ISC2 CGRC

To qualify for the CGRC certification, candidates must meet the following requirements:

A minimum of two (2) years of cumulative, paid work experience in one or more of the CGRC domains:

• Information Security Risk Management Program
• Scope of the Information System
• Selection and Approval of Security and Privacy Controls
• Implementation of Security and Privacy Controls
• Assessment/Audit of Security and Privacy Controls
• Authorization/Approval of Information Systems
• Continuous Monitoring

Work experience must be verified by an employer.

Candidates without required experience can earn an Associate of ISC2 designation and gain the required experience within six (6) years.

Successfully pass the CGRC exam.

Agree to ISC2’s Code of Ethics and Continuing Professional Education (CPE) Policy.

• The CGRC certification is ideal for professionals involved in security governance, risk assessment, and compliance roles, including:
  • Information Security Managers
  • Risk Analysts
  • Compliance Officers
  • IT Auditors
  • Security Consultants
  • System Administrators
  • Cybersecurity Professionals focusing on risk management

• Globally Recognized: CGRC is a respected certification for security governance and risk professionals.
• Career Growth: Unlock opportunities in compliance, risk, and governance roles.
• Competitive Edge: Stand out in the cybersecurity industry with specialized expertise.
• Higher Earning Potential: CGRC-certified professionals command higher salaries.
• Compliance Readiness: Stay up to date with regulatory standards and risk management best practices.