Skip to content
CertGPS

OSCP or CGRC (Formerly CAP): The Penetration Test and the Risk Decision It Feeds

Comparison

OSCP and CGRC sit at opposite ends of one process: the tester who breaks in and the officer who turns the findings into a risk decision. Which end suits you.

Published
Updated
Read time
4 min
C
CertGPS

Not independently reviewed

AI-assisted content. Editorial policy · Suggest a correction

On this page

OSCP or CGRC (Formerly CAP): The Penetration Test and the Risk Decision It Feeds

OSCP certifies the person who breaks in: 23 hours and 45 minutes against Windows, Linux and Active Directory machines, then a report that someone else could follow step by step. CGRC, the ISC2 credential called CAP until February 2023, certifies the person who turns findings like those into a risk decision for an authorizing official. Since the two sit at opposite ends of one process, the choice is about which end you want to work at.

Two exams with almost nothing in common

OSCPCGRC
IssuerOffSecISC2
FormatProctored practical: three standalone machines and one Active Directory set, then a written reportFixed length; multiple choice and advanced item types
Time23 hours 45 minutes, then 24 hours to upload the report3 hours for 125 questions
Passing score70 of 100 points700 out of 1000
Price$1,699 exam only; $1,749 with 90 days of PEN-200$599
ExperienceNone required; TCP/IP, Windows and Linux administration and basic scripting recommendedTwo years in its domains, required
RenewalOSCP never expires; OSCP+ lasts three years, renewed by 120 CPEs with the $145 annual fee, a $799 recertification exam or a higher OffSec exam60 CPE credits per three years and a $135 annual fee

Where a penetration test report ends up

FedRAMP, the US government's program for authorizing cloud services, shows the handoff most clearly. Its Penetration Test Guidance requires a test by a third-party assessment organization no more than six months before the security assessment report, and at least every 12 months after authorization unless an authorizing body approves an exception with documented rationale. Each finding has to carry a description, its impact, a recommendation, a risk rating and evidence, and the report supplies the evidence assessors and risk owners need for the next decision.

The CGRC holder's job begins with it. ISC2's outline lists penetration testing as one of the "test" methods in objective 5.2, then walks through what follows: an initial report of risks (5.3), a response for each finding from avoid, accept, share, mitigate or transfer (5.4), and a risk response plan that prioritizes the residual risks and the resources to fix them (5.6). Domain 6 packages all of it for the authorizing official and records who accepted what.

Outside FedRAMP, the test may not happen at all. NIST SP 800-53B puts penetration testing (control CA-8) in the high baseline only, while vulnerability scanning (RA-5) is in all three, so a moderate-impact federal system can be assessed with scans, interviews and document review and no penetration test. A CGRC holder working on such systems may seldom see a test report.

Choosing a direction

OSCP suits a junior penetration tester, or a system or network administrator moving into offensive work. OffSec's grading rules show what the job values: every flag needs a screenshot from an interactive shell, the report must let a competent reader repeat each step, and you can use Metasploit against one machine only.

CGRC suits an information system security officer, a security control assessor or a GRC analyst on federal programs. Its two years must be work "performed in pursuit of information system authorization" or the direct application of security risk management knowledge.

If you're early and can't yet tell which way you lean, neither one is the next step. PenTest+ vs OSCP covers the offensive entry points, and Security+ and CGRC covers the route into authorization work.

Crossing from one side to the other

Some testers move into GRC, and part of their experience may transfer. A tester at a FedRAMP assessment organization has done work in pursuit of authorization, and CGRC's own outline names penetration testing as an assessment method. In our reading that makes a fair case for the two years; ISC2 decides at endorsement. Commercial testing done outside any authorization process is a harder argument.

The tester also keeps OSCP for life. Only the OSCP+ designation lapses, so someone who moves into GRC and stops paying OffSec's $145 annual fee still holds OSCP. OSCP won't help toward CISSP: ISC2's list of credentials that waive a year of experience includes CGRC and no OffSec certification.

Moving the other way, from GRC into testing, OffSec sets no prerequisites, so CGRC neither helps nor counts. What OffSec recommends is administration and networking experience, which GRC work doesn't usually build.

Our view

If you want to test, take OSCP, and leave CGRC until the day you'd rather write the risk response than find the vulnerability. The one place we'd recommend both is a FedRAMP assessment organization, where testers and assessors work on the same engagement and a person with both credentials can work on either side. For a GRC professional, $1,699 for OSCP is hard to justify unless you're changing careers. There's a reasonable argument that anyone who acts on test results should have broken into a machine at least once. We'd accept it for the PEN-200 training and stop short of the 24-hour exam.

OffSec's maintenance handbook distinguishes extending an existing certification from obtaining a new one. Extending OSCP+ requires annual maintenance coverage, including when using a qualifying exam; passing the $799 recertification exam without that coverage instead issues a new three-year certification.

Sources (13)