ISC2 Certified in Governance, Risk and Compliance (CGRC) Practice Exams

ISC2's governance, risk, and compliance certification. Built around the NIST Risk Management Framework. 10 free questions across the seven CGRC domains, detailed explanations on every answer, randomized every attempt.

Free Questions
10
Passing Score
700 / 1000
Randomized
Every attempt

About the ISC2 CGRC exam

Exam at a glance

The ISC2 professional-tier credential for governance, risk, and compliance professionals. CGRC is the only ISC2 certification built around a single framework — the NIST Risk Management Framework (NIST SP 800-37) — making it the natural fit for U.S. federal contractors, agency staff, and any organization that has standardized on NIST controls.

Former name: CAP

CGRC was rebranded from CAP (Certified Authorization Professional) in February 2022. The new name better reflects the broader governance and compliance scope the exam already covered, while keeping the same NIST RMF orientation. Certifications earned under the CAP name automatically converted to CGRC — no retest required.

Domain weighting

  • Information Security Risk Management Program: 16%
  • Scope of the System: 12%
  • Selection and Approval of Security and Privacy Controls: 15%
  • Implementation of Security and Privacy Controls: 16%
  • Assessment/Audit of Security and Privacy Controls: 17%
  • System Compliance: 16%
  • Compliance Maintenance: 8%

Core topics tested

  • NIST RMF six-step process — Categorize → Select → Implement → Assess → Authorize → Monitor (SP 800-37 Rev. 2).
  • Security categorization — FIPS 199 impact levels (Low/Moderate/High) for confidentiality, integrity, and availability.
  • Control selection — NIST SP 800-53 Rev. 5 control families, baselines, tailoring, and control inheritance.
  • Authorization boundaries — system boundary definition, interconnection agreements, common controls.
  • Assessment and authorization (A&A) artifacts — System Security Plan (SSP), Security Assessment Report (SAR), Plan of Action and Milestones (POA&M), Authorization to Operate (ATO).
  • Continuous monitoring — ongoing control assessments, configuration management, change control, security metrics.
  • Privacy controls — NIST SP 800-53 Rev. 5 privacy baseline, PII handling, privacy impact assessments.
  • Compliance maintenance — ATO renewal, decommissioning, system disposal, contingency planning.

Prerequisites

Two years of cumulative paid work experience in one or more of the seven CGRC domains. Pass without the experience and you earn the Associate of ISC2 designation, with three years to gain the qualifying experience.

Why take this certification

  • The GRC credential for federal work. CGRC maps directly to NIST RMF, which is mandatory for U.S. federal information systems under FISMA. If your organization sells to or supports federal agencies, CGRC is the go-to credential — and it appears explicitly on many DoD and civilian-agency role descriptions.
  • Lower experience bar than CISSP. Two years vs. five — CGRC is reachable earlier in a GRC career, while still carrying the ISC2 ANSI/ISO 17024 accreditation that hiring managers recognize.
  • Pairs naturally with CISSP. CISSP gives you the eight-domain breadth; CGRC gives you the deep RMF mechanics required to actually shepherd a system through assessment, authorization, and ongoing monitoring. Many GRC analysts and ISSOs hold both.
  • Privacy is now first-class. The Rev. 5 update to NIST SP 800-53 promoted privacy controls alongside security controls, and CGRC tests both — useful for roles that intersect with GDPR, HIPAA, and state privacy laws as well.