Skip to content
CertGPS

CGRC (Formerly CAP) or an Early CISSP Pass: Two ISC2 Options for GRC Staff

Comparison

CAP is now CGRC, and CISSP Associate means passing CISSP before five years. For GRC and authorization staff, which ISC2 exam to sit first and why.

Published
Updated
Read time
4 min
C
CertGPS

Not independently reviewed

AI-assisted content. Editorial policy · Suggest a correction

On this page

CGRC (Formerly CAP) or an Early CISSP Pass: Two ISC2 Options for GRC Staff

Both names in this comparison are out of date. ISC2 renamed the Certified Authorization Professional (CAP) on February 15, 2023, and it's now the Certified in Governance, Risk and Compliance (CGRC). "CISSP Associate" was never a certification: it's the Associate of ISC2, which you hold after passing CISSP without its five years of experience. For someone two to four years into authorization or compliance work, the deciding fact is that CGRC asks for two years and also takes one year off CISSP.

Both exams on one page

CGRC (formerly CAP)CISSP exam as an Associate of ISC2
IssuerISC2ISC2
FormatFixed-length; multiple choice and advanced item typesComputerized adaptive test; multiple choice and advanced item types
Questions125100 to 150
Time3 hours3 hours
Passing score700 out of 1000700 out of 1000
Price$599 standard registration (Americas)$749 standard registration (Americas)
Experience to certifyTwo years in one or more of seven domainsFive years in two or more of eight domains
Without the experienceAssociate of ISC2, three years to earn the twoAssociate of ISC2, six years to earn the five
Upkeep once certified$135 a year, 60 CPE credits per three years$135 a year, 120 CPE credits per three years; $50 and 15 credits a year while an associate

The system specialist and the program generalist

CGRC is written around one job: taking an information system through authorization. The people who write system security plans, run control assessments and assemble authorization packages are its audience, which on US federal programs means information system security officers and security control assessors. ISC2's own list of CGRC roles adds GRC analysts and managers, cybersecurity auditors and enterprise risk managers. ISC2 lists CGRC as approved under DoDM 8140.03.

CISSP covers the whole security program, and most of it is not governance. A GRC analyst who passes it early is betting that their next role is broader: security manager, architect, or consultant across several areas. Until you qualify, your designation is Associate of ISC2, not CISSP. ISC2's Associate FAQ says the badge does not identify the exam; its mark-use rules allow only the associate designation before certification.

RMF depth against eight-domain breadth

The CGRC outline follows the NIST Risk Management Framework from scoping a system through selecting, implementing and assessing controls to authorization and continuous monitoring. Implementation carries 17% of the exam and assessment or audit 16%, and Domains 4 to 7 together make up 60%. Domain 1 asks you to work with NIST, ISO/IEC, COBIT, FedRAMP, PCI DSS and CMMC. The vocabulary is federal: plans of action and milestones, authorizing officials, inherited controls, examine, interview and test.

CISSP names most of the same frameworks, but only as examples in objective 1.3 on governance and 1.9 on risk management, beside control assessments and continuous monitoring. Those two objectives sit inside a domain worth 16%. The other seven domains are where a GRC candidate is likelier to have gaps: cryptography and security models in Domain 3, network architecture in Domain 4, authentication systems in Domain 5, and secure coding in Domain 8. The two exams share a passing standard of 700 and the same three hours, but CISSP's adaptive format won't let you return to a question, while CGRC is a fixed 125 items.

The order that skips the associate stage

CGRC is on ISC2's list of credentials that waive one year of CISSP experience. A GRC analyst who certifies with CGRC at two years can therefore become a full CISSP once they have four years of work, without ever holding the associate designation. The waiver is capped at one year, whether it comes from a credential or a degree.

Authorization work also helps you meet CISSP's rule of experience in at least two domains. Control assessment matches objective 6.2 on security control testing and 6.5 on audits, and governance and risk work matches Domain 1. If your job has never touched networks, identity or operations, look for a project that does before you apply.

Fees reward staying inside ISC2. Members pay a single $135 annual maintenance fee however many certifications they hold, so CGRC and CISSP together cost the same each year as either alone. CPE credits are a separate matter: CISSP's 120 per cycle is double CGRC's 60.

If you're under two years, CGRC offers its own associate route, with three years to earn the two. That's a shorter wait than CISSP's and on an exam that matches your current work. Our GRC career track covers where CGRC sits in a longer plan, and SSCP against the associate route covers the same question for administrators.

Our view for GRC staff

For an ISSO, assessor or GRC analyst on a federal program, we'd sit CGRC first. It's $150 cheaper, it certifies the job you're doing, and it brings CISSP a year closer. The associate route suits a different reader: someone in a GRC seat with a technical background, three or more years in, who plans to move into broader security management and wants CISSP banked before the move. A reasonable practitioner might argue that CISSP opens more doors than CGRC at any stage. We'd agree once you can use the name, which is the point of waiting.

Sources (12)