topic Re: Self paced study - Official CBK in CGRC Study Group

Self paced study

Emem — Tue, 21 Feb 2023 13:18:43 GMT

Is there any self-paced study materials for CGRC?

Re: Self paced study

AndreaMoore — Tue, 21 Feb 2023 16:43:04 GMT

https://www.isc2.org/certifications/References#accordion-98214e3e692e455698e0c725124a6573

https://www.isc2.org/Training/Self-Study-Resources#accordion-e531654470c744c1b1af00ffdf6f0f3e

Here are some options for CGRC.

Re: Self paced study

emb021 — Tue, 14 Mar 2023 18:40:11 GMT

Thanks, but there is an error:

ISO 27001/ISO 27002 A Pocket Guide, 2nd Edition isn't published by McGraw-Hill. Its from It Governance Publishing

https://www.amazon.com/ISO27001-ISO27002-Pocket-Guide-2013/dp/1849285225/ref=sr_1_1?crid=2HGOC6CYUDH52&keywords=ISO+27001%2FISO+27002+A+Pocket+Guide&qid=1678818776&s=books&sprefix=iso+27001%2Fiso+27002+a+pocket+guide%2Cstripbooks%2C267&sr=1-1

Looking forward to new editions that cover the 2022 editions of 27001/2

Re: Self paced study

allenbaylis — Thu, 16 Mar 2023 15:55:39 GMT

Hi Adrea or anyone. I would like to sit this exam but I can't find any study material. The links you posted is for in class training. I'm looking for up to date text books

Re: Self paced study

allenbaylis — Thu, 16 Mar 2023 15:57:39 GMT

I'm looking for any up to date study material. Any recommendations would be greatly appreciated.

Re: Self paced study

emb021 — Thu, 16 Mar 2023 16:16:47 GMT

There is NO text book for the CGRC exam.

These are the recommended reference material to study.

Information Security Risk Management for ISCO 27001/ISO 27002, 3rd Edition by Alan Calder, Steve Watkings. Publisher: IT Governance Publishing. (Aug, 2019).
ISO 27001/ISO 27002 A Pocket Guide, 2nd Edition by Chris Davis, Mike Kegerreis, Mike Schille. Publisher: IT Governance Publishing. (Oct, 2013).
IT Auditing Using Controls to Protect Information Assets, 3rd Edition by Mike Kegerreis, Mike Schiller, Chris Davis. Publisher: McGraw-Hill Education. (Oct, 2019).
NIST FIPS-199, Standards for Security Categorization of Federal Information and Information Systems by U.S. Dept. of Commerce. (Feb, 2004).
NIST SP 800-115, Technical Guide to Information Security Testing and Assessment by Karen Scarfone, Murugiah Souppaya, Amanda Cody, Angela Orebaugh. (Sep, 2008).
NIST SP 800-137, Information Security Continuous Monitoring (ISCM) for Federal Information Systems and Organizations by Kelley Dempsey, Nirali Shah Chawla, Arnold Johnson, Ronald Johnston, Alicia Clay Jones, Angela Orebaugh, Matthew Scholl, Kevin Stine. (Sep, 2011).
NIST SP 800-160, Vol. 1, Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems by Ron Ross, Michael McEvilley, Janet Carrier Oren. (Mar, 2018).
NIST SP 800-30, Rev. 1, Guide for Conducting Risk Assessments by Joint Task Force Transformation Initiative. (Sep, 2012).
NIST SP 800-37, Rev. 2, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy by Joint Task Force Transformation Initiative. (Dec, 2018).
NIST SP 800-39, Managing Information Security Risk: Organization, Mission, and Information System View by Joint Task Force Transformation Initiative. (Mar, 2011).
NIST SP 800-53, Rev. 5, Security and Privacy Controls for Information Systems and Organizations by Joint Task Force Transformation Initiative. (Sep, 2020).
NIST SP 800-53B, Control Baselines for Information Systems and Organizations by Joint Task Force Transformation Initiative. (Oct, 2020).
NIST SP 800-60, Vol. 1, Rev. 1, Guide for Mapping Types of Information and Information Systems to Security Categories by Kevin Stine, Rich Kissel, William C. Barker, Jim Fahlsing, Jessica Gulick. (Aug, 2008).
NIST SP 800-70, Rev. 4, National Checklist Program for IT Products: Guidelines for Checklist Users and Developers by Stephen D. Quinn, Murugiah Souppaya, Melanie Cook, Karen Scarfone. (Sep, 2020).
NIST SP 800-88, Guidelines for Media Sanitization by Richard Kissel, Andrew Regenscheid, Matthew Scholl, Kevin Stine. (Dec, 2014).

