ISC2 CGRC exam guide covering governance, risk, controls, and compliance decisions.
This Governance, Risk and Compliance Certification guide helps CGRC candidates focus on what the exam tests, where close answers usually split, and which review page to use next.
Use the study plan to sharpen risk, control, and incident-response decisions, the cheat sheet for last-mile review, the sample questions for decision practice, the FAQ for scope checks, the resources page for ISC2 exam references, and the glossary when control names blur together.
| Item | Guide value |
|---|---|
| Vendor | ISC2 |
| Exam or credential | Governance, Risk and Compliance Certification |
| Code or shorthand | CGRC |
| Study level | GRC practitioner |
| IT Mastery page | CGRC exam page |
| Guide shape | Start-here page, study plan, cheat sheet, FAQ, resources, and glossary. |
| Lane | What to master | Common weak answer |
|---|---|---|
| Governance and risk management | Align risk appetite, policies, roles, controls, and executive oversight. | Jumping to implementation before defining risk and authority. |
| Authorization and assurance | Understand control selection, assessment, evidence, remediation, authorization, and continuous monitoring. | Treating authorization as a one-time paperwork step. |
| Compliance and frameworks | Map laws, standards, control catalogs, audit needs, and reporting expectations. | Confusing framework compliance with actual risk reduction. |
| Privacy and data protection | Manage data inventory, classification, consent, retention, privacy controls, and impact. | Ignoring data lifecycle and subject rights. |
| Third-party and program management | Assess vendors, contracts, SLAs, shared controls, reporting, and ongoing monitoring. | Approving suppliers once and never monitoring performance. |
CGRC answers should connect policy, risk, controls, evidence, authorization, monitoring, and accountability.
Use the current ISC2 exam page for live exam details, including name, status, pricing, duration, delivery method, languages, retirement or beta changes, and domain weights where applicable.