topic Re: CGRC before CISSP? in CGRC Study Group

CGRC before CISSP?

SalzburgGirl — Tue, 01 Oct 2024 10:50:08 GMT

Before I embark on the CISSP, I was wondering if getting the CGRC would make sense or is even recommended. I mainly work in the GRC area (doing policy work), and would like to get a more solid understanding of the different frameworks etc. I am thinking that getting a CGRC certification could help me here.

Does it make sense to attempt this certification without the knowledge & experience required for a CISSP?

Thanks for any guidance you may have.

Re: CGRC before CISSP?

ericgeater — Tue, 01 Oct 2024 13:20:10 GMT

I've done a self-study of the CGRC. I still may take the exam next year for the wisdom of the frameworks, as you mentioned. But CISSP is a completely different depth than CGRC.

I would pick up a CGRC study guide (if one exists?!) and give it a read-through. The material rarely changes, as you may expect. If you find that you're already well-placed in your knowledge, then maybe the CGRC will be an easy win for you.

But it likely won't lend much toward your CISSP study.

Re: CGRC before CISSP?

gidyn — Tue, 01 Oct 2024 14:33:46 GMT

If you've never done an ISC2 exam before, one in an area that you're familiar with may good to get a taste of the question style.

Re: CGRC before CISSP?

SalzburgGirl — Thu, 03 Oct 2024 13:08:15 GMT

Hi @ericgeater ! Thank you for your views on this. There is no dedicated study guide for this certification, as far as I know. So, I will have to resort to what's available for the CISSP. But good to know that the CGRC doesn't go into the same great depth as the CISSP (I assume that that is what you meant 😉).

I have done one ISC2 exam already (the CC), so I am somewhat familiar with the format.

Re: CGRC before CISSP?

emb021 — Thu, 03 Oct 2024 14:00:52 GMT

@SalzburgGirl Sadly, its hard to understand what the revamped CGRC cert covers as there is no review guide.

Have you looked at ISACA's CGEIT or CRISC certs? I found these two helped me in my GRC career.

Further, both CGEIT and CRISC are fairly well known certs. CGRC is just too new.

Re: CGRC before CISSP?

ericgeater — Thu, 03 Oct 2024 15:51:17 GMT

Hello @SalzburgGirl , and someone once said that the best study guides are the frameworks themselves. 800-37, 800-53, etc etc. In fact, somewhere on this forum is a thread where an exhaustive roster of frameworks is listed!

Also, someone shared a document to me, which they call the Mango Document (for some reason). It's on their Google Drive, and it expressly deals with CGRC. I am placing the link below:

https://drive.google.com/file/d/1MqdckHhLnVT3CZC5BCL_NovNYf1wYU5O/view?usp=sharing

Definitely, you should look in the forum for the thread I just mentioned.

Re: CGRC before CISSP?

nkeaton — Fri, 25 Oct 2024 19:58:26 GMT

The CGRC is very different from the other exams. It was the first one that I did (was CAP at the time). It was more difficult for me because it was non-technical. If you are asking for a progression, I would recommend the CC first while it is no cost for most (self-study training and exam voucher). I think it relieves a lot of the stress of taking an ISC2 exam and is the general knowledge need for the CISSP (no analytical questions). If your goal is the CISSP, you might consider doing the SSCP after the CC and then the CISSP. The CGRC does not exactly fit in a sequence and could do it after the CC as well as long as remember that everything that you need is in the NIST documents but is definitely different than the others except maybe the ISSEP. CGRC and the CISM also complement each other well because deal with frameworks and GRC. I do hold all of these mentioned if have any additional questions. Best wishes. .

Re: CGRC before CISSP?

nkeaton — Fri, 25 Oct 2024 20:00:53 GMT

The CBK for the CGRC really adds zero to study; I waited for its release and learned nothing from it. I used the NIST documents and questions by Jim Litchko who I consider the #1 expert in the World on the CGRC (formerly CAP) and RMF.

Re: CGRC before CISSP?

nkeaton — Fri, 25 Oct 2024 20:09:50 GMT

The NIST documents are what I used and passed with those, self-study. The CGRC is not new. It was only renamed. I took it as the CAP in 2012. It had just changed from DIACAP to RMF. So I am not sure even how long that it was an exam before I took it (I just did an internet search and said 2005). CAP just happened to work out as an acronym as was Certification and Accreditation Professional before I took it. When I tested was Certified Authorization Professional. One of the reasons that I took it when I did and not another was that it was the first exam to be offered online at an exam center. The rest were still paper and pencil (question sheet and answer book) as a group at a hotel or some other large meeting place.

Re: CGRC before CISSP?

dips0502 — Mon, 28 Oct 2024 13:39:35 GMT

I have taken and passed both exams, with the CGRC being the more recent. I don't necessarily think it makes much of a difference which one you attempt first. The CBK for both exams is mostly different, with perhaps a 10 percent overlap. The CGRC heavily revolves around the NIST RMF and other NIST references, with COBIT, GDPR, and ISO only mentioned in passing. You can find the NIST references in the suggested CBK references for the exam. If you work with the NIST RMF and are already comfortable with it, then you should be fine starting with it. If you want to start with a certification that caters to a more global audience, then consider the CISSP.

Re: CGRC before CISSP?

emb021 — Tue, 29 Oct 2024 13:23:24 GMT

@dips0502 Thanks for the info.
Kind of disappointing. If ISC2 is pushing this as a "GRC" cert vs a "CAP" cert, then they need to add MORE stuff from other frameworks such as COBIT, CIS Controls, 27001, NIST CSF, etc and NOT be so heavy on RMF.

Re: CGRC before CISSP?

dips0502 — Tue, 29 Oct 2024 13:36:48 GMT

I 100 percent agree!

Re: CGRC before CISSP?

nkeaton — Thu, 31 Oct 2024 15:10:28 GMT

They did add some frameworks, but for now the emphasis seems to be most on RMF. Perhaps that will change the next time that they update the exam. I do agree that the name change might be more about name recognition. I still think is a good exam but definitely not technical. The CISM or ISSEP would dive deeper in GRC and frameworks.