What is the CPL?
The Cybersecurity GRC Engineer Certified Professional License
What the license represents
The CPL recognizes experienced practitioners who can connect cybersecurity obligations, organizational risk, control objectives, technical implementations, assessments, evidence, remediation, and executive decisions across enterprise, cloud, software, industrial, government, and supply-chain environments.
A professional who earns this license can determine scope and applicability; translate overlapping requirements into measurable control objectives; define ownership, inheritance, and implementation traceability; design assessment procedures and acceptance criteria; evaluate control effectiveness; preserve evidence provenance and integrity; govern findings, exceptions, and corrective actions; and design automation that supports continuous assurance.
The license represents the demonstrated ability to build and explain a defensible assurance system, distinguish compliance status from cybersecurity outcomes, communicate limitations and residual risk, and support accountable decisions. It does not independently confer legal, audit, system-authorization, control-owner, or risk-acceptance authority..
What Will I Receive?
Your Professional Licensing Certification
Your certification is the official record that you have satisfied the qualification and assessment requirements for the Cybersecurity GRC Engineer CPL. It displays your name, professional designation, issue date, and unique License ID.
The license is valid for three years and can be independently verified through the ISAUnited public credential registry at
Your Professional Stamp
The personalized Cybersecurity GRC Engineer CPL Stamp is a professional mark issued to each license holder. It identifies the holder by name and signifies demonstrated capability to design, integrate, assess, automate, validate, and communicate cybersecurity governance, risk, control, evidence, and assurance systems.
Authorized use of the CPCA Stamp
The stamp may be applied to obligation and applicability profiles, cybersecurity risk and control architectures, control implementation records, assessment plans, evidence catalogs and Evidence Packs, findings and remediation packages, continuous-assurance designs, technical reports, and executive decision reports prepared, reviewed, or approved by the license holder within their assigned professional responsibilities.
Use of the stamp signifies professional accountability for the GRC engineering work and adherence to ISAUnited licensing requirements and its Code of Ethics. It does not represent organizational approval, legal or regulatory determination, independent audit opinion, compliance certification, system authorization, or acceptance of risk unless the license holder has been separately granted that authority.
Who is this CPL For?
Designed for Experienced Practitioners
The Cybersecurity GRC Engineer CPL is for cybersecurity, technology, risk, assurance, and governance professionals who design, assess, integrate, or improve systems that connect obligations and cybersecurity risk to controls, technical evidence, remediation, and organizational decisions. Candidates do not need to already hold the title Cybersecurity GRC Engineer, but should have experience with cybersecurity controls, risk analysis, assessment, evidence, findings, and cross-functional decision support.
NOTE: The CPL is a professional-level credential and is not intended as an entry-level cybersecurity certification.
Cybersecurity GRC and Security Assurance Professionals
Practitioners responsible for building or improving governance, risk, control, evidence, assessment, remediation, and assurance processes across cybersecurity programs.
Security Control Assessors and Technology Auditors
Professionals who plan and perform technical control assessments, examine evidence, document limitations, develop findings, and support remediation while preserving required independence.
Risk and Compliance Automation Practitioners
Professionals who engineer control-monitoring, evidence-collection, policy-checking, workflow, metrics, and exception-handling capabilities for continuous assurance.
Senior Security Engineers, Architects, and Technical Leaders
Experienced practitioners responsible for connecting security requirements and risk to technical implementations, assessment evidence, corrective action, and decision-ready assurance.
Why Should I Earn it?
Demonstrate Applied Cybersecurity GRC Engineering Capabilities
The Cybersecurity GRC Engineer CPL lets experienced professionals demonstrate they can perform GRC engineering work in a realistic Cyber Capstone. It recognizes applied judgment - how you determine applicability, analyze cybersecurity risk, normalize control objectives, evaluate implementation and evidence, engineer remediation, design continuous assurance, and communicate residual risk - not just knowledge recall.
