0.5 Start Here

Introduction

This is the last lesson of the orientation. It turns lessons 0.1 to 0.4 into a start: where to begin, what a first week looks like, what the exam is and how to prepare for it, how the course completes, and what to do when a lesson does not click.

Lesson 0.2 described the reading paths through the course. This lesson picks one for you, names the first lesson to open, and sets out the exam the course ends with.

This lesson covers what to have before you begin, where to begin, Module 1, a first week, the exam, what it tests, preparing for it, completing the course, getting unstuck, and the start.

Four things should be in place before you open the first lesson. The tiles list them.

The practice file, set up in lesson 0.4, is where every artifact you build will go. The versions register, started in lesson 0.3's practice, sits at its top. Your route is the decision lesson 0.4 asked you to make: your own organization, the fallback, or both, decided per practice. And a first lesson, chosen with the gate in section 2.

None of these takes long. The practice file is a folder; the versions register is a short list; the route is a decision you can change; and the first lesson is a choice among three.

Together they take a single sitting, and they mean the first lesson's practice can be done the day you read it. If one of them is missing when you open a lesson, the practice is the part that suffers, and the practice is where the course does its work.

If you skipped lessons 0.3 and 0.4, go back to them now. They are the two lessons of the orientation that set up work the rest of the course depends on: the versions habit, and the practice file with its rules about what not to record.

The orientation itself is free to read, as the course's preview. The teaching modules and the exam need an active paid subscription. If you are reading the preview to decide whether to take the course, lesson 0.1's sections on who the course is for and what it does not teach are the place to decide.

Everything else you need comes with the lessons. Each module's index page says which records from earlier modules its lessons assume, so you never need to prepare for a module beyond reading its index. If you are starting partway through the course, that index tells you what to build first.

Where you begin depends on why you are taking the course. The gate sorts the three starting points.

If you are new to GRC, or building a program from scratch, start at lesson 1.1 What Governance, Risk and Compliance Each Decide, read Module 1 in order, and carry on through the course. The course is written to be read that way: each module produces the records the next one uses.

If you run a program already and want to check its foundations, read the Module 1 index to see what it covers, then start at lesson 2.1 Understanding the Organization. Return to Module 1's lessons where its index names something your program lacks.

If you have a specific task, a risk assessment, a certification, a supplier review or an audit, go to the module for it. Read its index page, then its exercise lesson, then the lessons the exercise draws on. The exercise shows the whole method at once, and its cross-references tell you which lessons to read for each step.

The gate's foot gives the one rule that applies to all three: read the module index page before the module's first lesson. The index says what the module covers, which earlier records it assumes, and what you will be able to do at the end.

Whichever you choose, you can change it. Readers who start at a specific module often return to Module 1 once the task is done, to see the program the task sits in.

Readers who start at Module 1 sometimes jump ahead when a task arrives at work. Each lesson stands on its own, as lesson 0.2 explained, so either works. Note in your practice file where you started and why, so that when you return to the course after a break you know where you left the route.

If you start at the beginning, Module 1 is where you start. The cards list its lessons, read from the course's files.

Module 1 sets out what a GRC program is and decides who does what in it.

Its lessons separate what governance, risk and compliance each decide; describe the security program as a loop; place the three lines and the roles with their decision rights; locate GRC in the organization and look at why GRC programs fail; and survey the frameworks and standards a program uses. Its last lesson is an exercise that brings them together in a program charter.

The charter is the first artifact of a program, and the first one the course asks you to build in full. It records what the program is for, who owns it, who decides what, which frameworks it uses and how it is reviewed.

Later modules refer back to it: Module 2's scoping and baseline start from it, and its clauses on frameworks, the risk method and review are the ones later modules fill in.

Module 1 is the module where the course's vocabulary is set. Terms such as risk owner, control owner, decision right and the three lines are defined there and used without redefinition afterward. Readers who start later in the course and meet a term they do not know will usually find it defined in Module 1.

If GRC is new to you, Module 1 is also where you will find out whether the course suits you. Its lessons are the same length and shape as every later lesson, and its practices ask for the same kind of artifact.

If the first three lessons feel right, the rest of the course will too. If they do not, lesson 0.1's section on courses beside this one names where else to look.

A plan helps the first week happen. The record sets out one that works for a reader studying alongside a job.

In the first sitting, read lessons 0.3 to 0.5 and set up the practice file. In the second, read the Module 1 index and lesson 1.1 What Governance, Risk and Compliance Each Decide.

