Name: CGRC Exam Preparation Course (Self-Paced)
Price: 2649.0 USD
Availability: InStock

This course includes

18 hours of project-based training from experts
CGRC exam voucher
Answers from real instructors
Retake for free within 1 year
Verified digital certificate of completion
Learn at an accredited institution
Credits: 1.8 CPEs and 1.8 CEUs

ISC2 and CGRC are trademarks of ISC2. This course is not affiliated with or endorsed by ISC2, and passing the exam is not guaranteed.

This self-paced course walks through the risk management lifecycle tested on the ISC2 CGRC exam, organized around its seven domains and mapped to the NIST Risk Management Framework. It is written for federal and commercial learners alike.

Learners scope and categorize systems, select and assess controls, assemble authorization packages, and design continuous monitoring. Knowledge checks written in the exam's scenario-based style close every module.

Target Audience

This course is for working professionals who take part in, or are moving into, a formal risk management or system authorization process: federal ISSOs, ISSMs and risk management staff who will support or lead an authorization package, and commercial GRC analysts, IT auditors, risk and compliance professionals, and security practitioners who want a structured, government-grounded risk framework they can apply to enterprise systems. It assumes the reader already has a working information security background. It is not for someone with no prior security exposure; a learner in that position should complete a foundational course first. It is also not a substitute for the two years of relevant work experience ISC2 requires for full certification, though associate status is available to candidates who pass the exam before meeting that requirement.

This course has a prerequisite

A working information security background, equivalent to Security+ Exam Preparation or about two years of hands-on IT or security experience.

Tuition

Full Tuition

$2,649
Due before the class starts

This course includes

18 hours of project-based training from experts
CGRC exam voucher
Answers from real instructors
Retake for free within 1 year
Verified digital certificate of completion
Learn at an accredited institution
Credits: 1.8 CPEs and 1.8 CEUs

Learning Experience Highlights

Training from government‑experienced instructors

Receive instruction from subject‑matter experts who bring proven government experience.

Specialized for government & DoD

Courses that are regularly updated based on feedback and industry developments, ensuring versions are mapped to federal competencies.

The instructor was wonderful and so knowledgeable. The course materials were extremely relevant to what my job is. I feel like I can be better because of this class.
— 2025 student

Three professionals sit in black chairs with laptops and notebooks, engaged in conversation against a red wall.

Real-world solutions

Directly addressing the day-to-day challenges of federal employees.

125+ departments & agencies served

Your trusted training partner, equipping public service professionals with the skills and knowledge to excel in their roles and drive meaningful impact.

100% Online. Start Anytime

24/7 access to our premium course videos and projects.
Industry experts are assigned as your course instructor. Message your instructor with any questions.
Participate in GSUSA online discussion forums — share ideas and receive additional support.
Hands-on quizzes and mini projects to test and reinforce concepts.

Earn a Certificate of Completion

Upon completion of this course, you’ll receive an official certificate testifying to your mastery of the curriculum. We’ll send you a link where you can download your certificate, share it online with your friends, post it to your professional network on LinkedIn, and view all your earned certificates. Congratulations on your achievement!

Shareable on

Sample credential for completion of CGRC Exam Preparation Course (Self-Paced)

A group of adult learners sits in a classroom, smiling and engaged in a government training session.

A government training instructor in a suit gestures while teaching in front of a whiteboard covered with notes and diagrams.

A person in professional attire holds a Graduate School USA folder, symbolizing participation in government training programs.

