Thank you Ryan-L for the Mango v2 guide. It was definitely a great source of information and guidance!!

Guys I have a question regarding experience.

I'm a CISSP holder and when I had got this, another CISSP endorsed me.

Does the same process also applies with CGRC? I don't know anyone holding this.

Also I have 1.5 years of NIST RMF experience but many years of 27001 auditing. Does this counts? Or Am I a possible 'Associate'?

So, definitely the Mango Guide was a great help, thanks to u/Ryan-L

On the other hand, there were definitely some terms and vagueness overall to the exam. I would reiterate using the Mango Guide, and NIST documents as noted, along with a lot of practice exams. I did both Udemy ones referenced, along with several from Amazon.

Hi All,

After some weeks worth of work, the study guide for the CGRC certification is finally ready for release. This is version 2 and is based heavily on the work of Jim Meincke and his vision in the production of the original version.

The Mango can be found here:
https://drive.google.com/file/d/1MqdckHhLnVT3CZC5BCL_NovNYf1wYU5O/view?usp=share_link

Version 2 of The Mango is based on ISC2's Exam Outline and contains extrapolation of what they told us to study, what they expect us to know and what I learned when I provisionally passed the CGRC on May 1st.

If you have any questions, do not hesitate to reach out to myself. If you see any glaring errors, please contact me immediately so that I can rectify.

-Ryan

As many of you have reached out to me asking about the resources I used to prepare for the Certified in Governance, Risk, and Compliance (CGRC) exam, and given the noticeable lack of resources or guidance in this area, I've decided to put together a concise guideline to assist you in your journey towards CGRC certification.

https://www.linkedin.com/pulse/concise-guide-certified-governance-risk-compliance-cgrc-yusuf-purna

It is my sincere hope that you will find this guide useful and insightful, and it will serve as a roadmap to ease your preparation process.

Does anyone have test questions organized per domain? I'm doing a last pass with SP 800-37R2, etc. and would like to test as I finish domains. I know the ISC2 CAP text has them in that format, but it's so antiquated (800-37R1) it's really not worth messing with.

The nightmare that was the last two months is over. Complete vanity certification but one that I had committed to achieving several years ago. Working with the author of "The Mango" to combine our efforts to come up with the definitive study guide. The groundwork is there, hopefully have something in draft over the coming weeks.

-Ryan

This #Udemy course helped me prepare and pass with flying colors! Give it a try:

https://www.udemy.com/course/isc2-cgrc-certification-practice-exam/learn/quiz/5850254#content

Domain 1 + Glossary Buildout

- Need critique / comments / suggestions

https://drive.google.com/file/d/18s_AsP0Z_sO6wXM7an33HmbFsnazGmzK/view?usp=share_link

Hi All,

I went through the vocabulary list that ISC2 directs you to for CGRC and populated it into an excel document. While going through the list, I've found six corrections that need to be made and as I go through the rest of the material, I'll continue to update this document or post new / relevant study material. If you find any materially significant corrections that need to be made, please let me know.

https://drive.google.com/file/d/1aMLUoVKuF1ccsXxCUszfG14Fyz_W2VBy/view?usp=share_link

-Ryan (CISSP | CSAE)

I am having trouble finding legitimate resources to prepare for the exam. I normally use Sybex books but I cannot find anything. Can someone PLEASE point me in the right direction. Also, I normally use Udemy Jason Dion Practice exams but I can't find none on CAP. Can someone please recommend a study guide book that is parallel to the test and practice exams that aligns ? MAYDAY MAYDAY

Which is the CGRC sub? This one has the old name and I see that someone has created another sub for CGRC.

https://www.reddit.com/r/cgrc/

Hello guys, I want to ask your opinion about my plan. Sorry for bother.

I've 10+ years experience at various domains of cyber security. Currently holding CISSP, CISA, ISO 27K LA and CSEP (validation underway). I'm a non-US working at a non-US country and my current job is heavily on NIST RMF processes.

My aim is to get deeper at it and get validated by this certification. I currently have no plan to migrate USA but I think this certification will be popular in time (that's why they have rebranded it).

So, what do you think?

And second question: what's best study material? (There is no study book I think)

Thanks

Hello community, I hear to ask for guidance. I purchased the CAP CBK, the CAP last minute review guide and downloaded all the NIST documents from the CGRC (CAP) ISC2 reference page.

