CGRC case studies

The CGRC (Governance, Risk and Compliance Certification) is an ISC2 credential for practitioners who protect, authorize and maintain information systems inside risk management frameworks. ISC2 positions it for IT, information security and information assurance professionals working in GRC roles - auditors, compliance officers, GRC analysts, architects and managers, third-party risk managers and enterprise risk managers - who need to understand, apply or implement a risk management program for organizational IT systems. The exam is organized into seven published domains: the governance, risk management and compliance program itself; scoping the system; selecting and approving frameworks plus security and privacy controls; implementing those controls; assessing and auditing them; system compliance; and ongoing compliance maintenance. ISC2 lists two years of required work experience alongside the exam, and the credential is ANAB-accredited under ISO/IEC 17024 and approved under U.S. The CGRC case studies are 5 cases and about 3,467 words.