GRC for Security Professionals

What GRC for Security Professionals teaches: build a working governance, risk, and compliance program, a risk register you actually work, policies people follow, controls mapped to ISO 27001, NIST CSF, SOC 2, GDPR, and CMMC, and audit evidence produced as a byproduct. The program you'll build, what you walk away with, and how the course is structured. Start here.

The governance-risk-compliance triad as an operating system. How the three disciplines connect and reinforce each other. Why most GRC programs fail, with detailed case studies of each failure mode. Organizational positioning, reporting lines, and regulatory drivers.

Policy as executable governance. The policy hierarchy and the enforcement test that separates its levels. Why policies become shelf-ware and how to write ones that hold. The minimum viable policy set. The policy lifecycle. Mapping policies to the controls that enforce them and the requirements they satisfy.

The risk engine the policy framework has been referencing. Vocabulary, four identification methods, calibrated scoring, appetite and tolerance, the register, and the evidence that keeps control effectiveness ratings honest.

Turning scored risks into decisions and controls. The four treatment options in the order you consider them, control selection on five criteria, the Statement of Applicability, treatment plans with targets, and the verification that measures whether any of it worked.

Keeping the register true between reviews. Metrics that measure exposure as well as controls, dashboards for two audiences, board reporting in twenty minutes, escalation with written triggers, the quarterly review, and queries that produce trends rather than points.

Mapping the risk programme onto ISO 27001. The clauses are the engine and Annex A is the toolbox. Scope, context, planning, support, audit, improvement, the full Statement of Applicability, and certification through to surveillance.

A framework you cannot be certified against, and why it earns its place next to one you can. Six functions, profiles with real targets, implementation tiers, and running CSF alongside ISO 27001 without collecting evidence twice.

An attestation rather than a certification, tested against controls you write yourself. The system description, the criteria, evidence across an observation window, the examining firm, and using the report once you hold it.

UK GDPR, the DPA 2018 and the Data (Use and Access) Act 2025 read together. Lawful bases including the new seventh, records of processing, impact assessments, individual rights and the new complaints obligation, breach notification, and transfers.

A certification regime attached to one customer, currently mid-reform. Identifying controlled information, the 110 requirements at objective grain, the plan and the score, assessment and affirmation, and the scoping decision that sets the cost.

Every framework in this course requires awareness training and none tells you how to make it work. Behaviour rather than topics, friction rather than content, simulations that build detection rather than punish, and measurement that can detect its own failure.

Running audits as a programme rather than a series of events. Internal audit that finds things, external audits that verify them, findings that close and stay closed, and several frameworks on one set of evidence.

Running a function rather than a process. Translating risk into terms a board can compare, reporting that drives decisions, committees with real authority, budget arguments that survive a finance director, and delivering bad news early.

The discipline that keeps everything else from going quietly out of date. Watching primary sources, assessing what a change actually requires, absorbing it into the programme rather than beside it, and maintaining a scan that survives years.

Whether anybody actually has the capacity. Structure and the one activity that needs independence, the skills the work really requires, tooling as a sequencing question, cadences as the operating model, and what a maturity score can honestly support.

What changes when obligations come from a sector regulator, company law, or an insurer rather than a general framework. Four audiences, one evidence structure, and where all of it is heading.

The scales, matrices, mappings and report skeletons, with what each instrument decides and where it misleads.

Ordered procedures for the work a GRC function actually does: assessments, certifications, audits, breaches and board cycles.

A working register, policy set, control map and evidence pack, built from nothing and then tested against the failures that make them useless.

Six cases reasoned end to end, including the ones where every artifact was current and the function was achieving nothing.

What to do when a regulator writes, an auditor raises a finding, a customer sends a questionnaire, or somebody asks for an exception.

The exam, the lab pack, the artifacts you built, and the two products this course bridges into.

External sources this course draws on: frameworks, standards, regulator guidance and vendor documentation.

GRC for Security Professionals end-of-course exam: a simulation-based assessment testing whether you can establish what binds an organization, grade gaps against evidence that already exists, sequence work against a date you do not control, and take a board a decision it can act on.