CGRC Exam Information and Outline
Certified in Governance, Risk and Compliance
Syllabus Update Checked on: November 6, 2026
CGRC Exam Syllabus & Study Guide
Before you start practicing with our exam simulator, it is essential to understand the
official CGRC exam objectives. This course outline serves as your roadmap.
The information below reflects the 2026 syllabus defined by
ISC2.
Below are complete topics detail with latest syllabus and course outline, that will help you good knowledge about exam objectives and topics that you have to prepare. These contents are covered in questions and answers pool of exam.
- Exam Format
- 125 multiple-choice questions; 3 hours
- Information Security Risk Management Program (16%)
- Risk management frameworks (NIST RMF), roles and governance
- Scope of the Information System (10%)
- System boundaries and categorization (FIPS 199)
- Selection and Approval of Security and Privacy Controls (14%)
- Baselines and tailoring (SP 800-53)
- Implementation of Security and Privacy Controls (17%)
- Implementation and documentation
- Assessment/Audit of Security and Privacy Controls (16%)
- Assessment plans and findings
- System Compliance (14%)
- Authorization decision and POA&M
- Compliance Maintenance (13%)
- Continuous monitoring and change management