Re: Self paced study

allenbaylis — Thu, 16 Mar 2023 19:16:54 GMT

Thank you!

Re: Self paced study

SumanS0urav — Sat, 01 Apr 2023 11:48:44 GMT

Do we have official CBK study guide or e-book for this exam ?

Re: Self paced study - Official CBK

DrK — Sat, 01 Apr 2023 23:35:28 GMT

CAP Official (ISC)2 Student Guide 6th Edition

Dr Sudesh Kannan

Re: Self paced study - Official CBK

emb021 — Mon, 03 Apr 2023 15:28:10 GMT

And is this "CAP Official (ISC)2 Student Guide 6th Edition" valid for the CGRC exam?

Re: Self paced study - Official CBK

singh83 — Tue, 04 Apr 2023 07:42:17 GMT

looks like that's the case since ISC2 renamed CAP to CGRC. btw, I couldn't find a link to the book title.

Re: Self paced study - Official CBK

emb021 — Tue, 04 Apr 2023 13:28:14 GMT

Same. Looked for the source mentioned and nothing came up on Google but the old CBKs from ISC.

Re: Self paced study - Official CBK

RyanLeVier — Tue, 04 Apr 2023 15:58:41 GMT

I had a number of conversations with different people in the community, I even tried to reach out to Paul Howard (original author who is also local to me) but the common prevailing explanation is that the CBK is now behind the Course Paywall. In order to access a prepared CBK you must purchase training from ISC2.

That said, of course anyone is free to chase the resources and create your own CBK (which is what I am in the process of doing). I've started by creating a Vocab list from linked resources and I think I've discovered a few holes in the vocabulary list.

https://drive.google.com/file/d/1aMLUoVKuF1ccsXxCUszfG14Fyz_W2VBy/view?usp=share_link

-Ryan LeVier, CISSP | CSAE

Re: Self paced study - Official CBK

ericgeater — Wed, 05 Apr 2023 14:45:33 GMT

@RyanLeVier that's a great document... but when I opened it in Google Docs the layout seemed to drastically change. Don't know if that's because my browser decided to mangle it.

Still, I am glad you shared it with us. If we see something that might be useful to add, would you like for us to mention it?

Re: Self paced study - Official CBK

DrK — Wed, 05 Apr 2023 15:30:50 GMT

Yes - the material has not changed. Only the name has changed from CAP to CGRC

Re: Self paced study

Uminxu2 — Thu, 04 May 2023 07:54:12 GMT

Thanks Mike!

Re: Self paced study - Official CBK

Uminxu2 — Thu, 04 May 2023 08:16:12 GMT

Thanks Ryan for the document and obvious effort it took to put it together!

Re: Self paced study - Official CBK

Joephoto — Fri, 28 Jul 2023 13:06:05 GMT

Don't know how your vocabulary list compares, but (ISC)2 has online vocabulary flashcards that cover the seven CGRC domains, and it is actually free: https://www.isc2.org/Training/Self-Study-Resources/CGRC/Chapter-1#

Re: Self paced study - Official CBK

Ashief_Ahmed — Mon, 31 Jul 2023 20:14:03 GMT

Hi,

There are lots of resources and I am kind of confused. Is there anyone who can provide a crisp list of resources for CGRC?

Thanks a lot.

Regards,

Ashief Ahmed CISSP, SSCP, CCSP, CC, CISA, CISM, CGEIT, CDPSE, CCSK, AWS SAA

Re: Self paced study - Official CBK

ericgeater — Mon, 31 Jul 2023 20:57:12 GMT

@Ashief_Ahmed, @emb021 correctly pointed out that the bulk of free material is the NIST and ISO documents which companies commonly use to create a governance strategy. There may be some paid training available from ISC2, but if you're just talking self-study, then becoming familiar with the Special Publications may be a great place to begin.

Oh, and the Flash Cards. They're pretty useful.