GRC Engineering Lab | Governance, risk and compliance (GRC), through practice
Learn GRC engineering by hands-on practice
Follow a clear path of short lessons called rooms. Try real practice tasks called labs. You do the work yourself.
No payment card needed. Your first lesson takes about 30 minutes.
$ opa eval -d mfa.rego -i users.json 'data.mfa.deny'deny: "svc-backup has no MFA (admin)"deny: "j.olsen has no MFA (admin)"$ git commit -m "AC-2: block admins without MFA"[main 4f1c2a9] 1 file changed
An auditor asks for proof MFA is enforced for every admin. What do you hand over?
- A screenshot of the MFA settings page
- The policy, its test run and the commit that enforced it
What is GRC engineering?
GRC stands for governance, risk and compliance. It is how a company sets its rules, spots what could go wrong, and proves to auditors that it follows standards such as ISO 27001 or SOC 2.
GRC engineering does that work with code instead of spreadsheets and screenshots. You write security rules as policy code (for example with Open Policy Agent and Rego), build pipelines that collect audit evidence automatically, and turn controls into checks that run every day.
Who it is for: people breaking into tech or cybersecurity, compliance and audit staff who want technical skills, and engineers moving into security and compliance work.
What you will be able to do: explain core IT and cybersecurity ideas, run a risk assessment, build an information security management system (ISMS), support an audit, write and test policy as code, and ship an automated evidence pipeline. Finish a course and earn a certificate anyone can check on our verify page.
Start at your level
Not sure where to begin? Tell us what you want to learn.
Learn the tech basics, then governance, risk and compliance (GRC).
What you do in an hour-long lesson
1 · Read
Read a short lesson. Zoom in on the diagram for a closer look.
2 · Decide
Try a real situation. Some answers are close, but not quite right.
"The review of account access every three months was signed. But 14 former staff still have accounts. Is this security check working?"
3 · Build
Try a practice task. Our server (the computer running the site) scores each check.
- ✓ basic settings require passwords of at least 14 characters
- ✓ Secure Shell (SSH) remote sign-in as the main administrator is turned off
- ✗ no rule for how long to keep records of system activity
Popular lessons to start with
All 110 rooms →Risk, Control, Compliance
Subnetting in Depth
Policy as Code with OPA/Rego
Build an Evidence Pipeline, Step by Step
Linux Administration and Security
Evidence 101
Progress you can share
Earn experience points (XP), ranks and badges. Build streaks by learning on consecutive days. Get certificates anyone can check.
Your profile after about a month
- Recruit
- Operator
- Analyst
- Automator
- Engineer
- Architect
19
day streak
14
badges
1
certificate
An example, not a real learner.
Training a GRC team?
Give analysts the same learning path from spreadsheets to code. See who has finished each step.
Questions people ask
Do I need to know how to code?
No. The starter courses need no past experience. The coding lessons explain every line before you write one.
How long does it take?
Most rooms (short lessons) take 30 to 60 minutes. Do one a day to finish a track (a course) in two or three weeks.
Does it focus on one company's tools?
The GRC and engineering lessons do not focus on one company's tools. Two lessons cover specific systems, Linux and Windows, and use those names.
Do I get a certificate?
Yes. Finish a course and its final project to get a certificate. It has a code anyone can use to check it.
What does an account cost?
Creating an account is free. You need one to save progress, earn experience points (XP) and appear on the learner rankings.
Can my team use it?
Yes. Contact us for help setting up a group and tracking progress.
Finish your first lesson in 30 minutes
Choose a lesson now and finish it before lunch.
Create a free account