Duration:
4 days
Course Synopsis:
In today's dynamic landscape of cybersecurity laws and regulations, organizations face a critical skills gap that can lead to increased liability. The Cybersecurity Specialization: Governance, Risk, and Compliance course equips individuals with the knowledge needed to navigate these complexities. It covers the creation of governance systems, risk management strategies, policy enforcement, and compliance measures. Through a challenge-based approach, participants gain practical skills that mirror real-world scenarios, enabling them to enhance their organization's cybersecurity posture and minimize legal risks.
Course Objectives:
In-depth coverage of the seven domains required to pass the CGRS exam:
- Develop a compliance risk mitigation strategy.
- Contribute to a risk management framework.
- Create policies with controls.
- Enhance risk maturity.
- Promote enterprise security.
- Prioritize business processes in continuity planning.
- Select eGRC tools based on needs and capabilities.
Course Prerequisites:
- Candidates must have a minimum of two years cumulative work experience in one or more of the seven domains of the CGRC CBK.
- A candidate who doesn’t have the required experience to become a CGRC may become an Associate of ISC2 by successfully passing the CGRC examination. The Associate of ISC2 will then have three years to earn the two years of required, relevant experience.
Who Should Attend:
The CGRC is ideal for IT, information security, and information assurance practitioners who work in Governance, Risk, and Compliance (GRC) roles and have a need to understand, apply and/or implement a risk management program for IT systems within an organization, including positions like:
- Cybersecurity Auditor
- Cybersecurity Compliance Officer
- GRC Architect
- GRC Manager
- Cybersecurity Risk & Compliance Project Manager
- Cybersecurity Risk & Controls Analyst
- Cybersecurity Third Party Risk Manager
- Enterprise Risk Manager
- GRC Analyst
- GRC Director
- Information Assurance Manager
Domain 1. Information Security Risk Management Program
- Understand the foundation of an organization information security risk management program
- Understand risk management program process
- Understand regulatory and legal requirements
Domain 2. Scope of the Information System
- Define the information system
- Determine the categorization of the information system
Domain 3. Selection and Approval of Security and Privacy Controls
- Identify and document baseline and inherited controls
- Select and tailor controls to the system
- Develop continuous control monitoring strategy (e.g., implementation, timeline, effectiveness)
- Review and approve security plan/Information Security Management System (ISMS)
Domain 4. Implementation of Security and Privacy Controls
- Implement selected controls
- Document control implementation
Domain 5. Assessment/Audit of Security and Privacy Controls
- Prepare for assessment/audit
- Conduct assessment/audit
- Prepare the initial assessment/audit report
- Review the initial assessment/audit report and perform remediation actions
- Develop final assessment/audit report
- Develop remediation plan
Domain 6. Authorization/Approval of Information System
- Compile security and privacy authorization/approval documents
- Determine information system risk
- Authorize/approve information system
Domain 7. Continuous Monitoring
- Determine impact of changes to information system and environment
- Perform ongoing assessments/audits based on organizational requirements
- Review supply chain risk analysis monitoring activities (e.g., cyber threat reports, agency reports, news reports)
- Actively participate in response planning and communication of a cyber event
- Revise monitoring strategies based on changes to industry developments introduced through legal, regulatory, supplier, security and privacy updates
- Keep designated officials updated about the risk posture for continuous authorization/approval
- Decommission information system
Examination Information
Length of exam
3 hours
Number of questions
Question format
Multiple choice
Passing grade
700 out of 1000 points
Exam availability
English
Testing center
Pearson VUE Testing Center
Programme scope, delivery arrangements and suitability are confirmed during enquiry.