Skip to content
CertGPS
Comparison

Security+ and CGRC (Formerly CAP): A Baseline First, Authorization Work Later

CAP is now ISC2's CGRC, a two-year credential for RMF authorization work. Why it follows Security+ rather than competing with it, and how to get from one to the other.

C
CertGPS

Not independently reviewed

AI-assisted content. Editorial policy · Suggest a correction

Published
Updated
Read time
4 min
On this page

Related certifications

Topics

Security+ and CGRC (Formerly CAP): A Baseline First, Authorization Work Later

There is no CAP exam to compare any more. ISC2 renamed the Certified Authorization Professional on February 15, 2023, and it's now the Certified in Governance, Risk and Compliance (CGRC), with the same exam and eligibility rules. Security+ needs no experience; CGRC needs two years in its domains and tests one job closely, taking an information system through the NIST Risk Management Framework (RMF) to authorization, so for a Security+ holder it usually comes a few years later.

Side by side

Security+CGRC
IssuerCompTIAISC2
FormatMultiple choice and performance-based itemsFixed length; multiple choice and advanced item types
QuestionsUp to 90125
Time90 minutes3 hours
Passing score750 on a 100–900 scale700 out of 1000
Price$439 voucher for SY0-701 (US list)$599 (Americas)
DeliveryPearson VUE test center or OnVUE onlinePearson VUE test centers, English only
ExperienceNone required; two years as a security or systems administrator recommendedTwo years cumulative full-time work in one or more of seven domains, or pass and become an Associate of ISC2
RenewalEvery three years: 50 CEUs and a $150 fee$135 a year and 60 CPE credits per three years

Two different career stages

Security+ is a first security certification for administrators, technicians and analysts. CompTIA maps it to a long list of US Department of Defense 8140 work roles, from system administrator to cyber defense analyst, and the list includes security control assessor.

CGRC is written for the people who write system security plans, run control assessments and assemble authorization packages: security control assessors among them, along with information system security officers and GRC analysts, typically on US federal programs or for their contractors. ISC2 lists it as approved under the DoDM 8140.03 manual. On a federal program, Security+ can get a newcomer onto an assessment or compliance team, and CGRC describes what that person will be doing two years later.

Since the rename, ISC2 has also pitched CGRC at GRC staff outside government, and its outline names ISO/IEC standards, COBIT, PCI DSS and GDPR alongside NIST. The order of the domains still follows the RMF, though, from scoping a system through to continuous monitoring.

What the exams actually ask

Security+ gives governance a slice of a broad exam. Security Program Management and Oversight is 20% of CompTIA's SY0-701 outline and drops to 14% in SY0-801, which launches on November 17, 2026. It asks you to know what a risk register is, how policies differ from standards, and what an audit is for, alongside firewalls, identity and incident response.

CGRC spends all 125 questions on the authorization lifecycle. In ISC2's June 2024 outline, domains four to seven (implementation, assessment and audit, system compliance and compliance maintenance) add up to 60%, so most of the exam is about what happens after the controls are chosen. The vocabulary is federal: a Plan of Action and Milestones (POA&M), authorizing officials, inherited and common controls, overlays, and examine, interview and test as assessment methods. A Security+ holder will recognize the ideas. CGRC asks you to place them in the right step of the RMF and the right document.

Both can be prepared for on a small budget. CompTIA publishes the Security+ objectives free, and the core CGRC reading, NIST SP 800-37 for the RMF and SP 800-53 for the controls, is free from NIST.

Getting from Security+ to CGRC

ISC2 counts two years of cumulative full-time work in any of CGRC's seven domains, and part-time work and internships can count toward it. ISC2's CGRC experience page lists no waiver for a degree or another credential, so Security+ doesn't shorten that requirement, but the job it helps you land can fill it. If you pass CGRC before reaching two years, you become an Associate of ISC2 and have three years to earn the experience.

Read SP 800-37 while you're in the job, so each RMF step attaches to a system you know. If your team runs assessments, ask to write the implementation statements or the POA&M entries for one system; that one package covers most of CGRC's domains.

Both credentials are on ISC2's list for waiving a year of the five CISSP requires, though ISC2 grants one year at most. CGRC also helps with Security+ renewal: CompTIA lists it among the outside certifications that earn all 50 Security+ CEUs, so passing CGRC during a Security+ cycle covers the CEUs, though CompTIA's $150 fee still applies. You'll still pay on two schedules: that fee every three years, and ISC2's annual fee of $135, which also covers any other ISC2 certification you hold.

Our view

For someone heading into federal compliance, we'd sit Security+ now, take any role that touches control assessment, and sit CGRC at the two-year mark. The $599 is well spent once the exam describes your actual job. Outside US federal work we're less keen. ISC2 has widened the outline since the rename, but the content is still shaped by the RMF, and a private-sector GRC analyst may get more from ISACA's CRISC or CISA later. A reasonable practitioner could disagree, since the current outline does name ISO/IEC standards, COBIT and GDPR. Our GRC specialist career track lays out those routes.

Sources