CAP Is Now CGRC: The Rename, the Current Outline and What's Pending

There's no CAP exam to sit any more. ISC2 renamed the Certified Authorization Professional in February 2023, and the credential is now the Certified in Governance, Risk and Compliance (CGRC). Its outline changed on June 15, 2024, adding international frameworks alongside the US federal ones, and 2025 brought only a call for input on the next version.

The rename, February 15, 2023

ISC2 said the new name "aligns with the knowledge, skills and abilities covered by the exam" and was meant to reach governance, risk and compliance (GRC) work beyond its original audience. The announcement was explicit that the change "only affects the name of the certification and does not impact the exam or course content", nor the eligibility rules. Existing CAP holders didn't need to do anything: their digital certificates and badges switched to CGRC automatically. If a job posting still asks for CAP, a CGRC meets it.

What the June 2024 outline changed

The first real content change came 16 months after the rename. ISC2's June 17, 2024 post on the update lists the domain changes:

• Domain 1 was retitled Security and Privacy Governance, Risk Management, and Compliance Program.
• Domain 2 became Scope of the System and dropped from 11% to 10%.
• Domain 3 became Selection and Approval of Framework, Security, and Privacy Controls and dropped from 15% to 14%.
• Domain 4, Implementation of Security and Privacy Controls, rose from 16% to 17%.
• Domain 6 became System Compliance and rose from 10% to 14%.
• Domain 7 became Compliance Maintenance and dropped from 16% to 13%.

Domain 5, assessment and audit, stays at 16% on the current outline page. The biggest single move is Domain 6, which gained four points. In ISC2's words the exam was "revised from a global perspective to consider international terminology, frameworks and regulations". Domain 1 now names ISO/IEC standards, COBIT, PCI DSS and GDPR alongside NIST. The domains still run in the order of a system's life, from scoping through control selection, implementation, assessment, authorization and ongoing compliance.

What happened in 2025 and 2026

On February 11, 2025, ISC2 asked CGRC holders to say what the outline should add and drop, with answers due by March 4 and a job task analysis workshop tentatively set for March 25 to 27, 2025. That is the first step toward a new outline. As of October 2026 the CGRC outline page still shows the June 15, 2024 outline and no successor.

The other 2026 development is guidance, not a syllabus change. ISC2's Exam Guidance for Artificial Intelligence, updated September 1, 2026, has a CGRC section headed "Based on CGRC Exam Outline Effective June 15, 2024". Its Domain 1 material names the NIST AI Risk Management Framework and ISO/IEC 42001, and a later domain refers to the EU AI Act. The outline page carries a summary of how AI fits each of the seven domains.

The format hasn't moved either. CGRC isn't one of the four ISC2 exams that went adaptive; it's still a fixed 125 items in three hours, in English only, with a pass mark of 700 out of 1000.

What to do if you're preparing now

Study from the June 2024 outline, and treat any book or course built for CAP as out of date on domain names and weights, even where the topics overlap. ISC2's pricing page lists the exam at $599 in the Americas. The experience rule is two years in one or more of the seven domains; if you pass without it, you hold the Associate of ISC2 title until you have it. Weight your study toward Domains 4 to 7, which make up 60% of the exam between them.

Check the outline page again before you book. ISC2 has had CGRC holders' input for more than a year and a half, and when the CCSP went through the same process its new outline arrived about 29 months after the workshop, a pattern what ISC2 has said about the next CISSP outline sets out. For where CGRC sits beside ISACA's audit credential, see CISA vs CAP.