32%

of security professionals say their organisation prioritises cybersecurity as a critical business function. ISC2 Cybersecurity Workforce Study 2025.

ISC2 Certified in Governance, Risk and Compliance (CGRC) certification

Make Security a Board Priority.

Only a third of professionals say their organisation treats cybersecurity as a critical business function. CGRC proves you can build the governance, risk and compliance programme that changes that.

HRD Corp claimableYayasan Peneraju: may be eligibleKL or online

Exam

ISC2 CGRC

Course

5 days

Course fee

RM9,500

Exam fee

Included

Next intake

25 Jan 2027

Quick answer

What is CGRC?

Certified in Governance, Risk and Compliance (CGRC), formerly CAP, is ISC2’s certification for professionals who run security and privacy risk management and compliance programmes. It proves you can scope a system, select, implement and assess controls, authorise it and keep it compliant. The exam is 125 items in three hours, and you need two years of experience to be certified.

Exam facts verified against isc2.org on 23 Oct 2026

FOR

GRC, risk, compliance and assurance professionals

ROLES

GRC analyst, compliance manager, ISSO, security control assessor

SKIP IF

You audit rather than run compliance. Look at ISACA CISA

01

The Credential

What you study, practise and sit to earn it.

Pass the CGRC exam, show two years of experience in a CGRC domain, and get endorsed. It covers the full lifecycle, from preparing a programme to monitoring it.

COURSE

5 days, 7 domains

COURSEWARE

ISC2 Official Training

EXAM

125 items, 3 hrs

CREDENTIAL

ISC2 CGRC

Awarded by

ISC2

Formerly

Certified Authorization Professional (CAP)

Experience

2 years in a CGRC domain

No experience yet?

Pass and become an Associate of ISC2

Exam outline

Effective 15 Jun 2024, with AI guidance

Upkeep

60 CPE per 3 years, US$135 a year

02

Decide in 60 Seconds

Four options people weigh against each other.

If you want to

Choose

Why

Run security and privacy compliance programmes

→

CGRC

Risk management lifecycle, from scoping to monitoring

Own IT risk linked to business goals

→

ISACA CRISC

IT risk management and controls

Audit IT systems and controls

→

ISACA CISA

The global standard for IS audit

Implement an ISO 27001 management system

→

ISO/IEC 27001 Foundation

Two-day grounding in ISO 27001

Two years of experience to certify. Are you ready?
0/4

Tick what applies. 3 or 4: you are ready for this course. Fewer: start with ISO/IEC 27001 Foundation.

03

What the Exam Covers

Seven domains from ISC2’s CGRC exam outline. Bars to scale.

7 domains, 125 itemsLargest: Implementation of Controls, 17%

Implementation of Security and Privacy Controls 17%
Governance, Risk Management and Compliance Program 16%
Assessment and Audit of Controls 16%
Selection and Approval of Framework and Controls 14%
System Compliance 14%
Compliance Maintenance 13%
Scope of the System 10%

Source: ISC2 CGRC Certification Exam Outline, effective 15 Jun 2024.

04

What the Course Covers

Seven modules that follow the risk management lifecycle.

Five days of ISC2 Official Training. You follow a system through the full risk management lifecycle, the same sequence the exam tests.

Steps 1 to 2

Prepare and Categorise

  • Prepare: governance, roles and risk strategy
  • Categorise: scope the system and its information types

Steps 3 to 4

Select and Implement

  • Select: frameworks, baselines and tailored controls
  • Implement: deploy and document the controls

Steps 5 to 6

Assess and Authorise

  • Assess: test controls and report findings
  • Authorise: risk acceptance and the compliance decision

Step 7

Monitor

  • Continuous monitoring, change and ongoing compliance

ISC2

Official Training courseware, taught by CGRC-certified instructors.

05

Why Now

Where governance falls short, and why train with us.

32%

say their organisation prioritises cybersecurity as a critical business function

ISC2 Cybersecurity Workforce Study 2025

30%

of security professionals see governance, risk and compliance as an in-demand skill

ISC2 Cybersecurity Workforce Study 2025

76%

say organisations should be held accountable if breached after cutting cybersecurity staff

ISC2 Cybersecurity Workforce Study 2025

6 hrs

Six Hours to Report. Who’s Watching the Alerts?

