CGRC Cheat Sheet 2026

The 30 highest-yield CGRC facts, distilled from real exam questions. Print it, save it as a PDF, or study it here — free, no sign-up.

1. What is the role of 'tone at the top' in an effective compliance program? → Senior leadership visibly demonstrating commitment to ethical conduct and compliance
2. Which federal law in the United States specifically governs the collection of personal information from children under 13 years old? → COPPA
3. An organization performs a threat analysis and finds that employees are the most frequent source of incidents. This category of threat source is called: → Insider threat
4. What is a best practice in Certified Governance Risk and Compliance policy development? → A method or technique recognized as superior based on evidence and expert consensus
5. What is a best practice in Certified Governance Risk and Compliance authorization process? → A method or technique recognized as superior based on evidence and expert consensus
6. Which FedRAMP security assessment concept requires cloud service providers to maintain a continuously updated inventory of their security posture? → Continuous Monitoring (ConMon)
7. What is the primary risk associated with conducting a penetration test without a signed rules of engagement (ROE) document? → The assessor may face legal liability for activities that would otherwise be authorized
8. In Certified Governance Risk and Compliance, what role does continuing education play in governance principles? → To keep professionals current with evolving standards, technologies, and best practices
9. In Certified Governance Risk and Compliance, what is the primary function of strategic planning in audit management? → To set long-term goals and determine the best approach to achieve them
10. Under NIST SP 800-122, what is the recommended approach for assessing privacy risk associated with PII? → Evaluate the likelihood of a PII breach and the impact on affected individuals
11. Which type of assessment in Certified Governance Risk and Compliance compares an individual's performance to a predetermined standard? → Criterion-referenced assessment
12. A risk register entry shows a threat with HIGH likelihood but LOW impact. How should this risk typically be prioritized? → Medium priority — monitor and apply cost-effective controls
13. Under NIST SP 800-60, which federal government function is an example of a 'Management and Support' information type? → Human Resources Management
14. Which compliance framework is MOST commonly used as a baseline for US federal government contractors handling controlled unclassified information (CUI)? → NIST SP 800-171
15. What is the primary objective of governance principles in Certified Governance Risk and Compliance? → To ensure competence and proficiency in core governance principles concepts
16. Which federal law requires all federal agencies to categorize their information and information systems using FIPS 199? → Federal Information Security Modernization Act (FISMA)
17. What is a key benefit of implementing performance metrics in Certified Governance Risk and Compliance risk management framework? → Providing measurable data to track progress and inform decision-making
18. Who is primarily responsible for reviewing and accepting the risk associated with items listed on a POA&M? → The Authorizing Official (AO)
19. In Certified Governance Risk and Compliance, why is policy development knowledge important for professional certification? → It demonstrates competence and ensures practitioners meet established standards
20. During a CGRC assessment, an auditor reviews an organization's consent management practices. Which characteristic makes consent valid under GDPR? → Freely given, specific, informed, and unambiguous indication of agreement
21. What is the difference between reliability and validity in Certified Governance Risk and Compliance assessment? → Reliability refers to consistency of results; validity refers to accuracy of measurement
22. FIPS 199 defines the security category of an information system based on which three security objectives? → Confidentiality, Integrity, and Availability
23. Which of the following best describes the 'examine' assessment method defined in NIST SP 800-53A? → Reviewing, inspecting, and analyzing specifications, documentation, and mechanisms
24. Under NIST SP 800-37 Rev. 2, who reviews and approves the Security and Privacy Assessment Plan before the control assessment starts? → The authorizing official or designated representative
25. What is the relationship between theory and practice in Certified Governance Risk and Compliance continuous monitoring? → Theory provides the foundation and framework that guides effective practical application
26. What is the primary objective of authorization process in Certified Governance Risk and Compliance? → To ensure competence and proficiency in core authorization process concepts
27. What is the role of the System Owner in relation to security controls under the RMF? → Ensuring controls are implemented, documented, and maintained for their system
28. Which control family in NIST SP 800-53 covers contingency planning, including backup and recovery procedures? → CP – Contingency Planning
29. Which security assessment technique examines application source code to identify vulnerabilities without executing the program? → Static Application Security Testing (SAST)
30. Which assessment method involves evaluating security controls by reviewing documentation, interviewing personnel, and observing system behavior? → Security control assessment