Introducing CPE Records — Log Your Do GRC Hours with ISACA, ISC2, IAPP and CompTIA

If you hold a CISA, CISM, CRISC, CISSP, CGRC, CIPP, CIPM or Security+, you have to log continuing professional education to keep it. Until now, the time you spent on Do GRC didn't leave you with anything to log. From today it does: every path you finish and every lab you submit earns a CPE record.

To be clear about what this is for: CPE records count toward certifications you hold with other organisations. They are not part of Do GRC's own exams, and a Do GRC credential still comes only from passing the practical exam.

What a record shows

Each record carries what the certifying bodies ask a record to hold: your name, the provider, the activity's title and description, the dates you did it and the hours. It lists what was covered, room by room, and shows the hours two ways: ISACA CPE hours, at one hour per 50 minutes, and 60-minute hours, which is how ISC2, the IAPP and CompTIA count.

Every record has its own code and a QR code that opens it on Do GRC, so an auditor can check it is real. It prints to a clean PDF, and the CPE page downloads all of them as a CSV log, ready to copy into your body's portal.

How the hours are counted

A path counts once every room in it is complete, at the rooms' published durations. Some rooms appear in more than one path; each counts toward one record only, so you never claim the same hour twice.

A lab counts the lesser of its published estimate and the time between starting it and submitting it, so a record never says you spent longer than you did.

Both figures are rounded to the nearest quarter hour, as ISACA asks. Its own worked example, 390 minutes coming to 7.75 CPE hours, is one of the tests the feature has to pass.

Claiming the hours

Do GRC isn't an approved or pre-approved provider of any of these bodies, and you don't need it to be: ISACA, ISC2 and the IAPP let members claim outside training themselves and keep proof in case they are audited. In short:

ISACA: report the hours in your ISACA account. Self-study counts when the certificate states the CPE hours, which these do. From January 2027, at least 90 of every 120 hours must match your certification's exam content outline.

ISC2: submit them in the CPE portal as education, and upload the record as proof.

IAPP: self-submit on the CPE Submission Form, where outside training courses count for up to 12 credits in each two-year term.

CompTIA: send the record with its outline; CompTIA reviews each claim against the exam objectives.

Each body decides what counts toward its certifications, so check its current policy before you claim. The CPE page links to each one.

Keep your copies

Audits can come years after the hours. ISACA asks members to keep records for at least three years, so print or download yours as you go. Records stay on your account if your membership ends.

If your name changes

Records are issued in the name you confirm on the CPE page. If it changes later, through marriage, divorce or transition, you can reissue your records in your current name. Each one gets a new code, and the old codes stop showing any name: anyone who opens one sees only that the record was reissued. Exam certificates can be reissued the same way from Exam Certificates.

Where to find it

CPE now has its own place in the navigation bar, just after the More menu. Records are issued for whatever you finish, so free accounts get them for the free content too.