If your work involves categorizing systems, selecting controls, preparing authorization packages, or keeping systems compliant after they go live, ISC2’s Certified in Governance, Risk and Compliance (CGRC)® is built for you. The exam covers the full life cycle of a system’s security and privacy compliance, so the breadth can feel intimidating at first. The good news is that ISC2 publishes exactly what it tests, and a plan built around that outline gives you a clear path to passing on your first try.

In this guide, we’ll walk you through the exam format, all seven domains and their weights, the official resources worth downloading, and the questions candidates ask most often.

What Is the ISC2 CGRC Exam?

The CGRC is ISC2’s credential for governance, risk, and compliance (GRC) professionals. It was previously known as the Certified Authorization Professional (CAP)®, and it has deep roots in the U.S. federal authorization process. According to the CGRC Certification Exam Outline, CGRC holders “have the knowledge and skills to integrate governance, performance management, risk management, and regulatory compliance within the organization.”

In practice, the exam follows a system from start to finish: defining its scope, choosing and implementing controls, assessing them, getting a risk decision from leadership, and maintaining compliance until the system is retired. Many questions use the language of the NIST Risk Management Framework (RMF), but the current outline also names ISO/IEC standards, FedRAMP, PCI DSS, CMMC, HIPAA, and GDPR, so you need a framework-neutral understanding of GRC as well.

What Is the CGRC Exam Format?

Here is the exam at a glance, based on the exam outline and ISC2’s CGRC certification page:

  • Questions: 125 items.
  • Question types: Multiple choice and advanced item types.
  • Time: 3 hours.
  • Passing score: 700 out of 1,000 points.
  • Language: English.
  • Delivery: In person at Pearson VUE testing centers. ISC2’s FAQ states that online proctoring isn’t offered because it doesn’t meet ISC2’s exam security standards.
  • Results: You typically get your pass/fail result at the test center when you finish. ISC2 doesn’t release numeric scores, but candidates who don’t pass receive domain-level proficiency feedback.

With 180 minutes for 125 items, you have a little under 90 seconds per question. That’s comfortable if you can quickly place each scenario in the system life cycle.

What Content Outline Does the CGRC Exam Use?

The current exam follows the ISC2 CGRC Certification Exam Outline, effective June 15, 2024. It divides the exam into seven domains and 24 task statements. Approximate item counts below are calculated from ISC2’s percentages and the 125-item total.

  • Domain 1, Security and Privacy Governance, Risk Management, and Compliance Program: 16% (about 20 items)
  • Domain 2, Scope of the System: 10% (about 12 or 13 items)
  • Domain 3, Selection and Approval of Framework, Security, and Privacy Controls: 14% (about 17 or 18 items)
  • Domain 4, Implementation of Security and Privacy Controls: 17% (about 21 items)
  • Domain 5, Assessment/Audit of Security and Privacy Controls: 16% (about 20 items)
  • Domain 6, System Compliance: 14% (about 17 or 18 items)
  • Domain 7, Compliance Maintenance: 13% (about 16 items)

Domain 1: Security and Privacy Governance, Risk Management, and Compliance Program (16%)

This foundation domain tests how a GRC program is built and who does what within it.

  • Principles of governance, risk management, and compliance, plus risk management frameworks such as NIST, COBIT, and ISO/IEC.
  • System development life cycle (SDLC) phases and information life cycle management.
  • Confidentiality, integrity, availability, non-repudiation, and privacy concepts.
  • Roles and responsibilities, system assets, and boundaries.
  • Familiarity with frameworks (ISO/IEC, FedRAMP, PCI DSS, CMMC) and laws (FISMA, HIPAA, GDPR, executive orders).

Study tip: Know the RMF roles cold, especially the authorizing official, system owner, common control provider, information system security officer, and control assessor. Many questions hinge on who has the authority to act.

Domain 2: Scope of the System (10%)

This domain covers describing the system and determining its compliance requirements.

  • Document the system name, scope, purpose, and functionality.
  • Identify the information types the system processes, stores, or transmits.
  • Set security objectives for each information type and determine the risk impact level.

What questions look like: Expect a system that handles several information types with different impact ratings. You’ll need to apply the high-water mark to reach the overall categorization.

Domain 3: Selection and Approval of Framework, Security, and Privacy Controls (14%)

Here you choose the controls that fit the system. That means starting from a baseline, identifying what’s inherited, tailoring, and getting stakeholder agreement.

  • Identify and document baseline and inherited controls.
  • Select appropriate control enhancements and data handling and marking requirements.
  • Document control selection and a strategy for continued compliance.
  • Allocate controls and obtain stakeholder agreement.

Study tip: Be clear on the difference between tailoring a baseline, inheriting a common control, and using a compensating control.

Domain 4: Implementation of Security and Privacy Controls (17%)

The most heavily weighted domain covers implementing selected controls and documenting them accurately.

  • Develop an implementation strategy aligned with requirements, and identify control types.
  • Set the frequency for documentation reviews and training.
  • Implement controls consistent with requirements, including compensating or alternate controls.
  • Document residual risk, planned implementations, and how each control is implemented.

What questions look like: A control can’t be implemented as written. The best answer usually involves a documented compensating control and a record of the residual risk, not quietly skipping the control.

