CGRC

CGRC - Certified in Governance, Risk and Compliance

The CGRC (formerly known as CAP - Certified Authorization Professional) is an (ISC)² certification that validates the knowledge and skills required to integrate security and privacy into organizational information systems through the Risk Management Framework (RMF). It is designed for professionals who authorize and maintain information systems with a focus on governance, risk management, and compliance. The CGRC demonstrates expertise in the formal authorization process used by government agencies and organizations that follow NIST guidelines. Typical candidates include information security officers, authorizing officials, security control assessors, system owners, and GRC analysts who participate in the RMF process. The credential requires a minimum of two years of cumulative paid work experience in one or more of the seven domains of the CGRC Common Body of Knowledge (CBK).

Exam Details

Domain Weights

Study Tips

• The CGRC exam is heavily aligned with the NIST Risk Management Framework (RMF) as defined in NIST SP 800-37 Rev. 2; memorize all seven RMF steps and the key activities within each step
• Domains 1, 3, and 5 carry the most weight at 16%, 15%, and 16% respectively; focus on risk management fundamentals, control selection, and assessment procedures
• Understand the roles and responsibilities in the RMF process: Authorizing Official (AO), System Owner, Information System Security Officer (ISSO), Security Control Assessor (SCA), and Common Control Provider
• Know the key NIST publications inside and out: SP 800-37 (RMF), SP 800-53 (controls catalog), SP 800-53A (assessment procedures), SP 800-30 (risk assessment), SP 800-137 (continuous monitoring)
• The authorization decision types are critical: Authorization to Operate (ATO), Common Control Authorization, Authorization to Use, and Denial of Authorization; understand what triggers each decision
• FIPS 199 (security categorization) and FIPS 200 (minimum security requirements) are foundational; system categorization drives everything else in the RMF process
• Continuous monitoring is not just scanning; it includes ongoing assessments, configuration management, change control, and reporting to the Authorizing Official
• The exam tests the "think like an assessor" mindset; understand how to evaluate controls objectively and document findings in the Security Assessment Report (SAR)

Question Strategy Tips

• Map every question to its RMF step; understanding which step is being tested helps you identify the correct answer among similar-looking options
• When in doubt, choose the answer that follows the documented process rather than a shortcut; the CGRC exam rewards methodical, standards-based approaches
• Pay attention to role-specific questions; the Authorizing Official makes the risk acceptance decision, the System Owner implements controls, and the SCA evaluates effectiveness
• Time management is important with 125 questions in 180 minutes; that gives approximately 1 minute and 26 seconds per question
• Look for NIST-specific terminology in answer choices; answers that use the correct NIST vocabulary are more likely to be correct than those using generic security terms
• Flag questions about overlapping topics (e.g., risk assessment appears in multiple RMF steps) and revisit them after completing easier questions

Recommended Resources

• NIST SP 800-37 Rev. 2: Risk Management Framework for Information Systems and Organizations; the primary reference document for the entire CGRC exam
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations; the comprehensive controls catalog referenced throughout the RMF process
• NIST SP 800-53A Rev. 5: Assessing Security and Privacy Controls; defines assessment procedures, methods (examine, interview, test), and depth/coverage expectations
• NIST SP 800-30 Rev. 1: Guide for Conducting Risk Assessments; critical for Domain 1 and understanding risk assessment methodology
• NIST SP 800-137: Information Security Continuous Monitoring; essential for Domain 7 covering ISCM strategy, metrics, and automation
• FIPS 199 & FIPS 200: Security Categorization and Minimum Security Requirements; foundational standards for system categorization and control baselines

Domain 1: Information Security Risk Management Program (16%) & Domain 6: Authorization (13%)

These domains cover the foundational risk management concepts, the NIST Risk Management Framework lifecycle, the authorization process, and the roles and responsibilities of key stakeholders. You must understand how organizations establish risk management programs, how the RMF provides a structured approach to managing security risk, and how the authorization decision formally accepts the residual risk of operating an information system.

NIST Risk Management Framework (RMF) - Seven Steps

Exam Tip: The Prepare step was added in RMF Rev. 2 and is organization-level (not system-level). It sets the foundation for all subsequent steps. Memorize all seven steps in order: Prepare, Categorize, Select, Implement, Assess, Authorize, Monitor.

