Certified in Governance, Risk and Compliance (CGRC)

Last checked October 22, 2026 against the official ISC2 exam page.

1. Question 1Implementation of Security and Privacy Controls

   What does implementing a control mean in the authorization process?

   1. AWriting a poem that describes the control in an informal way for the users of the system to read and remember
   2. BBuying new office furniture for the team that operates the system so that the staff can work in comfort each day
   3. CPutting the selected control into operation in the system as it is documented in the security plan
   4. DChoosing a name for the information system so that it can be identified in the inventory of the organization
   Show answer and explanationHide answer

   Correct answer: C

   Implementation means putting the selected control into operation as the plan describes, which is what later assessment verifies. Poems, furniture, and naming are not implementation activities.

2. Question 2Governance, Risk Management, and Compliance Program

   Which document sets the organization-wide approach to risk, including the risk appetite and tolerance used by all information systems?

   1. AThe system security plan, which describes the controls implemented for one individual information system only
   2. BThe plan of action and milestones, which lists the weaknesses found in assessments and the dates for fixing them
   3. CThe security assessment report, which records the results of testing the controls for a single system in scope
   4. DThe organization-wide risk management strategy, which defines how risk is framed, assessed, and responded to
   Show answer and explanationHide answer

   Correct answer: D

   The organization-wide risk management strategy frames how risk is assessed and tolerated across all systems, including appetite and response approach. The system security plan, plan of action, and assessment report each document a single system or a single activity rather than the enterprise approach.

3. Question 3Selection and Approval of Framework, Security, and Privacy Controls

   What is control tailoring?

   1. ASewing protective covers for the hardware so that the equipment is kept clean and undamaged in the server room
   2. BAdjusting a baseline of controls to fit the system's mission, operating environment, and risk, with documented reasons
   3. CPrinting labels for each control so that the operations staff can identify the controls quickly in the documents
   4. DDeleting the controls that the team finds inconvenient, so that the work is simpler for the staff who operate the system
   Show answer and explanationHide answer

   Correct answer: B

   Tailoring starts from a baseline and adjusts it for the mission, environment, and risk, with the rationale recorded. Sewing, labelling, and deleting inconvenient controls are not tailoring.

4. Question 4Assessment and Audit

   What is the purpose of a security assessment in the authorization process?

   1. ATo decide the budget that the organization will allocate to security tools in the coming financial year overall
   2. BTo choose the font that will be used in the user guides and the marketing material for the system at launch
   3. CTo draw the network diagrams that the team will use in its presentations to the business units during the year
   4. DTo determine whether the controls are implemented correctly and operating as intended for the system in question
   Show answer and explanationHide answer

   Correct answer: D

   A security assessment checks whether controls are implemented correctly and operating as intended, which is the evidence for authorization. Budgets, diagrams, and fonts are not the assessment's purpose.

5. Question 5System Compliance

   What is an authorization decision?

   1. AA logo that the marketing team approves for use on the system's login page and in its promotional material
   2. BA purchase order that the procurement team raises to buy the hardware that the system will run on in production
   3. CA formal decision by the authorizing official to accept the residual risk and allow the system to operate
   4. DA staff roster that lists the people who are scheduled to work on the system during each shift of the week
   Show answer and explanationHide answer

   Correct answer: C

   An authorization decision is a formal acceptance of residual risk by an authorizing official, allowing operation with a stated scope and term. Purchase orders, logos, and rosters are unrelated business records.