CGRC Exam Preparation Course (Self-Paced) Curriculum

What You'll Learn at a Glance

Describe the purpose and structure of an organization-wide information security risk management program.
Scope a system's authorization boundary and assign impact levels using categorization standards.
Select and tailor security and privacy controls appropriate to a system's risk profile.
Document control implementation decisions in a system security plan.
Assess control effectiveness using established assessment procedures and reporting formats.
Compile assessment findings into a risk-based recommendation for an authorizing official.
Evaluate residual risk and prepare an authorization decision package.
Design a continuous monitoring strategy that keeps a system's authorization current.
Apply a structured risk management process across a system's full life cycle.
Explain how governance, risk and compliance functions intersect in both government and commercial risk programs.
Communicate risk decisions and supporting evidence to non-technical stakeholders.
Identify the primary source documents used at each stage of the risk management process.
Prepare for the format and pacing of the ISC2 CGRC exam.

Course Syllabus

Download Syllabus PDF

Module 1: Foundations of Information Security Risk Management

Lessons:
- What risk management means for an information system
- The risk management life cycle: from NIST SP 800-37 to the CGRC's seven domains
- Federal and commercial risk management compared
Applied activity: Learners map a provided case-study organization's risk decisions to the seven-step life cycle and identify which step is weakest.

Module 2: Risk Management Roles, Governance and Legal Authorities

Lessons:
- Core roles: authorizing official, ISSO, system owner and risk executive
- Governance structures that oversee the program
- Legal and policy authorities behind federal risk management, and their commercial equivalents
Applied activity: Learners sort ten responsibilities into the correct role and justify one placement in writing.

Module 3: Aligning the Risk Management Program with Organizational Risk Tolerance

Lessons:
- Defining organizational risk tolerance and risk appetite
- Building a risk management strategy that reflects tolerance
- Communicating risk tolerance decisions to system-level teams
Applied activity: Learners draft a short risk tolerance statement for a fictional organization and explain how it would change one downstream control decision.

Module 4: Defining the System and Its Authorization Boundary

Lessons:
- What counts as a system for authorization purposes
- Drawing the authorization boundary
- Common boundary-scoping mistakes
Applied activity: Given a network diagram, learners draw the authorization boundary and justify what is included or excluded.

Module 5: Categorizing Information and Information Systems

Lessons:
- Information types and impact levels
- Applying FIPS 199 categorization to confidentiality, integrity and availability
- Documenting the categorization decision
Applied activity: Learners categorize a public-facing website and a payroll system and defend their impact ratings.

Module 6: Registering the System and Assigning Security Responsibilities

Lessons:
- System registration and inventory requirements
- Assigning the system owner, ISSO and other security roles
- Linking scoping decisions to the system security plan
Applied activity: Learners complete a short system registration form for a case-study system, assigning roles and citing its categorization.

Module 7: Control Baselines and Tailoring

Lessons:
- Control families and baselines in NIST SP 800-53
- Tailoring a baseline to a system's actual risk
- Documenting tailoring decisions
Applied activity: Learners select a baseline for a moderate-impact case-study system and tailor two controls, documenting the rationale.

Module 8: Selecting Privacy Controls and Overlays

Lessons:
- Privacy controls and their relationship to security controls
- Applying overlays for specialized environments
- Coordinating privacy and security control selection
Applied activity: Learners identify which privacy controls apply to a system that processes personally identifiable information and select an overlay.

Module 9: Documenting Controls in the System Security Plan

Lessons:
- Purpose and structure of the system security plan
- Writing defensible control implementation statements
- Review and approval of the security plan
Applied activity: Learners write one implementation statement for a selected control and self-review it against a provided checklist.

Module 10: Translating the Security Plan into Implemented Controls

Lessons:
- From plan to practice: implementation planning
- Sequencing implementation by risk priority
- Common implementation gaps
Applied activity: Learners build a short implementation checklist for one technical and one administrative control.

Module 11: Common Controls, Inheritance and Shared Responsibility

Lessons:
- Common controls and control inheritance
- Shared responsibility in cloud and multi-tenant environments
- Documenting inherited controls
Applied activity: Given a cloud provider's responsibility matrix, learners identify which controls the system owner must still implement.

Module 12: Recording Implementation Evidence

Lessons:
- What counts as implementation evidence
- Organizing evidence for later assessment
- Avoiding evidence gaps before assessment begins
Applied activity: Learners assemble a short evidence package for one implemented control from a case study.

