sit the exam and become an associate while you finish the experience requirement, but plan for it early because it determines when you move from associate to fully certified.
How many attempts do I get, and how long do I have to schedule?
An exam-only purchase requires the exam code to be scheduled and administered within 365 days of purchase and includes one attempt. The Peace of Mind option bundles two attempts at lower cost than two single exams, with 180 days from purchase to sit both, subject to the ISC2 Retake Policy.
Which training format should I choose?
ISC2 offers an adaptive learning tool, 90-day and 180-day self-paced online training, and live online instructor-led courses, some bundled with the exam. Choose self-paced if you need scheduling flexibility and instructor-led if you want accountability; exam bundles add a 365-day window to sit the test.
In what order should I study the seven domains?
Follow the lifecycle order ISC2 publishes: build the governance, risk and compliance program first, then scope the system, select and approve frameworks and controls, implement them, assess and audit, determine system compliance, and finally maintain compliance. Each domain assumes the outputs of the previous one, so skipping ahead makes the later domains feel abstract.
What causes candidates to fail?
The most common pattern is memorizing control catalogs without being able to place a control in the authorization lifecycle. The exam rewards knowing what artifact comes next and who owns it. Weak scoping habits and vague answers about assessment evidence also cost points, because both drive every downstream decision.
Is the CGRC recognized outside the private sector?
The credential is ANAB-accredited against ISO/IEC 17024 and is approved under U.S. DoD 8140.03, which matters for defense and public-sector roles. ISC2 also positions it for commercial GRC roles, so it travels across sectors, though always verify an individual employer's requirements.
How much does the exam cost?
ISC2 does not list a fee on the certification page used for this guide, and pricing varies by region, membership status and bundle. Check the ISC2 store for your location before budgeting, and note that the Peace of Mind bundle changes the effective per-attempt cost.