Hi there
I am an ISC2 Instructor, an adjunct Professor in cybersecurity and I received my CGRC certificate last year.
Many of my students ask me if they should enroll in an ISC2 course or study on their own.
I always answer that it is a trick question and the answer is both! You should enroll in a good ISC2 course and study on your own.
Here are some thumb rules about certification that I got from my mentors, mentees and other students
1. This is a technical certification. Make sure that you have 2-3 years of experience in Governance/Risk/Compliance before you start working on this certification. You will get much more if you have the experience. While there an option to get this certificate with OUT the required work experience, most students got more from preparation for this exam because they could learn at work
2. If you like a structured approach - use the self learning modules by ISC2, it is very interactive and it gives a great overview
3. If you like interacting with your instructor, with your classmates and would like your training to be spread over 8 weeks, I recommend the 8 week instructor led courses. You get access to the course material for 6 months.
4. If you are prepared well, enroll in the 5 day workshop as a great review before you go for the exam.
5. The bottom line is that you have to read the standards and be very familiar with them. Start with this standard.
NIST SP 800-37 Rev 2, Guide for Applying the Risk Management Framework to Federal Information Systems
Many of my students and I benefited from the Free flashcards that ISC2 makes available.
Check out the graphics and links below.
Dr K
Cyber Security Professional
Self-Study Resources can be found here: https://www.isc2.org/Training/Self-Study-Resources
Here is a link to the Online Instructor Led Course as well:
https://enroll.isc2.org/catalog?pagename=cgrc-training
https://csrc.nist.gov/projects/risk-management/about-rmf
NIST SP 800-18 - development of system security plans
NIST SP 800-30 - supports the development of system and organizational risk assessments
NIST SP 800-30 Rev 1, Guide for Conducting Risk Assessments
SP 800-171 Rev. 2
Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
800-53 and 800-171 provide actual security controls
NIST SP 800-53A Rev 4 (Rev 5 when released), Assessing Security and Privacy Controls in Federal Information Systems and Organizations*
NIST SP 800-53 Rev 5, Security and Privacy Controls for Federal Systems and Organizations*
NIST SP 800-53B, Control Baselines for Information Systems and Organizations
NIST SP 800-37 Rev 2, Guide for Applying the Risk Management Framework to Federal Information Systems
NIST SP 800-39, Organizational Wide Risk Management
NIST SP 800-160, Volume I, Systems Security Engineering
FIPS 200 addresses the specification of minimum security requirements for federal information and information systems.
FIPS 199 addresses the classification divides systems. It divides the systems into high, moderate, and low impact systems based on their impact on individuals and organizations.