Key RMF Roles and Responsibilities

Authorization Package Components

Exam Tip: The authorization package consists of three core documents: SSP, SAR, and POA&M. The Authorizing Official reviews all three to make the risk-based authorization decision. Some organizations may also include a risk executive summary.

Authorization Decision Types

Risk Management Concepts

• Risk Tolerance: The level of risk an organization is willing to accept in pursuit of its objectives; defined by senior leadership and the AO; drives control selection and authorization decisions
• Residual Risk: The risk remaining after security controls are implemented; must be explicitly accepted by the AO during the authorization decision
• Inherent Risk: The risk that exists before any controls are applied; represents the worst-case scenario for a given threat and vulnerability combination
• Risk Response Strategies: Accept (acknowledge and accept), Mitigate (implement controls to reduce), Transfer (insurance, contracts), Avoid (eliminate the activity), Share (distribute across parties)
• Three Risk Tiers (NIST): Tier 1 = Organization level (governance, strategy); Tier 2 = Mission/Business Process level (enterprise architecture); Tier 3 = Information System level (RMF execution)

Key Concept: Risk management is a three-tiered approach per NIST SP 800-39. Tier 1 sets organizational risk strategy, Tier 2 defines mission-oriented risk approaches, and Tier 3 applies RMF to individual systems. Information flows both top-down (policy/guidance) and bottom-up (risk information/feedback).

Domain 2: Scope of the Information System (11%) & Domain 3: Selection and Approval of Controls (15%)

These domains cover how to define the information system boundary, categorize the system using FIPS 199, and select appropriate security and privacy controls from NIST SP 800-53. You must understand how system scope and categorization directly drive control selection, tailoring, and the use of overlays to address specific organizational or regulatory requirements.

FIPS 199 Security Categorization

Exam Tip: The overall system categorization is determined by the HIGH WATER MARK principle. The system is categorized at the highest impact level across all three security objectives (C, I, A). For example, if C=Low, I=Moderate, A=High, the overall system category is HIGH.

NIST SP 800-53 Control Families

Control Selection and Tailoring Process

• Step 1 - Select Baseline: Based on FIPS 199 categorization (Low, Moderate, or High), select the corresponding control baseline from NIST SP 800-53B which provides pre-defined sets of controls for each impact level
• Step 2 - Tailor Controls: Modify the baseline by applying scoping guidance (removing controls that do not apply), adding compensating controls, and assigning organization-specific parameter values to control enhancements
• Step 3 - Apply Overlays: Add supplementary controls required by specific communities (e.g., intelligence community, DoD, healthcare) or specific technologies (e.g., cloud, mobile, industrial control systems)
• Step 4 - Supplement Controls: Add additional controls beyond the baseline based on the organization's risk assessment results, threat intelligence, and specific regulatory requirements
• Step 5 - Document in SSP: Record all selected controls, tailoring decisions, and rationale in the System Security Plan for AO review

Key Change in Rev. 5: NIST SP 800-53 Rev. 5 removed control baselines from the main document and placed them in SP 800-53B. Rev. 5 also added the PT (PII Processing and Transparency) and SR (Supply Chain Risk Management) control families.

Control Types

System Boundary and Scope

• Authorization Boundary: Defines what is included in the authorization scope; all components within the boundary are subject to the same authorization decision
• System Components: Hardware, software, firmware, network devices, and interconnections that are within the authorization boundary and under the system owner's control
• Interconnections: Connections to external systems must be documented in Interconnection Security Agreements (ISAs) and Memoranda of Understanding (MOUs)
• Information Types: All types of information processed, stored, or transmitted by the system must be identified and categorized using NIST SP 800-60
• Boundary Challenges: Cloud computing, microservices, shared services, and APIs create complex boundary decisions; the system owner must clearly define what falls within their authorization scope

Domain 4: Implementation of Controls (15%) & Domain 5: Assessment/Audit of Controls (16%)

These domains cover how security and privacy controls are implemented, documented, and assessed for effectiveness. You must understand the control implementation process, the assessment methodology defined in NIST SP 800-53A, the three assessment methods (examine, interview, test), and how to produce a Security Assessment Report (SAR) with actionable findings and recommendations.

Control Implementation Process

SP 800-53A Assessment Methods

Exam Tip: Each assessment method has two attributes: DEPTH (basic, focused, comprehensive) and COVERAGE (basic, focused, comprehensive). Higher assurance requires greater depth and coverage. The assessment plan specifies the method and attributes for each control.

