Every organization that handles sensitive data needs people who can turn laws, frameworks, and risk appetite into controls that work and evidence that holds up. The Certified in Governance, Risk and Compliance (CGRC)® from ISC2 recognizes professionals who do that work, from categorizing a new system to guiding it through authorization and ongoing compliance.

If you’re wondering whether the CGRC fits your career, we’ll walk you through who it’s for, the eligibility requirements, how long to study, where it can take you, and what comes next.

Who Should Take the ISC2 CGRC Exam?

The CGRC is designed for practitioners who work in risk and compliance within cybersecurity. It’s a strong fit if you:

  • Work on authorization packages for federal agencies, the Department of Defense, or government contractors, including system security plans, assessment reports, and plans of action and milestones (POA&Ms).
  • Serve as an information system security officer (ISSO) or security control assessor and want a credential that matches the RMF work you do every day.
  • Are a GRC analyst or compliance officer in industries governed by HIPAA, PCI DSS, GDPR, or ISO/IEC 27001.
  • Work in IT audit or third-party risk and evaluate controls, evidence, and residual risk.
  • Support cloud or defense contractors preparing for FedRAMP or CMMC assessments.

ISC2’s CGRC guide lists roles such as cybersecurity auditor, cybersecurity compliance officer, GRC analyst, manager, architect, or director, cybersecurity risk and controls analyst, third-party risk manager, enterprise risk manager, and information assurance manager.

Who Might Want to Wait?

If your background is mostly hands-on technical work, such as network administration or incident response, you may know the controls but not the governance process around them. You can still take the exam, but plan extra time for categorization, assessment, and authorization concepts. If you’re brand new to cybersecurity, ISC2’s Certified in Cybersecurity (CC) is a lower-stakes starting point.

What Are the CGRC Eligibility Requirements?

According to ISC2’s CGRC experience requirements, you need at least two years of cumulative, full-time experience in one or more of the seven domains in the CGRC exam outline. Key details:

  • Full-time work: At least 35 hours per week for four weeks earns one month of experience.
  • Part-time work: 20 to 34 hours per week counts. 1,040 part-time hours equal six months, and 2,080 hours equal 12 months.
  • Internships: Paid or unpaid internships count if documented on company or institutional letterhead.
  • No degree waiver: Unlike the CISSP, the CGRC doesn’t offer an education-based experience waiver.
  • Associate of ISC2: If you pass without the full experience, you become an Associate of ISC2 and have three years to earn the two years of experience.

How Do You Get Certified?

  1. Buy your exam through ISC2 and schedule it with Pearson VUE. ISC2’s pricing page lists the CGRC at U.S. $599 in the Americas, with regional prices elsewhere.
  2. Take the 125-item, 3-hour exam at a Pearson VUE test center. Online proctoring isn’t available.
  3. Complete the ISC2 endorsement process within nine months of passing. An ISC2 member in good standing verifies your experience, and you agree to the ISC2 Code of Ethics.
  4. Pay your first annual maintenance fee once you’re certified.

ISC2’s FAQ notes that endorsement review typically takes four to six weeks, so submit early.

How Long Should You Study for the CGRC Exam?

Most candidates need about two to four months of steady study, often five to eight hours per week.

  • RMF practitioners who already work on authorization packages may be ready in 6 to 8 weeks. Focus on the non-NIST frameworks and privacy topics that the 2024 outline added.
  • Auditors and compliance analysts outside government should plan for three to four months. RMF steps, roles, and documents like the SSP, SAR, and POA&M may be new to you.
  • Technical professionals moving into GRC should plan for the longer end and read NIST SP 800-37 Rev. 2 early.

Sample 12-Week CGRC Study Plan

  • Week 1: Read the exam outline, take a mixed baseline quiz, and skim NIST SP 800-37 Rev. 2 to learn the seven RMF steps.
  • Weeks 2 and 3: Domain 1 (16%). GRC principles, frameworks, laws, SDLC, and roles and responsibilities.
  • Week 4: Domain 2 (10%). Information types, FIPS 199 categorization, and system boundaries.
  • Week 5: Domain 3 (14%). SP 800-53 baselines, common and inherited controls, tailoring, and enhancements.
  • Weeks 6 and 7: Domain 4 (17%). Implementation strategy, compensating controls, and documenting control implementation.
  • Weeks 8 and 9: Domain 5 (16%). Assessment planning, interview, examine, and test methods, assessment reports, and risk response.
  • Week 10: Domains 6 and 7 (27% combined). Authorization packages, risk acceptance, change management, continuous monitoring, and decommissioning.
  • Weeks 11 and 12: Timed mixed practice, review of missed questions, and a final pass through your weakest domain.

What Careers Can the CGRC Support?

The CGRC supports roles where risk decisions and compliance evidence are central to the job. Common titles include:

  • GRC analyst, GRC manager, or GRC director
  • Information system security officer (ISSO) or information system security manager (ISSM)
  • Security control assessor or cybersecurity auditor
  • Compliance officer or risk and controls analyst
  • Third-party or vendor risk manager
  • Information assurance manager

These roles are common in federal agencies, defense contracting, healthcare, financial services, cloud service providers, and consulting. ISC2 notes that the CGRC is accredited under ANSI National Accreditation Board (ANAB) ISO/IEC 17024 and approved under DoD Manual 8140.03, which matters if you work in or with the Department of Defense.

What Is the Salary for CGRC Holders?

The U.S. Bureau of Labor Statistics (BLS) doesn’t track GRC professionals separately, but its closest category is information security analysts. According to the BLS Occupational Outlook Handbook, the median pay for information security analysts was $129,180 per year in May 2025.
The outlook is excellent. BLS projects employment of information security analysts to grow 21% from 2025 to 2035, much faster than the average for all occupations, with about 14,100 openings each year.

Pay varies with location, clearance level, industry, and scope of responsibility. A certification strengthens your case, but it’s one factor among many.

How Do You Maintain the CGRC?

The CGRC runs on a three-year certification cycle. Under ISC2’s member policies, you need 60 CPE credits per cycle, and ISC2 suggests earning about 20 each year so you aren’t scrambling at the end. You also pay an annual maintenance fee of U.S. $135, due each year on your certification anniversary.

Useful CPE activities for GRC professionals include training on new framework versions, attending ISC2 chapter meetings, and completing ISC2 webinars.

What Certifications Stack Well With the CGRC?

The best next step depends on where you want to go:

Start Preparing for the ISC2 CGRC Exam With Pocket Prep

Whatever your background, steady practice turns experience into a passing score. Pocket Prep’s ISC2 CGRC practice questions include 500 questions across all seven domains, each with a detailed explanation. Use Quick 10 on busy days and Missed Questions to lock in what you’ve learned. You’ve already done the hard work on the job, and now it’s time to prove it by earning the CGRC.