Hands-on
Lab catalog
166 labs across 8 tracks. You edit a real artefact, the server runs named checks: expectations and reference solutions never reach your browser.
166 lab(s)
Build the computer architecture specification
Computer Architecture
Review the control claims
Computer Architecture
Build the operating systems specification
Operating Systems
Triage the operational evidence queue
Operating Systems
Build the filesystems and permissions specification
Filesystems and Permissions
Review the control claims
Filesystems and Permissions
Build the command line and safe automation specification
Command Line and Safe Automation
Triage the operational evidence queue
Command Line and Safe Automation
Build the identity and authentication specification
Identity and Authentication
Review the control claims
Identity and Authentication
Build the logging and time specification
Logging and Time
Triage the operational evidence queue
Logging and Time
Build the hardening and patching specification
Hardening and Patching
Review the control claims
Hardening and Patching
Build the backup and recovery specification
Backup and Recovery
Triage the operational evidence queue
Backup and Recovery
Build the estate evidence index
IT Fundamentals Capstone
Review the final estate conclusions
IT Fundamentals Capstone
Repair the upload evidence plan
Network Models and Encapsulation
Review the layered incident report
Network Models and Encapsulation
Specify the reception switch handover
Ethernet, Switching and VLANs
Review the switching sign-off
Ethernet, Switching and VLANs
Repair the scanner address record
IPv4 Addressing and CIDR
Review the addressing handover
IPv4 Addressing and CIDR
Author an aligned allocation manifest
Subnetting in Depth
Review addressing claims
Subnetting in Depth
Specify the clinic segment
IPv6 Essentials
Review the IPv6 assurance memo
IPv6 Essentials
Reconstruct a routed and translated flow
Routing and NAT
Review six routing assurance claims
Routing and NAT
Repair the core-service plan
Transport and Core Services
Review the analyst's network claims
Transport and Core Services
Specify the laboratory transport guardrail
Secure Protocols and PKI
Review the transport acceptance notes
Secure Protocols and PKI
Repair the portal boundary plan
Network Security Architecture
Review the quarterly boundary evidence
Network Security Architecture
Build the segmented address plan
Networking Fundamentals Capstone
Review the cutover rule changes
Networking Fundamentals Capstone
Repair the migration responsibility map
Cloud Concepts and Shared Responsibility
Review the assurance handover
Cloud Concepts and Shared Responsibility
Make a disposable worker auditable
Compute Building Blocks
Review the compute assurance packet
Compute Building Blocks
Specify a recoverable private export store
Storage Building Blocks
Review six storage assurance claims
Storage Building Blocks
Repair the appointment network plan
Cloud Networking
Review six boundary claims
Cloud Networking
Constrain the invoice exporter
Cloud Identity and Access
Review six access changes
Cloud Identity and Access
Repair the restricted-export protection plan
Cloud Data Protection
Review the protection claims
Cloud Data Protection
Specify a controlled replacement release
Infrastructure as Code and Immutability
Review the change-control evidence
Infrastructure as Code and Immutability
Repair the evidence collection plan
Cloud Logging, Monitoring and Posture
Rank the morning posture queue
Cloud Logging, Monitoring and Posture
Deliver the account remediation contract
Cloud Fundamentals Capstone
Rank the follow-up export
Cloud Fundamentals Capstone
Repair the billing request contract
How Applications Work
Review the HTTP assurance notes
How Applications Work
Repair the review collector contract
APIs and Data Formats
Review the integration claims
APIs and Data Formats
Constrain the booking service and its recovery
Databases for Applications
Review six database control claims
Databases for Applications
Repair the clinic access contract
Authentication and Authorisation in Apps
Review identity release claims
Authentication and Authorisation in Apps
Specify an enforceable download gate
The Secure SDLC
Review six release claims
The Secure SDLC
Specify closure of a previewer finding
The OWASP Top 10 in Depth
Audit six proposed closure decisions
The OWASP Top 10 in Depth
Specify the release integrity gate
Software Supply Chain
Review six release claims
Software Supply Chain
Repair the billing release gate
Release and Runtime
Review the operating evidence
Release and Runtime
Author the urgent remediation work package
Application Fundamentals Capstone
Audit the remediation board before sign-off
Application Fundamentals Capstone
Turn a Word control into data
Controls as Data
Map one control to three frameworks
Controls as Data
Write a test plan an auditor can rerun
Control Design & Testing
Rewrite an evidence request as a specification
Evidence 101
Find the admins who are actually exposed
SQL for Compliance Data
Deny the buckets that are actually public
Policy as Code with OPA/Rego
Pick the first thing worth engineering
What Is GRC Engineering?