Assessment Depth and Coverage

Security Assessment Report (SAR) Components

• Executive Summary: High-level overview of assessment scope, methodology, overall findings, and risk posture for the Authorizing Official's review
• Assessment Methodology: Description of assessment methods used (examine, interview, test), depth and coverage levels, tools employed, and assessment team qualifications
• Detailed Findings: For each control assessed: the assessment objective, the method and objects used, the finding (satisfied or other than satisfied), and supporting evidence
• Risk Determination: For each finding of "other than satisfied": the associated risk level (very low, low, moderate, high, very high), likelihood of exploitation, and potential impact
• Recommendations: Suggested remediation actions for findings, prioritized by risk level, with estimated resources and timelines for implementation

Assessment Finding Determinations

Plan of Action and Milestones (POA&M)

• Purpose: The POA&M is a living document that tracks identified weaknesses, planned remediation actions, milestones, and responsible parties for all "other than satisfied" findings
• Required Fields: Weakness description, source of finding (SAR, scan, audit), risk level, planned remediation, responsible party, scheduled completion date, milestones, status
• Risk-Based Prioritization: High-risk findings should be remediated first; the AO may accept low-risk findings as residual risk rather than requiring remediation
• Ongoing Management: The POA&M must be updated regularly as items are remediated, new findings are identified, and risk levels change; reviewed during continuous monitoring
• AO Oversight: The Authorizing Official reviews the POA&M as part of the authorization decision and during ongoing authorization to track risk remediation progress

Exam Tip: The POA&M is NOT a document that hides risk from the AO. It transparently communicates known weaknesses and the plan to address them. The AO uses the POA&M alongside the SSP and SAR to make an informed risk decision.

Domain 7: Continuous Monitoring (14%)

This domain covers Information Security Continuous Monitoring (ISCM) as defined in NIST SP 800-137. Continuous monitoring maintains ongoing awareness of the security posture, vulnerabilities, and threats to support risk management decisions. It is not a single activity but a comprehensive program that includes control assessments, configuration management, vulnerability management, compliance monitoring, and ongoing authorization. The goal is to transform the authorization process from a point-in-time event into an ongoing, near-real-time assessment of risk.

ISCM Strategy Components (NIST SP 800-137)

Continuous Monitoring Activities

Ongoing Authorization

• Concept: Ongoing authorization replaces the traditional periodic reauthorization cycle with continuous risk monitoring and decision-making; the AO maintains situational awareness through automated reporting
• Triggers for Reauthorization: Significant change to the system, new threat landscape, major incident, change in mission requirements, expiration of existing authorization, or AO decision based on risk
• Significant Change Examples: New interconnection with external system, major software upgrade, change in system boundary, migration to new infrastructure, integration of new data type
• AO Responsibilities: Continuously review risk reports, POA&M updates, and monitoring data; make ongoing risk acceptance decisions; determine when full reauthorization is warranted
• Automation: Maximize automation for data collection, vulnerability assessment, compliance checking, and dashboard generation to support near-real-time risk decisions

Exam Tip: Ongoing authorization does not eliminate the need for formal authorization decisions. The AO still makes explicit risk acceptance decisions but does so on an ongoing basis informed by continuous monitoring data rather than waiting for a periodic reauthorization cycle.

ISCM Metrics and Measures

Key NIST Publications for Continuous Monitoring

• NIST SP 800-137: Information Security Continuous Monitoring for Federal Information Systems and Organizations; defines the ISCM process and multi-tiered approach
• NIST SP 800-137A: Assessing Information Security Continuous Monitoring Programs; provides guidance on evaluating ISCM program effectiveness
• NIST SP 800-128: Guide for Security-Focused Configuration Management of Information Systems; essential for the configuration monitoring component of ISCM
• NIST SP 800-40: Guide to Enterprise Patch Management Planning; supports the patch management component of continuous monitoring
• SCAP (Security Content Automation Protocol): Suite of specifications for automated vulnerability management, measurement, and compliance checking; enables standardized data exchange between security tools

Risk Assessment vs Risk Management

Common Controls vs System-Specific Controls vs Hybrid Controls

Assessment Methods: Examine vs Interview vs Test

FIPS 199 Impact Levels Compared

Key NIST Publications Quick Reference

Exam Tip: You do not need to memorize every detail of every NIST publication, but you must know which publication maps to which RMF step and what each publication's primary purpose is. The exam frequently asks "which document would you refer to" for a given activity.