CGRC Governance, Risk and Compliance Certification Training

🧩 The CGRC (Certified in Governance, Risk, and Compliance) certification, offered by (ISC)², is designed for professionals who manage, implement, and monitor information security risk and compliance frameworks. To be eligible for the CGRC credential, candidates must meet certain experience and knowledge requirements.

🧩 Domain 1: Information Security Risk Management Program (15%) Focus: Establishing and managing a security risk management framework. Topics include: Understanding organizational risk tolerance and appetite Governance and compliance requirements (e.g., NIST, ISO, COBIT) Roles and responsibilities in a risk management program Integrating security with enterprise risk management (ERM) Security authorization boundaries and system categorization 🧱 Domain 2: Scope of the Information System (11%) Focus: Determining system boundaries and identifying assets. Topics include: Identifying system components, environments, and interfaces Defining authorization boundaries Documentation requirements for system components Managing hybrid cloud and on-premise systems Data classification and ownership 📋 Domain 3: Selection and Approval of Security and Privacy Controls (15%) Focus: Selecting appropriate controls and frameworks. Topics include: Using NIST SP 800-53, ISO 27001, and other control frameworks Control baselines and tailoring processes Security and privacy control selection Risk assessment and residual risk evaluation Documenting control selections in security plans 🛠️ Domain 4: Implementation of Security and Privacy Controls (16%) Focus: Implementing the selected controls across systems. Topics include: Implementation methods and verification techniques Control inheritance and shared responsibility models Security engineering principles and best practices Continuous monitoring setup and configuration Documentation of control implementation 🔍 Domain 5: Assessment/Audit of Security and Privacy Controls (16%) Focus: Evaluating how effective implemented controls are. Topics include: Assessment procedures (e.g., NIST SP 800-53A) Control testing and validation techniques Conducting audits and vulnerability assessments Collecting, analyzing, and reporting assessment data Continuous monitoring feedback loops ✅ Domain 6: Authorization/Approval of Information System (10%) Focus: Making the system operational while managing risks. Topics include: Security authorization process (e.g., NIST RMF Step 5) Risk acceptance and mitigation strategies Security plan, risk assessment report, and POA&M documentation Continuous authorization and ongoing monitoring approvals Communicating risk to executives and stakeholders 🔄 Domain 7: Continuous Monitoring (17%) Focus: Maintaining security and compliance throughout the system lifecycle. Topics include: Continuous control monitoring and reporting Threat intelligence and real-time alerting Configuration management and change control Incident response integration with compliance requirements Updating documentation and reauthorization cycles

Component Details Certification Name CGRC – Certified in Governance, Risk and Compliance Offered By (ISC)² (International Information System Security Certification Consortium) Exam Type Multiple-choice (single best answer) Number of Questions 125 Duration 4 hours (240 minutes) Passing Score 700 out of 1000 Delivery Method Computer-based, via Pearson VUE testing centers Exam Language English

❌ No, the CGRC (Certified in Governance, Risk and Compliance) certification is not directly aligned with Splunk certification exams.

The CGRC (Certified in Governance, Risk and Compliance) training — offered by (ISC)² and authorized training partners — is designed to help learners fully understand and apply the seven domains of the CGRC Common Body of Knowledge (CBK).