Untangle a risk register row
Risk, Control, Compliance
Scope a second framework without copying the first
Frameworks Tour: SOC 2, ISO 27001, NIST
Build the audit timeline the evidence can survive
The Audit Lifecycle
Split one document into three layers
Policy, Standard, Procedure
Find the rows the tracker cannot support
The Spreadsheet Failure Mode
Specify the job that runs the control
Your First Automated Control
Capstone: ship a complete control package
Foundations Capstone
Encode review as branch protection
Git for GRC Artifacts
Gate production deploys in the pipeline
Control Checks in CI/CD
Find the collectors that are lying to you
Evidence Pipelines
Report only the findings actually in breach
Continuous Control Monitoring
Put a model in the policy loop safely
LLMs for Policy & Gap Analysis
Gate high-risk model deployments
Governing AI Systems
Capstone: automate access removal end to end
Capstone: Automate a SOC 2 Control Family
Tailor a baseline into a profile
OSCAL Profiles & Baselines
Specify a collector that cannot lie
Automating GRC with APIs
Write a suite that can actually fail
Testing Compliance Code
Make an artefact re-derivable
Evidence Integrity & Chain of Custody
Define a metric that survives a question
Control Health Metrics & Scorecards
Specify a drift monitor someone can act on
Drift Detection & Alert Design
Specify the evidence architecture
Data & Evidence Capstone
Constrain an evidence agent
Agentic Evidence Workflows
Make an AI RMF record operable
AI Risk Management with NIST AI RMF
Classify, then map the obligations
EU AI Act Obligations as Controls
Write the intake that protects the platform
Scaling a GRC Engineering Function
Specify the control delivery pipeline
Automation Capstone
Specify the vendor intake pipeline
Vendor Risk Automation
Turn the contract into a control map
Fourth-Party & Supply-Chain Visibility
Specify incident response as code
Incident Response as Code
Specify the exercise-to-pipeline loop
Tabletop to Pipeline
Review the control library records
Controls as Data
Sign off the automation roadmap
What Is GRC Engineering?
Review a framework crosswalk
Frameworks Tour: SOC 2, ISO 27001, NIST
Re-file a governance library
Policy, Standard, Procedure
Challenge six test conclusions
Control Design & Testing
Accept or bounce an evidence bundle
Evidence 101
Triage the auditor's PBC list
The Audit Lifecycle
Review pull requests against the controls repo
Git for GRC Artifacts
Review model-drafted policy text
LLMs for Policy & Gap Analysis
Review the AI use-case register
Governing AI Systems
Review the readiness claims
Capstone: Automate a SOC 2 Control Family
Review the programme baseline
Foundations Capstone
Review the profile pull request
OSCAL Profiles & Baselines
Review the policy test suite
Testing Compliance Code
Review the control scorecard
Control Health Metrics & Scorecards
Review the evidence architecture
Data & Evidence Capstone
Review the agent evidence run
Agentic Evidence Workflows
Review the AI Act register
EU AI Act Obligations as Controls
Review the control pipelines before the audit window
Automation Capstone
Review the vendor register records
Vendor Risk Automation
Review the exercise findings
Tabletop to Pipeline
Triage the control workbook
The Spreadsheet Failure Mode
Triage the risk register
Risk, Control, Compliance
Triage a week of control runs
Your First Automated Control
Triage the query results
SQL for Compliance Data
Triage the policy decision log
Policy as Code with OPA/Rego
Triage the collector failures
Evidence Pipelines
Triage the pipeline gate report
Control Checks in CI/CD
Triage the monitoring alerts
Continuous Control Monitoring
Triage the collector run log
Automating GRC with APIs
Triage the evidence store audit
Evidence Integrity & Chain of Custody
Triage the drift queue
Drift Detection & Alert Design
Triage the AI risk register
AI Risk Management with NIST AI RMF
Triage the intake queue
Scaling a GRC Engineering Function
Triage the supply-chain review
Fourth-Party & Supply-Chain Visibility
Triage the quarter's incident review
Incident Response as Code
Write the MFA and encryption policy
Build an Evidence Pipeline, Step by Step
Configure the IAM-02 pipeline
Build an Evidence Pipeline, Step by Step
Review six pipeline runs
Build an Evidence Pipeline, Step by Step
Declare independent security layers
Cybersecurity Essentials
Review six security claims
Cybersecurity Essentials
Repair the incident vocabulary
The Language of Security and GRC
Challenge six assurance labels
The Language of Security and GRC
Encode decision rights and escalation
Governance and Accountability
Challenge the governance pack
Governance and Accountability
Author a supported risk entry
Risk Assessment in Practice
Review risk committee claims
Risk Assessment in Practice
Author a scoped obligation row
Laws, Regulations and Obligations
Review obligation claims
Laws, Regulations and Obligations
Specify measurable operations controls
Security Operations Basics for GRC
Challenge the evidence pack
Security Operations Basics for GRC
Specify a defensible recovery policy
Resilience and Continuity
Review the resilience evidence
Resilience and Continuity
Specify workforce and supplier gates
People and Third Parties
Challenge the trust claims
People and Third Parties