Domain 5: Assessment/Audit of Security and Privacy Controls (16%)

This domain follows the assessment from planning to the final report and risk response plan. It has the most task statements (six) of any domain.

  • Define roles, objectives, scope, resources, schedule, and deliverables, and finalize the assessment plan.
  • Verify controls using the interview, examine, and test methods, and validate evidence.
  • Record preliminary findings and risks in an initial report.
  • Assign risk responses (avoid, accept, share, mitigate, or transfer) with stakeholders, and reassess non-compliant findings.
  • Finalize the assessment report, identify residual risks, prioritize them, and identify required resources.

Study tip: Learn the order of events. The assessor reports findings; the system owner and leadership decide on the response.

Domain 6: System Compliance (14%)

System Compliance is about the risk decision. Documentation is compiled and submitted, the system’s risk posture is determined, and the decision is formally communicated.

  • Compile, review, and submit security and privacy documentation.
  • Apply risk acceptance criteria, determine residual risk, and obtain stakeholder concurrence.
  • Issue formal notification of the compliance decision and share it with stakeholders.

What questions look like: Know who makes the call. In the RMF, only the authorizing official can accept risk on behalf of the organization.

Domain 7: Compliance Maintenance (13%)

Compliance doesn’t end at authorization. This domain covers the system’s operational life through decommissioning.

  • Perform change management that weighs impact to risk, operations, and compliance, with rollback plans.
  • Set review frequencies, monitor systems, perform security updates, and revise monitoring strategies.
  • Support incident response, contingency activities, and awareness training.
  • Engage in audits through testing, vulnerability scanning, and personnel interviews.
  • Decommission systems and retain documentation.

Study tip: Connect continuous monitoring back to the strategy developed during control selection.

How Should You Use the CGRC Blueprint to Build a Study Plan?

The domain weights are fairly even, ranging from 10% to 17%. That means you can’t skip any domain and still expect a comfortable margin. Here’s a practical approach:

  1. Take a baseline. Answer a mixed set of practice questions before you start reviewing so you know which domains need the most attention.
  2. Learn the life cycle first. Domains 2 through 7 follow a system from scoping to decommissioning. If you can place any scenario on that timeline, many questions become easier.
  3. Map every miss to a task statement. With 24 tasks, patterns show up quickly. For example, you might find you’re strong on assessment methods but weak on risk response.
  4. Finish with timed, mixed practice. In the final weeks, practice at about 85 seconds per question.

What Official Resources Should You Use?

  • CGRC Certification Exam Outline: Domains, weights, task statements, and exam format.
  • ISC2 CGRC Ultimate Guide: An overview of the certification, requirements, job roles, and ISC2 training options.
  • ISC2 FAQ: Results, endorsement, and test center policies.
  • Free NIST publications: SP 800-37 Rev. 2 (the RMF), SP 800-53 Rev. 5 and SP 800-53B (controls and baselines), SP 800-53A Rev. 5 (assessment procedures), FIPS 199 and FIPS 200 (categorization), and SP 800-137 (continuous monitoring).

Commonly used CGRC study textbooks:

  • Information Security Risk Management for ISO 27001/ISO 27002, 3rd Edition – PDF (ISBN 978-1787781375)
  • ISO 27001/ISO 27002: A Pocket Guide, 2nd Edition – PDF (ISBN 978-1849285230)
  • Official (ISC)2® Guide to the CAP® CBK®, 2nd Edition (ISBN 978-1439820759)

Frequently Asked Questions About the ISC2 CGRC Exam

What is the passing score for the CGRC?
You need 700 out of 1,000 scaled points. ISC2 reports pass/fail rather than a numeric score.

How soon will I get my results?
You usually receive your result at the Pearson VUE test center right after the exam. ISC2’s FAQ notes that the emailed copy can take up to 72 business hours.

What happens if I don’t pass?
Under ISC2’s retake policy, you can retest after 30 days following a first attempt, 60 days after a second, and 90 days after a third or later attempt, with a maximum of four attempts in 12 months. Each attempt requires a new exam fee unless you bought an ISC2 bundle that includes a retake.

Has the CGRC outline changed recently?
The latest outline took effect June 15, 2024. It renamed several domains to emphasize governance, privacy, and frameworks, and it lists frameworks and laws such as ISO/IEC, FedRAMP, PCI DSS, CMMC, and GDPR alongside NIST.

Can I take the exam before I have the required experience?
Yes. If you pass without the two years of experience, you can become an Associate of ISC2 and then earn the experience within three years.

How much does the exam cost?
ISC2’s exam pricing page lists the CGRC at U.S. $599 in the Americas. Prices vary by region, and taxes may apply.

How do I maintain the CGRC certification?
You earn 60 continuing professional education (CPE) credits every three years and pay an annual maintenance fee (AMF) of U.S. $135.

Start Preparing for the ISC2 CGRC Exam With Pocket Prep

Pocket Prep’s ISC2 CGRC practice questions give you 500 exam-style questions across all seven domains, each with a detailed explanation of why the best answer is correct. Start with a Weakest Subject quiz to find your gaps, then build stamina with Timed Quiz sessions. With a clear plan and steady practice, you can walk into the test center ready.