Malaysia’s Cyber Security Act 2024 (Act 854) came into force on 26 August 2024. Critical infrastructure entities must report a cyber security incident within six hours, and managed SOC monitoring services now need a licence. Meeting those duties is a governance, risk and compliance job.

NACSA; Cyber Security (Notification of Cyber Security Incident) Regulations 2024

ISC2 Official Training Preferred Partner

Official ISC2 courseware, CGRC-certified instructors

Exam included

One fee covers training and your exam

HRD Corp registered

This course is HRD Corp claimable

KL or online

Instructor-led in class or live online

06

The Cost, All In

Every figure per person, in ringgit.

Fees

Five-day courseIncluded

CGRC exam voucherIncluded

Funding

HRD Corp claim for employersClaimable

Yayasan Peneraju financing (Bumiputera)May be eligible

Course with exam

RM9,500

Dates

Where

Fee

Mon 25 to Fri 29 Jan 2027

Kuala Lumpur or online

RM9,500 incl. exam

Mon 19 to Fri 23 Apr 2027

Kuala Lumpur or online

RM9,500 incl. exam

Mon 9 to Fri 13 Aug 2027

Kuala Lumpur or online

RM9,500 incl. exam

Mon 29 Nov to Fri 3 Dec 2027

Kuala Lumpur or online

RM9,500 incl. exam

Training a team? We run private intakes on dates that suit your organisation, with HRD Corp claims handled alongside you.

07

Exam and Renewal

What exam day looks like, and what happens after you pass.

Certification

Certified in Governance, Risk and Compliance (CGRC)

Items

125, multiple choice and advanced item types

Duration

3 hours

Passing score

700 out of 1,000

Delivery

Pearson VUE test centre

Exam outline

Effective 15 Jun 2024

Experience

2 years in a CGRC domain

Exam fee

Included in the course fee

KEEP IT ACTIVE

Earn 60 CPE credits

Earn 60 continuing professional education credits over each three-year cycle, about 20 a year.

ANNUAL FEE

US$135 a year

ISC2 members pay one annual maintenance fee of US$135, however many ISC2 certifications they hold.

FAQ

Questions People Ask

What is CGRC?

Certified in Governance, Risk and Compliance (CGRC), formerly the Certified Authorization Professional (CAP), is ISC2’s certification for running security and privacy risk management and compliance programmes.

At Trainocate Malaysia the five-day CGRC course is RM9,500 per person, including the exam. The course is HRD Corp claimable, and Malaysian Bumiputera learners may be eligible for Yayasan Peneraju funding.

125 multiple choice and advanced items in three hours, at a Pearson VUE test centre. You need 700 out of 1,000 to pass.

Two years of cumulative work experience in one or more of the seven CGRC domains. Without it you can pass and become an Associate of ISC2, with three years to earn the experience.

Yes. The exam covers international frameworks such as ISO/IEC 27001, NIST and COBIT, and laws such as GDPR, alongside US frameworks. The skills apply to any regulated organisation, including those under Malaysia’s Cyber Security Act 2024.

CGRC focuses on running security and privacy compliance programmes through the full lifecycle. CRISC focuses on identifying and managing IT risk against business goals. Both suit GRC careers.

Earn 60 CPE credits every three years and pay the US$135 annual maintenance fee.

Lead the Compliance Programme

Pick an intake. An advisor confirms fees, HRD Corp claims and Yayasan Peneraju eligibility with you.

  • Next intake: 25 to 29 Jan 2027
  • RM9,500, exam included

Sources

  1. ISC2: CGRC certification
  2. ISC2: CGRC exam outline, effective 15 Jun 2024
  3. ISC2: Member policies (CPE requirements)
  4. ISC2: Annual maintenance fees
  5. ISC2: 2025 Cybersecurity Workforce Study
  6. Trainocate: CGRC course page
  7. NACSA: Cyber Security Act 2024 (Act 854)
  8. MAICSA: Act 854 regulations summary