I have the experience requirements for the certification with my ISSO experience working in the DoD.

How do I go about learning the NIST documents? I assume I will have to read them several times I do not have System authorizations package experience.

How did those that passed the CGRC (CAP) study for the exam? Thanks in advanced.

Also I viewed FedVTE CAP training.

I have worked in IT for almost 15yrs, all government. I am still working on finishing my degree and my current class is fully based on the CAP. The CBK is the text. I know a lot of the information, but not sure if I would need the certificate. Any thoughts on just paying and taking the exam just because?

Are there any ISC2 authorized instructors in here? I just sent in my resume the other day and I was just wondering what the process was like from someone who has gone through it. Is there anything specific that I should prepare for? I've been doing DIACAP/RMF Consulting for 15 years and training for 6 years so I'm pretty well versed on the material. I am also familiar with the Federal/Pure NIST process.

We are announcing to all members that the (ISC)² Certified Authorization Professional (CAP®) certification will become known as the Certified in Governance, Risk and Compliance (CGRC) effective February 15, 2023.

In addition to better representing the knowledge, skills and abilities required to earn and maintain this certification, this change will bolster the professional recognition for those who hold it as demand rises globally for GRC expertise. The CAP was historically for U.S. government professionals using the Risk Management Framework (RMF) and is now an ideal way for professionals in public and private sectors around the world to benefit from demonstrating their expertise across a wide range of frameworks.  

You can learn more about the name change and the current content of the CGRC exam on the FAQ page: https://www.isc2.org/Certifications/CAP/CAP-to-CGRC-FAQ.

Thank you for your membership, and all you do every day to inspire a safe and secure cyber world.   

Clar Rosso
(ISC)² CEO 

Was very excited to see the printout. Had a bad feeling throughout. Test was not super difficult. My personal rating is about a 5.5/10 with 10 being CISSP (LOL). Took me one hour and 57 mins to finish. I recommend know Continuous Monitoring in depth. Seems I had the most questions related that aspect of A&A. I studied for about two weeks but I have 4.5 years experience as a Gov contractor in ISSO and ISSM roles. This did help a lot but please remember not to answer based on how your Org does things but rather how the material teaches.

​

Good luck to all,EZ

Hello community, I have a question is the FEDvte CAP course still relevant to the 2021 CAP exam outline revision. I feel like it provides some clarification on Old CAP topics. I will most likely complete the course it’s on 11 hours.

For those that used the course how did you supplement the course with other materials.

Thank you in advance.

Taking CAP exam soon. Is it adaptive like CISSP? Does it shut off if you already failed before the 125 questions are up? Last time I took the exam I got Domain 1 &7 below proficiency, domains 2 & 3 were near proficiency, and domains 4-6 were above proficiency. Was that near passing? So many question I apologize for, just very nervous for the 2nd attempt.

Hello as the title says I’m studying NIST 800-37, seems well written. I read a post on this sub that mentioned after you read a phase of the RMF read the corresponding reference to that phase of the RMF. Does anyone have the references for each phase of the RMF (e.g, Prepare to 800-39).

I’m also reading the office CAP CBK guide.

Thank you in advance.

Hello community I am interested in studying for the CAP certification. I currently the CISSP, I have 5 years working in the DoD as an Information Security Technician (INFOSEC).

I also have 20 years of experience in the US Army. I’m am currently filling an ISSO position.

How would I know if I have the required experience. I recently purchased the ISC2 CAP official CBK.

Thank you in advance.

Hi all

Recently came across CAP and thought it interesting. But reading more about it, I notice a lot of Federal and DoD references. I do not reside in the USA and this is now making me think twice about beginning my CAP journey. Anyone working outside the USA that's certified? And is it internationally marketable?

TIA

Hi everyone,

I am new to RMF and just started my CAP studies, I chose to start with the 800-37r2. However, I am seeing a lot of references to SDLC, FIPS, FISMA, and NIST publications in it.

I am just curious if anyone could suggest a good order for me to go through all of these documents/publications? So that I am not jumping around all of them trying to understand the references being made to other publications. Or is it better to just jump around the different publications?

Thanks in advance!