CGRC Requirements 2026: Who Can Sit the Exam and What It Costs
Before you can book a seat you have to clear ISC2’s eligibility gates. Here is exactly what they check, in the order they check it.
Table of Contents
What the CGRC credential is
ISC2 CGRC - Governance, Risk and Compliance Certification is awarded by ISC2. It is not a course certificate you can buy your way into — ISC2 decides whether you are allowed to sit the exam at all, and that decision is made before you ever see a question. Candidates who treat the application as a formality are the ones who lose a testing window to a paperwork problem.
The eligibility gates, in order
ISC2 checks these in sequence, and failing any one of them stops the application. Work through them top to bottom before you pay a fee.
Gate 1
Two years of cumulative paid work experience in one or more of the seven domains of the CGRC Common Body of Knowledge
Gate 2
Without that experience you can still sit the exam and become an Associate of ISC2, then have three years to earn it
The Associate route is the part most candidates miss: passing without the experience is a valid outcome, not a failure, and it starts a three-year clock rather than ending the process.
What it costs
ISC2 sets fees per application cycle and changes them often enough that a figure quoted here would age badly. Check the official page linked in the sidebar before you budget — and budget for a retake as well, which is charged separately.
What the exam itself looks like
| Passing standard | A scaled score of at least 700 out of 1,000 passes |
How long the process takes
Three clocks run at once and candidates usually notice only two. The first is the experience clock: the hours or years in the gates above have to be accrued, and in most programmes accrued recently, so time spent in the wrong role does not count no matter how long you spent there. The second is the approval clock: transcripts, licence verification and reference checks are done by people rather than scripts, and they run in weeks rather than days. The third is the eligibility window: once approved you have a fixed period to sit the exam, and letting it lapse means reapplying and paying again.
Plan backwards from the date you want the credential in hand, not forwards from the day you decide to start. The paperwork is the part that is outside your control, so it should go first.
Why applications get sent back
The failure modes are boring and they repeat. Hours logged in a role that does not match the definition in the handbook. A transcript sent by the candidate instead of by the school. A licence that is current but carries a restriction. Experience that is genuine but falls outside the lookback window. None of these are judgement calls you can argue your way past — they are checkboxes. Read the eligibility page as though it were a contract, because for the purposes of your application it is one.
Once you are approved, the work is question volume. Practise CGRC questions free and find out where you actually stand before you book a date.
FAQ
Who is eligible to sit the CGRC exam?
Two years of cumulative paid work experience in one or more of the seven domains of the CGRC Common Body of Knowledge Without that experience you can still sit the exam and become an Associate of ISC2, then have three years to earn it
How much does the CGRC exam cost?
ISC2 sets the fee per cycle. Check the official certification page for the current figure, and budget separately for a retake.
How many questions are on the CGRC exam?
ISC2 publishes the current item count in the candidate handbook.
How long does CGRC approval take?
Verification is manual, so allow weeks rather than days between submitting an application and being cleared to schedule. Once you are approved a fixed eligibility window starts running, and letting it expire means paying to apply again.
Sources
Every figure on this page comes from the certifying body, not from a third-party summary:
- https://www.isc2.org/certifications/cgrc
- https://www.isc2.org/certifications/cgrc/cgrc-experience-requirements
Checked September 2, 2026. Fees and eligibility rules change; confirm against ISC2 before you pay anything.