ISC2 Certified in Governance, Risk and Compliance (CGRC)
About This Course
CGRCSM is a globally recognized Governance, Risk and Compliance certification that is a proven way to demonstrate your knowledge and skills to integrate IT & cybersecurity governance, data governance, risk management, risk analytics, performance management, and regulatory compliance within your organization. CGRCSM certification demonstrates you have the advanced technical skills and knowledge to utilize frameworks to integrate cybersecurity, data governance, risk modeling, and privacy within organizational objectives, better enabling stakeholders to make informed decisions regarding data security, compliance, supply chain risk management and more as established by the GRC experts at ISC2.
The CGRCSM instructor-led training course curriculum consists of 7 major domains of coverage:
1. Security and Privacy Governance, Risk Management, and Compliance Program
2. Scope of the System
3. Selection and Approval of Framework, Security, and Privacy Controls
4. Implementation of Security and Privacy Controls
5. Assessment/Audit of Security and Privacy Controls
6. System Compliance
7. Compliance Maintenance
What You'll Learn
1. Apply appropriate governance, risk management, and compliance principles in the risk responses to address non-compliances in organizational security and privacy requirements.
2. Evaluate corporate governance compliance programmes and management systems against national and international standards, laws, regulations, and risk management frameworks such as NIST, COBIT and ISO/IEC.
3. Assess forms of non-compliance and organisational risks to determine appropriate security and privacy controls and other governance requirements.
4. Implement operational performance indicators of compliance programmes and management systems in identifying non-compliance to organisational security & privacy objectives.
5. Develop compliance documentation such as control evidence, risk registers, residual risk records and Plans of Action and Milestones (POA&M) in compliance to relevant legislative and regulatory requirements.
6. Identify relevant stakeholders to seek advice from on the management of security and privacy non-compliances.
7. Determine appropriate risk assessment and risk responses to address non-compliances within scope of relevant corporate governance, legislative and regulatory requirements.
8. Identify legislative and regulatory requirements for the relevant organization's risk and corporate governance policies on systems, applications, data, information, and other IT assets in the system development life cycle (SDLC).
9. Identify non-compliances through risk assessments based on relevant legislative and regulatory requirements with risk treatment recommendations for stakeholders.
10. Propose and evaluate appropriate compliance programmes and management systems with cybersecurity, change management and continuous monitoring functions in consultation with management stakeholders to address regulatory changes.
Entry Requirements
At least 2 years of working experience in information security, governance, risk management, compliance, audit, privacy, or related technology functions
Foundational knowledge of information security governance, risk management and compliance principles
Familiarity with organisational policies, controls, audits, regulatory requirements or risk assessment activities
Ability to review and interpret business, governance and compliance documentation
Working proficiency in Microsoft Office applications (Word, Excel, PowerPoint)
Ability to speak, listen, read and write English at a proficiency level equivalent to the Employability Skills Workforce Skills Qualification (ES WSQ) Workplace Literacy (WPL) Level 6