In sittings three to six, work through Module 1, one lesson and its practice per sitting. In the seventh, do lesson 1.8 Exercise: A Program Charter. The output is a program charter, built in the exercise. Then carry on with Module 2 at the same pace.

The note under the record gives the fallback for a short week: the exercise is the module's whole method in one place, so if you are short of time, do it before the practices you skipped.

Seven sittings is a suggestion, not a requirement. Lesson 0.1 set out the course's time and pace in full; this plan simply turns them into a first week. Some readers will do Module 1 in a weekend; others will take a month. The order matters more than the speed. A sitting here means about the time one lesson and its practice take, which lesson 0.1 set out.

A plan in a calendar is more likely to happen than one in a lesson. Put the first week's sittings in yours before you open lesson 1.1 What Governance, Risk and Compliance Each Decide, and protect them as you would a meeting.

If a sitting is missed, do not double up the next one. Take the next lesson in its turn and let the plan slip by a day. The course has no deadlines, and a lesson read in a hurry without its practice is worth less than one read later with it. The plan exists to make the first week happen, not to measure you against it.

The course ends with an exam. The tiles set out its format.

The exam has 35 questions: 30 drawn from 50 module questions written for the course, and one of two five-question case studies, each a program to make decisions about, which together make a pool of 60.

You have 120 minutes. Questions come one at a time, and you can review your answers before you submit. The pass mark is 70%. If you do not pass, you can try again after 24 hours.

Because questions are drawn from a pool, two attempts will not show the same set. The pool covers all 11 modules, so an attempt cannot be passed on a few modules alone. Rereading the questions from a failed attempt is therefore not a way to prepare; rereading the modules they came from is.

The case study is the part that most resembles the work. It describes an organization and its program, and asks a run of questions about it, each depending on the last: what the program should decide, what a record shows, what to do next. It is the exam's version of the exercise lessons.

The exam is taken online, in one sitting. 120 minutes for 35 questions and a case study is enough for a reader who knows the method, and tight for one who is looking answers up.

Plan to answer from what you know, and use the review at the end for the questions you marked. Find a time when you will not be interrupted for the full 120 minutes, and have nothing open but the exam.

You can take the exam whenever you are ready. There is no requirement to have finished every lesson first, though the pool covers every module, and most readers will want to have worked through the exercises. Taking it early and failing costs you 24 hours and shows you which modules to revisit, which is not a bad trade if you are close.

The exam tests what the course teaches. The comparison sets out what it tests and what it does not.

It tests method: which step comes next, and why. It tests judgment: which option a program should take, given what the question tells you. It tests reading: what a record, a report or a clause tells you, and what it does not. And it tests connection: how one decision affects the next, which is what the case study is for.

It does not test recall: control numbers or clause text by heart. It does not test law: what a statute requires of your organization, which is a question for counsel, as every lesson that touches law has said. It does not test tools: no question depends on a particular GRC platform. And it does not test your artifacts: what you built in the practices stays yours.

Questions name frameworks with their versions, as lessons do, so a question about SP 800-53 means the release lesson 0.3 lists. Where a question turns on a framework's wording, the question gives you the wording, or a paraphrase of it, rather than asking you to recall it.

A question that looks like recall usually is not. "Which document records why each Annex A control is included or excluded?" is a question about what a Statement of Applicability is for, not about the clause number.

The method behind the question is in the lesson; the number is not what is asked. The same is true of questions that name a lesson's worked example: you are never asked what a lesson's organization decided, only what a program in the question's position should decide.

If you have done the practices, most questions will feel familiar, because each one asks for a judgment you have already made on an organization of your own or a fallback.

Preparation is mostly rereading what you have already done. The cards list where to spend the time.

The module index pages, all 11 of them, give the shape of the course: what each module covers and what you should be able to do at the end. Reading them in one sitting is the quickest way to find the modules you are least sure of. Mark each module as sure, fairly sure or unsure, and spend your time in that order, from the bottom.

The exercise lessons, all 11, show connected judgment of the kind the case study asks for: several decisions about one organization, each depending on the last. If you have time for only one kind of revision, revise the exercises.

Your practice artifacts are your own record of the method. Reread a few, and check each against the lesson that taught it, as lesson 0.4 described. Where an artifact falls short, the gap is a lesson to reread.

Lesson 0.3 lists the versions the course teaches, which the questions use. A minute with its register before the exam avoids confusion between, say, the 2013 and 2022 editions of ISO/IEC 27001. It is also worth rereading lesson 0.3's section on how the course handles ISO text, because questions on Module 6 work the same way: they describe a clause's subject in the course's words.

