CGRC study guide
CGRC · Work through your exam, one topic at a time.
The CGRC (Governance, Risk and Compliance Certification) is an ISC2 credential for practitioners who protect, authorize and maintain information systems inside risk management frameworks. ISC2 positions it for IT, information security and information assurance professionals working in GRC roles - auditors, compliance officers, GRC analysts, architects and managers, third-party risk managers and enterprise risk managers - who need to understand, apply or implement a risk management program for organizational IT systems. The CGRC study guide has 7 sections and about 2,607 words.
01Security and Privacy Governance, Risk Management, and Compliance Program
Governance is the structure of decisions, accountability, and oversight that determines how much risk an organization will accept and who is allowed to accept it. Management is the execution layer that implements those decisions.
665 words, about 3 min02Scope of the System
An authorization boundary includes every component that processes, stores, transmits, or protects the system's data and functions - hardware, software, people, processes, facilities, interconnections, and supporting infrastructure, even when owned by a vendor. Under-scoping leaves real risk unassessed; over-scoping inflates cost and effort.
322 words, about 2 min03Selection and Approval of Framework, Security, and Privacy Controls
Common sources include NIST SP 800-53 with its 800-53B baselines, ISO/IEC 27001 Annex A, the NIST Cybersecurity Framework, CIS Controls, PCI DSS, and sector schemes. Select based on legal, regulatory, and contractual obligations plus mission and risk - not on familiarity or vendor preference.
331 words, about 2 min04Implementation of Security and Privacy Controls
Implementation converts the approved baseline into configuration, process, and evidence. The security plan records an implementation statement for each control: how it is implemented, where, by whom, whether it is inherited, and what evidence demonstrates it operates.
333 words, about 2 min05Assessment/Audit of Security and Privacy Controls
Assessment evaluates whether controls are designed and operating effectively against stated criteria. Audit is a formal, independent examination, often against an external standard.
312 words, about 2 min06System Compliance
The authorization package typically contains the security plan, the assessment report, the POA&M, and the continuous monitoring plan. The authorizing official reviews residual risk and issues an authorization to operate, an authorization with conditions, or a denial.
322 words, about 2 min07Compliance Maintenance
Controls drift as systems change, staff turn over, vendors change, and regulations evolve. Maintenance is a deliberate program of monitoring, scheduled review, and corrective action - not a certificate on a wall.
322 words, about 2 min