Module 13: Building the Security Assessment Plan

Lessons:
- Purpose and components of a security assessment plan
- Scoping the assessment to the system boundary
- Selecting assessment procedures from NIST SP 800-53A
Applied activity: Learners draft a one-page assessment plan outline for two controls from the case-study security plan.

Module 14: Assessment Methods: Examine, Interview and Test

Lessons:
- The examine method
- The interview method
- The test method
Applied activity: Learners choose the correct assessment method for each of five sample controls and explain why.

Module 15: Analyzing Assessment Results and Identifying Weaknesses

Lessons:
- Rating assessment results
- Distinguishing a weakness from a deficiency
- Root-cause analysis of a finding
Applied activity: Given three assessment findings, learners rate severity and identify the likely root cause of each.

Module 16: Reporting Findings in the Security Assessment Report

Lessons:
- Structure of the security assessment report
- Writing findings that support a risk decision
- Delivering the report to the system owner and authorizing official
Applied activity: Learners write one finding statement, including recommended remediation, for a case-study control failure.

Module 17: Assembling the Authorization Package

Lessons:
- Required components of an authorization package
- Coordinating inputs from scoping, implementation and assessment
- Common authorization package deficiencies
Applied activity: Learners build a checklist confirming a case-study authorization package is complete before submission.

Module 18: Risk Determination and the Authorizing Official's Decision

Lessons:
- Weighing residual risk against organizational tolerance
- The authorizing official's decision options
- Documenting and communicating the authorization decision
Applied activity: Given a completed case-study authorization package, learners recommend a decision and justify it in writing.

Module 19: Plans of Action and Milestones

Lessons:
- Purpose and structure of a plan of action and milestones
- Prioritizing and scheduling remediation
- Tracking a plan of action and milestones to closure
Applied activity: Learners draft one plan of action and milestones entry for an open finding, including a realistic milestone schedule.

Module 20: Designing a Continuous Monitoring Strategy

Lessons:
- Purpose of continuous monitoring in the risk management life cycle
- Selecting metrics and monitoring frequency
- Aligning the strategy with organizational risk tolerance
Applied activity: Learners draft a monitoring frequency table for five control families based on a case-study system's risk level.

Module 21: Ongoing Assessment and Control Effectiveness Over Time

Lessons:
- Reassessing controls on an ongoing basis
- Detecting control drift and degradation
- Updating the system security plan based on monitoring results
Applied activity: Given two monitoring snapshots of the same control taken months apart, learners identify signs of drift and recommend an update.

Module 22: Reporting Risk and Security Status to Leadership

Lessons:
- Building a risk and security status report
- Tailoring reporting for technical and executive audiences
- Feeding status reports back into governance decisions
Applied activity: Learners rewrite one technical monitoring finding as a two-sentence executive summary suitable for a governance board.

Module 23: System Disposal, Reauthorization and Program Maturity

Lessons:
- Reauthorization triggers and timing
- Secure system disposal and decommissioning
- Maturing a risk management program over time
Applied activity: Learners identify which of five described events would trigger reauthorization and which apply to disposal instead.

Group Training

Since 1921, Graduate School USA has partnered with over 125 federal agencies and trained more than one million federal employees. Led by instructors with deep, real-world knowledge of federal regulations, policies, and practices, our private group programs are practical, mission-driven, and tailored to your agency’s objectives. We offer expertise across key federal domains—including human resources, financial management, acquisition and contracting, leadership, and more—to deliver training where and how your team needs it.

Complete this form and we’ll get back to you within 1 business hour.

The Fact Is – We’ve Been Government’s Training Partner Since 1921

400+ Courses & Certificates 125+ Federal Agencies Served 200+ Subject-Matter Experts

Installments
	10% non-refundable deposit
$2,649.00	Total You Pay