Which GRC Certification Should I Get? Take the Five Question Assessment

A woman wrote to me this week and asked a question I get more than any other. She wants into this field. She does not know which certification to start with, and every list she has found reads like a catalogue instead of an answer.

I knew exactly what to send her. We built a tool for this. Five questions, a ranked shortlist, about a minute of your time.

Then I went to find the link and I could not find it.

It was on a different site than I remembered, a third of the way down a long page, under a heading you would only spot if you already knew it was there. I built the thing and I had to hunt for it. She never would have found it at all.

So it has moved, and this is where it lives now: which GRC certification is right for you. Top of its own page. One link you can send to somebody.

Why a quiz instead of a list

Every certification roundup on the internet gives the same twelve credentials to every reader. That is not advice. That is inventory.

The honest answer to which certification should I get is that it depends, and it depends on four things nobody bothers to ask you about.

It depends on where you are coming from. If you have spent nine years in IT, the CISA and the CISSP are sitting right there waiting for you. If you are coming from paralegal work, they are the wrong door entirely and the CIPP is the right one.

It depends on your sector. Healthcare compliance runs on its own regulations and its own vocabulary, and hiring managers in hospitals screen for the CHC in a way that no general compliance credential will satisfy. If you are not in healthcare, that credential is close to irrelevant to you.

It depends on how far along you are. The CISSP wants five years. Telling a career changer to go get one is not encouragement, it is a five year delay dressed up as guidance. The AIGP and the GRCP ask for no formal experience at all, which is exactly why they are the two most useful credentials for somebody standing outside the field looking in.

And it depends on what you actually want. Getting hired for the first time and getting promoted are different problems, and they do not have the same answer.

The assessment weighs all four. Your background and your chosen discipline carry the most weight. Your sector adds the credentials that only matter inside it. Your experience level takes away anything you are not yet eligible for, because there is no kindness in recommending an exam somebody cannot sit.

What you get

Four credentials, ranked, best fit first. For each one you get what it is actually called, what the salary data says, a sentence on why it fits you specifically rather than why it is generally good, and a link to the body that issues it.

You can see all of it without giving us anything. There is a field for your email and there is a button next to it that says skip. Use whichever one you want. I mean that, and I built the page so it works that way rather than saying so and then holding your results hostage.

One thing I got wrong, and I will say it plainly

The earlier version of this tool asked for a name and an email before it showed results. It promised no spam and easy unsubscribe.

It then threw every one of those addresses away. The code wrote them to the browser console and did nothing else. No list, no database, no email, nothing. Every person who trusted that form got their results and vanished, and I did not know until I went looking this week.

That is fixed. Leads are stored and they reach a human now. But if you took that assessment at some point over the last stretch and wondered why you never heard from us, that is why, and I am sorry. Come take it again. It works.

Who this is for

I built this for the person who is standing at the edge of GRC and cannot tell whether there is a door. There is. There are several, and which one opens for you depends on what you already carry.

It is also for the person already inside who has hit a ceiling and suspects a credential is the thing between them and the next level. Sometimes it is. Sometimes it is not, and the results will tell you that too.

Take it here: which GRC certification is right for you. Then, when you know what you are aiming at, we have practice exams and study companions for most of them, and the live roles so you can see what the credential actually buys.

Five questions. One minute. Send it to whoever asked you the same question I got asked this week.