Skip to content
CertGPS
Comparison

ISC2 CC and CGRC (Formerly CAP): From a Governance Primer to Authorization Work

CC's 2026 outline added a governance domain; CGRC tests two years of authorization and compliance work. How a newcomer climbs from one to the other.

LT
Lisa Thompson
Security Training Director
Published
Updated
Read time
4 min
On this page

Related certifications

Topics

ISC2 CC and CGRC (Formerly CAP): From a Governance Primer to Authorization Work

Since September 1, 2026, ISC2's entry exam has a domain called Security Governance, and it introduces the governance, risk and compliance (GRC) work that ISC2's Certified in Governance, Risk and Compliance (CGRC) tests in depth. CGRC, called the Certified Authorization Professional (CAP) until 2023, wants two years of experience and a $599 exam. CC requires no experience and costs $199. They're two rungs of one ladder, and the question is how to climb from the first to the second.

Two ISC2 exams, two career stages

CCCGRC
IssuerISC2ISC2
FormatComputerized adaptive test; multiple choice and advanced item typesFixed length; multiple choice and advanced item types
Questions100 to 125, including 25 unscored pretest items125
Time2 hours3 hours
Passing score700 out of 1000, reported as pass or fail700 out of 1000
Price$199$599
ExperienceNoneTwo years full time in one or more of seven domains
Maintenance$50 a year and 45 CPE credits per three years$135 a year and 60 CPE credits per three years

Where CC's governance domain stops and CGRC starts

CC's Domain 2 carries 17.3% of the exam. It asks you to plan GRC work, know why it matters and which frameworks and tools support it, and measure security with metrics, key risk indicators, dashboards, scorecards and reports. It replaced a domain on business continuity and disaster recovery, so a CC holder from 2026 onward has seen more governance than earlier candidates did.

CGRC starts where that ends, with one information system and the paperwork that gets it authorized to operate. Its seven domains cover the control-assurance lifecycle, drawing on the NIST Risk Management Framework and other frameworks: the governance program (16%), scoping the system (10%), choosing controls (14%), implementing them (17%), assessing them (16%), system compliance (14%) and compliance maintenance (13%). Domains 4 to 7 make up 60%, so most of the exam is about what happens after controls are chosen. Candidates are expected to know a Plan of Action and Milestones, inherited controls, overlays and the role of an authorizing official.

A CC holder will recognize the word "framework" in both outlines and not much more. CGRC's first domain names ISO/IEC, FedRAMP, PCI DSS, CMMC, FISMA, HIPAA and GDPR, and the later domains lean on US federal terms throughout.

Two years of GRC work, and the Associate shortcut

ISC2 asks CGRC candidates for two years of cumulative full-time work in at least one of its seven domains. Part-time work counts at 20 to 34 hours a week, and paid or unpaid internships count with a letter confirming them. ISC2's CGRC experience page doesn't offer a degree waiver, which SSCP and CISSP do.

Someone without the two years can still pass and become an Associate of ISC2, then has three years to earn the experience. That costs $50 a year and 15 CPE credits a year, the same as CC's upkeep in fee terms. The difference is the exam fee: $599 against $199, and CGRC is in English only, while CC is offered in five languages.

The first job is the bridge. Junior GRC analyst, compliance analyst and assessment support roles on federal programs or their contractors all involve control documentation, evidence gathering and tracking findings, which is work inside CGRC's domains. A CC holder with a year in such a role and a second year in sight is a reasonable associate candidate. A CC holder with no GRC job yet isn't.

What each counts toward

Both are approved under the US Defense Department's DoDM 8140.03 manual, according to ISC2. Beyond that they diverge. CGRC is on ISC2's list of credentials that waive one year of the five CISSP requires, and CC isn't. CompTIA also accepts CGRC as a qualifying activity for renewing SecurityX, worth 75 continuing education units.

Holding both costs $135 a year in total, since ISC2 charges one fee however many certifications a member holds. Group A CPE credits count toward every active credential whose domains they relate to, so one governance course can count toward CGRC's 60 credits per cycle and CC's 45 at the same time. The job titles ISC2 lists for CGRC include cybersecurity auditor, compliance officer, GRC manager and information assurance manager, and our GRC specialist career track covers the stages in between. If audit is the part you like most, CISA vs CGRC compares the ISACA alternative.

Our view

CC is a sensible first exam for anyone aiming at GRC, more so since the 2026 outline gave governance its own domain. We wouldn't sit CGRC as an associate straight after it, though. At $599 with a three-year clock, it pays off once you're in a GRC role and can see the two years coming. A reader in private-sector GRC, far from federal authorization work, might reasonably skip CGRC for an ISACA certification; one on a federal contract should plan for it.

Sources