OpenExamsFREE PRACTICE — ANY EXAM

Certified in Governance, Risk and Compliance — Requirements & Free Practice

US · License preparation

200 free questions · Answer explanations · No signup required

Choose what to practice

Start with an exam below. Your examination requirements depend on your application pathway. View licensing requirements

Loading selected examination banks…

Licenses, application pathways and examination requirements

Each license and applicant pathway has its own requirements and exemptions. Choosing practice questions does not determine your eligibility.

Certified in Governance, Risk and Compliance

Licensing authority: ISC2 · Application information

Initial by examination
CGRC Exam
Associate
A candidate without the required experience may become an Associate of ISC2 after passing the CGRC examination and has three years to earn the required experience.
Endorsement
Complete the ISC2 certification application after passing the exam and within nine months of the exam date; endorsement and experience evidence are required.
Experience
Two cumulative full-time years in one or more current CGRC outline domains; part-time work and internships may count.

CGRC Exam

Provider
Pearson VUE Testing Center
Format
Multiple choice and advanced item types
Exam questions
Total questions: 125.
Time limit
3 hours
Passing score
700 out of 1000 points
Examination outline
  • Security and Privacy Governance, Risk Management, and Compliance Program (16%)
    • Demonstrate knowledge in security and privacy governance, risk management, and compliance program
    • Demonstrate knowledge in security and privacy governance, risk management and compliance program processes
    • Demonstrate knowledge of compliance frameworks, regulations, privacy, and security requirements
  • Scope of the System (10%)
    • Describe the system
    • Determine security compliance required
  • Selection and Approval of Framework, Security, and Privacy Controls (14%)
    • Identify and document baseline and inherited controls
    • Select and tailor controls
  • Implementation of Security and Privacy Controls (17%)
    • Develop implementation strategy
    • Implement selected controls
    • Document control implementation
  • Assessment/Audit of Security and Privacy Controls (16%)
    • Prepare for assessment/audit
    • Conduct assessment/audit
    • Prepare the initial assessment/audit report
    • Review initial assessment/audit report and plan risk response actions
    • Develop final assessment/audit report
    • Develop risk response plan
  • System Compliance (14%)
    • Review and submit security/privacy documents
    • Determine system risk posture
    • Document system compliance
  • Compliance Maintenance (13%)
    • Perform system change management
    • Perform ongoing compliance activities based on requirements
    • Engage in audits activities based on compliance requirements
    • Decommission system when applicable
Examination sources