Certifications
Certification prep guides
Study guides for 14 certifications GRC professionals pursue, from audit and ISMS to risk and AI governance: exam facts, domain weights, study plans and original practice questions.
CISA - Certified Information Systems Auditor
ISACA · Audit & Assurance
IT/IS auditors, internal auditors, control and assurance professionals, compliance analysts and security professionals who assess IT controls. A strong first certification for anyone moving into IT audit or GRC.
150 questions · 4 hours · practice QsCISMCISM - Certified Information Security Manager
ISACA · Security Management
Information security managers, aspiring CISOs, GRC leads and consultants who design, run and govern an enterprise security programme.
150 questions · 4 hours · practice QsCRISCCRISC - Certified in Risk and Information Systems Control
ISACA · Risk Management
IT risk analysts and managers, GRC professionals, control owners, business analysts and project managers who identify and manage IT risk through IS controls. Very relevant for TPRM and ERM roles.
150 questions · 4 hours · practice QsCGEITCGEIT - Certified in the Governance of Enterprise IT
ISACA · IT Governance
Senior IT governance, advisory and assurance professionals, CIO/CISO-track leaders and board advisers responsible for the governance of enterprise IT.
150 questions · 4 hours · practice QsCISSPCISSP - Certified Information Systems Security Professional
ISC2 · Security Management & Architecture
Security managers, architects, engineers, consultants, auditors and GRC leads who need broad, management-level security knowledge across eight domains. Widely required for senior security roles in the Gulf and globally.
100-150 items · 3 hours · practice QsCCSPCCSP - Certified Cloud Security Professional
ISC2 · Cloud Security
Cloud security architects, engineers, consultants and GRC professionals who assess or govern cloud services (SaaS/IaaS/PaaS), including cloud vendor risk and compliance.
100-150 items · 3 hours · practice Qs27001ISO/IEC 27001 Lead Auditor
Accredited personnel-certification bodies, e.g. PECB, or IRCA-certified courses (CQI) · ISO Management Systems - Audit
Internal and external ISMS auditors, GRC and compliance professionals, consultants and anyone who leads or supports ISO/IEC 27001 certification audits.
80 (PECB multiple-choice version) · 3 hours · practice Qs27001ISO/IEC 27001 Lead Implementer
Accredited personnel-certification bodies, e.g. PECB (and other training providers) · ISO Management Systems - Implementation
ISMS managers, consultants, security and GRC professionals who build or run an ISO/IEC 27001 ISMS and prepare organisations for certification.
80 (PECB multiple-choice version) · check official site · practice Qs42001ISO/IEC 42001 Lead Auditor / Lead Implementer (AI Management System)
Accredited personnel-certification bodies, e.g. PECB · AI Governance - ISO Management Systems
ISMS/GRC professionals extending into AI governance, auditors of AI management systems (AIMS), and consultants implementing ISO/IEC 42001.
80 (PECB, both LA and LI) · check official site · practice QsAIGPAIGP - Artificial Intelligence Governance Professional
IAPP (International Association of Privacy Professionals) · AI Governance
Privacy, legal, compliance, risk and GRC professionals, product and data leaders responsible for governing how AI is developed, deployed and used.
100 questions · 2.75 hours (2 h 45 min) with an optional 15-minute break · practice QsAAIAAAIA - ISACA Advanced in AI Audit
ISACA · AI Audit
Experienced IT auditors and advisors who assess, implement or audit AI systems and want to show AI audit expertise on top of CISA (or an equivalent audit/accounting designation).
90 questions · 2.5 hours · practice QsAAISMAAISM - ISACA Advanced in AI Security Management
ISACA · AI Security Management
Security managers and leaders (CISM or CISSP holders) who govern, assess and secure enterprise AI.
90 questions · 2.5 hours (150 minutes) - per ISACA AAISM candidate guide; confirm on official site · practice QsAAIRAAIR - ISACA Advanced in AI Risk
ISACA · AI Risk
IT risk, GRC and ERM professionals with an existing risk/audit/security credential who manage AI risk across the enterprise.
90 questions · check official site · practice QsSecAI+CompTIA SecAI+ (CY0-001)
CompTIA · AI Security (technical)
Security practitioners who secure AI systems and use AI in security operations; a practical, hands-on complement to AIGP/AAISM.
Maximum 60 · 60 minutes · practice Qs