TRAIN FOR THE MISSION. BUILD WHAT COMES NEXT.CyberSkillForge portal
DoD Training Center
PEOPLE. SKILLS. STRONGER MISSIONS.DEFEND TODAY.
BUILD TOMORROW.
ELITE TRAINING
FOR A MORE
SECURE TOMORROW.
Build an approval pack →Prepare for this course →
CYBERSECURITY TRAINING

Certified in Governance, Risk and Compliance (CGRC)

ISC2 / CGRC

Build the skills for your next mission.

This advanced certification course, aligned with the rigorous standards of ISC2, provides comprehensive training in the critical domains of governance, risk management, and compliance within information and operational technology environments.

ISC2 CGRC certification tile on a dark circuit background with a luminous globe

Course objectives

Build practical skills across the key domains covered in Certified in Governance, Risk and Compliance (CGRC) (CGRC).

Governance, Risk, and Compliance (GRC) FoundationsUnderstand the core principles and components of GRC.
  • Understand the core principles and components of GRC.
  • Identify and differentiate between various GRC frameworks and standards (e.g., NIST, ISO, COBIT).
  • Analyze the impact of legal, regulatory, and contractual obligations on GRC initiatives.
  • Explain the role of organizational policies, standards, and procedures in GRC.
  • Describe the relationship between GRC and enterprise risk management (ERM).
  • Evaluate the ethical considerations and professional responsibilities in GRC.
GRC Program DevelopmentDevelop a GRC strategy aligned with organizational objectives and risk appetite.
  • Develop a GRC strategy aligned with organizational objectives and risk appetite.
  • Establish GRC roles, responsibilities, and organizational structures.
  • Implement GRC policies, standards, and procedures.
  • Integrate GRC processes with existing business operations and IT systems.
  • Select and apply appropriate GRC technologies and tools.
  • Design GRC training and awareness programs for stakeholders.
  • Develop metrics and key performance indicators (KPIs) for GRC program effectiveness.
Risk ManagementIdentify and categorize various types of risks (e.g., operational, financial, cybersecurity, compliance).
  • Identify and categorize various types of risks (e.g., operational, financial, cybersecurity, compliance).
  • Conduct risk assessments using quantitative and qualitative methodologies.
  • Analyze risk likelihood, impact, and interconnectedness.
  • Develop and implement risk treatment strategies (e.g., mitigation, transfer, acceptance, avoidance).
  • Monitor and review risk profiles and treatment effectiveness.
  • Report on risk posture to relevant stakeholders and management.
  • Understand the role of threat intelligence in risk management.
Compliance ManagementIdentify and interpret relevant compliance requirements (e.g., GDPR, HIPAA, SOX, PCI DSS).
  • Identify and interpret relevant compliance requirements (e.g., GDPR, HIPAA, SOX, PCI DSS).
  • Develop and implement compliance frameworks and controls.
  • Conduct compliance assessments and audits.
  • Manage compliance deviations and non-conformities.
  • Report on compliance status to internal and external stakeholders.
  • Maintain compliance documentation and records.
GRC Program Monitoring and OptimizationEstablish and implement GRC monitoring and reporting mechanisms.
  • Establish and implement GRC monitoring and reporting mechanisms.
  • Conduct internal and external audits of GRC controls and processes.
  • Analyze audit findings and implement corrective actions.
  • Evaluate the effectiveness of the GRC program and identify areas for improvement.
  • Manage GRC program changes and updates.
  • Communicate GRC performance and posture to executive management and the board.

Find your DoD 8140 pathway

Explore how this training may align to DoD 8140 work roles and proficiency levels.

Verify mapping against the current official matrix.View authoritative source V2.1 · 2025-09-19

About this course

This advanced certification course, aligned with the rigorous standards of ISC2, provides comprehensive training in the critical domains of governance, risk management, and compliance within information and operational technology environments. Participants will gain a deep understanding of how to establish, implement, and maintain effective security programs that align with organizational objectives, regulatory requirements, and industry best practices. The curriculum emphasizes the strategic integration of cybersecurity principles into enterprise-wide risk management frameworks, ensuring a resilient and compliant operational posture.

Training alone does not establish DoD 8140 qualification. Confirm position-specific requirements with your organization.

YOUR NEXT MISSION

Build capability.
Advance with confidence.

Plan your training