GRC Fundamentals
Everything a GRC practitioner needs before touching automation: cybersecurity essentials, the terminology auditors and engineers argue about, governance and accountability, risk assessment, laws and obligations, frameworks, policies, security operations, resilience, people and third parties, control design and the audit lifecycle.
15
rooms
2650
total XP
11h
est. time
What you'll be able to do
- ›Use security and GRC terminology precisely and spot when others misuse it
- ›Run a risk assessment and maintain a risk register
- ›Turn laws, frameworks and contracts into an obligations register
- ›Design a control that is testable and walk an audit end to end
Rooms
Risk, Control, Compliance
Three words practitioners use interchangeably and shouldn't. Learn to separate the threat, the safeguard, and the obligation.
Frameworks Tour: SOC 2, ISO 27001, NIST
Map the same underlying safeguard across SOC 2 Trust Services Criteria, ISO 27001 Annex A, NIST CSF and 800-53.
Control Design & Testing
Design vs. operating effectiveness, sampling, populations, and how to write a control that can actually be tested by a machine.
The Audit Lifecycle
Scoping, walkthroughs, evidence requests, exceptions and the report. Triage a live PBC list in the scenario sim.
Evidence 101
What makes evidence sufficient, appropriate and reproducible, and why a screenshot is the weakest artifact you can hand over.
Policy, Standard, Procedure
The document hierarchy that governs everything you will later encode, and how to keep it from rotting.
Cybersecurity Essentials
Distinguish security objectives, attack mechanisms, and layered controls, then evaluate evidence rather than reassuring labels.
The Language of Security and GRC
Separate risk, controls, exceptions, and assurance claims using evidence rather than confident labels.
Governance and Accountability
Translate oversight into clear decision rights, risk boundaries, independent assurance, and meaningful board reporting.
Risk Assessment in Practice
Build evidence-based risk scenarios, score exposure, and assign accountable treatment and review.
Laws, Regulations and Obligations
Determine which obligations apply, distinguish legal duties from promises, and trace requirements to controls and evidence.
Security Operations Basics for GRC
Trace access, changes, vulnerabilities, incidents, and monitoring from operational decisions to defensible audit evidence.
Resilience and Continuity
Translate business impact into recovery priorities, resilient backups, rehearsed continuity plans, and defensible evidence.
People and Third Parties
Measure safer behavior, time workforce access changes, and manage supplier risk across the relationship lifecycle.
Foundations Capstone
Pull the whole fundamentals track together on one startup: risks, obligations and recovery targets drive a SOC 2 scope, a control set two people can run, and an evidence plan.