CGRC study plan

Diagram the governance hierarchy and map decision rights for executives, the risk executive function, the authorizing official, and the system owner to the artifacts each produces.

Explain the risk management process components (frame, assess, respond, monitor) and match each to a concrete governance artifact.

Differentiate laws, regulations, standards, policies, and procedures and supply one CGRC-relevant example of each.

Build a glossary of at least 30 Domain 1 terms, including risk appetite, risk tolerance, inherent risk, residual risk, and the four risk response types.

Identify privacy and ethical obligations that constrain a security and privacy compliance program.

Perform a FIPS 199 categorization across confidentiality, integrity, and availability for a sample system and justify the resulting high-water mark.

Draw a system boundary that separates system components, interconnected systems, and the environment of operation.

Document system registration inputs: mission or business function, information types, user populations, and deployment environment.

Trace how organizational risk tolerance translates into system-level risk decisions and categorization choices.

Re-test Domain 1 weak areas identified in the week 1 self-quiz.

Compare at least three control frameworks (for example NIST, ISO/IEC 27001, COBIT) on purpose, structure, and applicability, and select one for a scenario with written rationale.

Select a NIST SP 800-53B baseline that matches the FIPS 199 categorization and document tailoring decisions, including scoping, parameterization, and compensating controls.

Classify controls as common, hybrid, or system-specific and assign inheritance responsibility to a named owner.

Assemble a control selection package that supports authorizing official approval, including justification for every deviation from the baseline.

Write implementation statements that state what is done, where, how, by whom, and with what evidence, avoiding future-tense placeholders.

Distinguish implemented, planned, alternative, and not-applicable control states and record each correctly in the system security plan.

Specify the evidence each control will generate, such as configuration exports, screenshots, signed policies, or log samples.

Sequence implementation tasks against dependencies, resource constraints, and a schedule.

Review the system security plan against a quality checklist before peer review.

Write an assessment plan that specifies objectives, methods, sampling approach, scope, and assessor independence requirements.

Apply the examine, interview, and test methods to at least five controls and record objective evidence for each.

Separate findings from observations and rate each by likelihood and impact.

Draft per-control determination statements and assemble them into a security assessment report.

Compare authorization decisions (ATO, DATO, IATO, denial) and identify the residual risk each one accepts and who accepts it.

Assemble an authorization package from the system security plan, security assessment report, and plan of action and milestones, and defend its completeness.

Write plan of action and milestones entries with milestones, resources, responsible parties, and remediation dates.

Draft a continuous monitoring strategy that is explicitly tied to the authorization decision and its conditions.

Design a continuous monitoring calendar covering automated data feeds, annual assessments, and control re-testing cadence.

Explain how change management, significant-change triggers, and reauthorization decisions connect to one another.

Define compliance metrics and reporting cadence for executives and the authorizing official.

Re-test the three weakest domains identified by prior quizzes and close at least ten gaps.

Complete two timed 125-question practice exams under exam conditions and score at least 80% on each.

Convert every missed question into a one-line knowledge gap note and close the 15 highest-priority gaps.

Recite all seven domains and their key artifacts from memory in under ten minutes.

Finalize exam-day logistics, including scheduling, identification, and time-management plan.