Governance, Risk and Compliance Certification (CGRC)

Overview

The ISC² Certified in Governance, Risk Management, and Compliance (CGRC) certification is designed for professionals who play key roles in managing and mitigating risks within organizations, particularly in the context of cybersecurity and information security.

The CGRC certification validates the skills and knowledge required to effectively manage governance, risk management, and compliance (GRC) processes within organizations.  It covers a wide range of topics related to governance, risk assessment, regulatory compliance, and implementing controls to mitigate risks.

Target Audience

The CGRC certification is targeted at professionals who have responsibilities related to governance, risk management, and compliance within organizations.  This includes roles such as risk managers, compliance officers, IT auditors, information security managers, and senior management executives.

Objectives

The CGRC certification exam covers several domains, each representing a different aspect of governance, risk management, and compliance:

• Domain 1: Information Security Risk Management Program
• Domain 2: Scope of the Information System
• Domain 3: Selection and Approval of Security and Privacy Controls
• Domain 4: Implementation of Security and Privacy Controls
• Domain 5: Assessment/Audit of Security and Privacy Controls
• Domain 6: Authorization/Approval of Information System
• Domain 7: Continuous Monitoring

Benefits

Prerequisites

• Professional Experience: Candidates must have a minimum of two years cumulative work experience in one or more of the seven domains of the CGRC CBK.  This may include experience in risk management, compliance management, auditing, information security management, or related fields.

• Knowledge of GRC Principles: Candidates should have a strong understanding of governance, risk management, and compliance principles, frameworks, and best practices.  This includes knowledge of relevant standards, regulations, and industry guidelines related to GRC.

• Advanced Education or Training: While not explicitly required, candidates with advanced education or training in GRC-related fields may have an advantage.  This could include a bachelor’s or master’s degree in fields such as cybersecurity, risk management, compliance, business administration, or a related discipline.

• Industry Certifications: Candidates may benefit from holding other relevant certifications in GRC, cybersecurity, risk management, or related areas.  Examples of relevant certifications include Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Information Security Auditor (CISA), and others.

• Understanding of Legal and Regulatory Frameworks: Candidates should have a basic understanding of legal and regulatory frameworks related to cybersecurity, privacy, data protection, and other areas relevant to GRC.  This includes knowledge of laws, regulations, and industry standards such as GDPR, HIPAA, SOX, PCI DSS, and others.

• Professional Ethics: Candidates should be familiar with professional ethics and codes of conduct relevant to the GRC profession.  This includes understanding ethical responsibilities related to confidentiality, integrity, and professionalism.