How many questions are on the ISC2 CGRC exam?

The ISC2 CGRC exam has 150 questions, and the vendor's published description is: 125 items; 3 hours; multiple-choice and advanced item types.

How long do you have to complete the ISC2 CGRC exam?

You get 180 minutes, which is about 72 seconds per question. The published format is: 125 items; 3 hours; multiple-choice and advanced item types.

What score do you need to pass the ISC2 CGRC exam?

The passing score is 70% (700 out of 1000 points).

How should I use the domain weights when revising?

Weight by percentage, not by domain. 14% is the one where lost points cost you the most, and Certilum scores you per domain so you can see exactly where that is.

Does Certilum have practice questions for the ISC2 CGRC exam?

Yes: 150 questions in our bank for this certification, each tagged to the exam domain it belongs to, with the official domain weights applied.

Exam format

ISC2 CGRC Exam Format

CGRC

Everything the official exam blueprint specifies: question count, time limit, scoring and the weight each domain carries. The ISC2 CGRC certification demonstrates advanced expertise in managing governance, risk, and compliance activities throughout the system development life cycle. Candidates learn how to select appropriate security and privacy frameworks, implement controls, perform assessments, and maintain system compliance. The credential is built on the Risk Management Framework and similar assessment and authorization processes, making it valuable for professionals who guide systems from authorization to continuous monitoring. This certification focuses on practical governance activities, including scoping systems, preparing authorization packages, monitoring controls, and communicating compliance status to senior leadership. It also prepares candidates to interpret relevant laws, regulations, and contractual requirements and to align security and privacy programs with enterprise objectives.

150 questions

180 min

70% to pass

7 domains

certilum

Exam facts at a glance

The published specifications for this certification.

Specification	Value
Questions	150
Time limit	180 minutes (72s per question)
Passing score	70% — 700 out of 1000 points
Domains	7
Level	Professional
Question bank here	150 questions
Published format	125 items; 3 hours; multiple-choice and advanced item types
Source	Official exam specification, published by the vendor

Official domain weights

The percentage of the exam each domain carries. Weight your revision by these numbers, not by what you find hardest.

Domain	Weight	Topics	Practice Qs
System Compliance	14%	Determine compliance with applicable laws, regulations, and policies Develop and maintain the authorization package Support risk acceptance and authorization decisions	21
Scope of the System	10%	Identify and document the system boundary Define the system purpose, data flows, and architecture Develop system descriptions and environmental assumptions	15
Compliance Maintenance	13%	Monitor and maintain security and privacy controls Conduct continuous monitoring and ongoing risk assessments Perform regular compliance reviews and report changes	19
Implementation of Security and Privacy Controls	17%	Manage implementation of security and privacy controls Document control deployment and system integration details Coordinate remediation and monitor implementation progress	26
Assessment/Audit of Security and Privacy Controls	16%	Plan and prepare security and privacy assessments Conduct control assessments and collect appropriate evidence Analyze findings and develop remediation recommendations	24
Selection and Approval of Framework, Security, and Privacy Controls	14%	Select applicable frameworks and control baselines Apply security and privacy control tailoring and inheritance Obtain control approval from authorizing officials	21
Security and Privacy Governance, Risk Management, and Compliance Program	16%	Establish and maintain a governance and risk management program Align security and privacy governance with organizational strategy and legal requirements Define roles, responsibilities, and communication channels for risk management and compliance	24

The heaviest domain is System Compliance at 14%, and that is where lost points cost you the most. Certilum scores you per domain so you can see the difference between a knowledge gap and a formatting problem.

Note from the vendor record: CGRC (Certified in Governance, Risk and Compliance) was renamed from Certified Authorization Professional (CAP) effective February 15, 2023 per ISC2's official announcement; the rename affects only the name, not exam or course content. The current CGRC Certification Exam Outline has an effective date of June 15, 2024. Candidates need 2 years of required work experience (otherwise ISC2 offers an Associate path), and the credential is ANAB-accredited to ISO/IEC 17024 and U.S. DoDM 8140.03 approved. Maintenance details (CPE credits and annual maintenance fee) are published separately in ISC2's continuing education policy and were not re-verified in this pass. Official exam page

More about the ISC2 CGRC exam

Explore the rest of this page series: format, cost, difficulty, requirements and how to prepare.

Exam costPrice, retakes and total budget Pass rateThe score you need Who can take itRequirements and prerequisites Study planHow to prepare, by domain

Related certifications

Explore other certifications in the same category and see how they stack up.

ISACA CISA

ISACA

Frequently asked questions

Everything you need to know about the ISC2 CGRC exam.

There are 7 domains: System Compliance, Scope of the System, Compliance Maintenance, Implementation of Security and Privacy Controls, Assessment/Audit of Security and Privacy Controls, Selection and Approval of Framework, Security, and Privacy Controls, Security and Privacy Governance, Risk Management, and Compliance Program. The official weights are System Compliance 14%, Scope of the System 10%, Compliance Maintenance 13%, Implementation of Security and Privacy Controls 17%, Assessment/Audit of Security and Privacy Controls 16%, Selection and Approval of Framework, Security, and Privacy Controls 14%, Security and Privacy Governance, Risk Management, and Compliance Program 16%.