Demonstrate Applied Capability
Show that you can engineer a traceable assurance system through professional work products covering governance context, risk and control architecture, assessment and evidence, remediation, continuous assurance, and executive decision support.
Strengthen Your Professional Credibility
Use the Cybersecurity GRC Engineer designation and professional stamp to identify your demonstrated capability and accountability in cybersecurity governance, risk, control assessment, evidence, and assurance engineering.
Make Your Achievement Verifiable
Give employers, clients, and professional peers a unique License ID they can confirm through the ISAUnited public credential registry.
Support Your Career Development
Document your readiness for cybersecurity GRC engineering, security assurance, control assessment, technology audit, compliance automation, cyber risk, and technical governance opportunities.
How Can I Earn It?
Two ways to earn your license.
Path 1 — Attend ISAU Academy (recommended)
Learn the method, then earn the license:
-
Enroll in the Pro Bundle (course + ebook + one evaluation)
-
Complete the self-paced modules (knowledge checks; non-heavy)
-
Submit your capstone portfolio (principles, models, methods in use)
-
Panel review & decision (up to 14 days for course completion)
NOTE: 20 CPEs awarded automatically for course completion.
Path 2 — Direct Evaluation (for experienced practitioners)
Already fluent in the concepts and methods? Bypass the course and go straight to the cyber capstone portfolio:
-
Brief eligibility check (experience + example artifacts)
-
Cyber Capstone portfolio submission and panel review
-
Same license, same stamp, same public verification
NOTE: 0 (zero) CPEs will be awarded for not completing the course.
What Is the CPL Assessment?
A Cyber Capstone Completed Through FlexCert 30
The certification exam isn't a traditional multiple-choice, memorization-based test. Instead, you complete a real-world, scenario-based Cyber Capstone that reflects the work cybersecurity practitioners do.
You will analyze a realistic organization and technical environment, identify security requirements and design risks, develop a secure architecture, recommend risk remediation, explain your design decisions and trade-offs, and define how to validate the architecture.
What You Will Submit
Your Cyber Capstone includes five connected professional work artifacts:
-
Architecture Context and Requirements Brief
-
Threat Model and Design Risk Analysis
-
Target Security Architecture Package
-
Security Design Rationale and Implementation Guidance
-
Architecture Validation and Executive Decision Brief
Complete It Through FlexCert 30
FlexCert 30 is the remote, independent format for completing your Cyber Capstone. You receive a controlled professional scenario, instructions, and submission templates, then have 30 days to develop and submit your work.
Complete the assessment on your own schedule without traveling to a testing center, scheduling a fixed examination appointment, or participating in live remote proctoring.
Thirty days. Independent completion. Your schedule.
How Will I Be Evaluated?
Your Cyber Capstone Artifacts Work Is the Evidence
Trained evaluators review your five Cyber Capstone artifacts as one connected architecture submission. The evaluation considers whether your requirements, threat analysis, architecture models, security controls, design decisions, validation approach, and professional communication are clear, technically sound, and consistent.
Part 1 — Technical Artifact Evaluation
This section determines whether you have passed the technical requirements of the Cyber Capstone.
Evaluators assess:
-
Architecture context and security requirements
-
Architecture models, data flows, and trust boundaries
-
Threat modeling and design risk analysis
-
Security patterns and control placement
-
Design decisions, trade-offs, and risk remediation
-
Technical feasibility and implementation guidance
-
Validation criteria and professional communication
Part 2 — Professional Capability Profile
We also use your submission to develop a separate Skills, Knowledge, and Abilities Capability Profile. This evidence-based profile evaluates your professional reasoning, technical judgment, disciplined practice, problem-solving, and communication across seven capability dimensions.
The profile shows how you performed, where you demonstrated strength, and where continued professional development may be beneficial.
Your Evaluation Outcome
After the review is completed, you receive a Defensible Capability Score Report containing your technical results, professional capability profile, evaluator findings, and licensing decision.
Candidates who successfully satisfy the technical and professional requirements are awarded the CPCA License and entered into the public credential registry.