There is no separate study guide to memorize, because the exam does not test memory. If you have read the lessons and done the practices, you are preparing by checking, not by learning anew.

A reader who cannot yet do a module's exercise is not ready for the exam's questions on that module, and the exercise says which lessons to return to. Spread the checking over a week rather than a night. A module a day, reading its index and redoing its exercise, covers the course in under two weeks.

Passing the exam completes the course. The evaluator sets out what completion requires and gives.

The requirement is to pass the course exam, with an active paid subscription. The exam passed at 70% or above is enough; there is no grade above a pass. A certificate is issued, and its ID can be checked by anyone at the verification page, so an employer or client can confirm it without asking you for a copy.

The course carries 40 CPE, recorded on completion. Add the date you passed to your versions register, so you can see later which versions of the frameworks you were examined on.

The last row is marked for information. Doing every practice is not required for the certificate, and it is the reason the course works. The evaluator's note says why both matter: the certificate says you passed the exam; the practice file says what you can do. Keep both.

If you built on your own organization, the practice file is more than a record of study. It holds a program's first charter, baseline, policies, register, mappings and reports, each drafted by a method you can explain. Bring them to your organization's review and approval as each lesson described; once approved, they are your program's records.

If you built on fallbacks, the file is a portfolio. It shows how you approach a charter, a risk entry, a mapping or a supplier assessment, with your assumptions stated. That is something a hiring manager can read, which a certificate alone does not offer. Remove nothing from it that shows your reasoning; the assumptions are the most useful part to a reader.

Completion is not the end of the subject. Frameworks change, as lesson 0.3 described, and a program runs on a cycle, as Module 11 taught. The versions register you started in this orientation is the habit that keeps your knowledge, and your program, current.

Every reader meets a lesson that does not come clear on first reading. The gate sets out three things to try.

If the lesson builds on an earlier one you have not read, follow the cross-reference: read the lesson it names, then return. Lessons point to each other by number, as lesson 0.2 explained, and a lesson that feels like it starts in the middle usually names where the beginning is.

The module index page also lists which earlier records each module assumes, which is often the quickest way to see what you have missed.

If you follow the method but not how it applies, read the worked example again. Trace it section by section, noting what the organization decided at each step and why, then try the practice. Ask at each step what the organization knew and what it chose, and whether you would have chosen the same with what you know about your own.

If the method still feels abstract, do the practice anyway. Build the artifact on the fallback, following the steps in the card. Doing it is often what makes it clear, because the steps force each part of the method into a concrete decision.

The gate's foot gives the pattern most readers find: a lesson that will not come clear on a third reading usually comes clear in the practice. GRC is learned by doing more than by reading, and the course is built around that.

If a lesson is still unclear after the practice, move on and come back. A later lesson often explains an earlier one by using it, and a module's exercise often shows a method more clearly than the lesson that introduced it, because it shows the method in use.

Note in your practice file which lesson it was. When you reach the module's exercise, check whether it has come clear; if it has not, that is the lesson to return to before the exam.

The orientation ends here, and the course begins. The checklist below is the practice for this lesson: the last few things to do before you open the first lesson.

The tiles recap what the orientation has covered.

The orientation has set out what the course is (lesson 0.1), how it is built (lesson 0.2), which versions it teaches and why it is built on NIST (lesson 0.3), how to practice with or without an organization of your own (lesson 0.4), and, in this lesson, where to begin and how it ends.

You will not need to return to it often; when you do, it will usually be to lesson 0.3's register.

The course has 11 teaching modules and 97 lessons. That sounds like a lot from here. It is one lesson and one practice at a time, and every lesson has the same shape, so after the first few you will know what to expect.

Taken at a lesson a sitting, with a sitting most weekdays, that is a few months of steady work, and it ends with the records of a program.

By the end of Module 1 you will have a program charter. By the end of Module 5 you will have a risk register with treatment decisions.

By the end of Module 11 you will have the records of a program that runs on a cycle and reports to the people who decide. Each step builds on the last. By the end of Module 8 you will have a Statement of Applicability, a framework mapping and an obligation register.

Your first lesson is 1.1 What Governance, Risk and Compliance Each Decide if you start at the beginning, or the one the gate in section 2 gave you. Open its module index first. If you have done the practice for this lesson, it is already open.

Before the first lesson, have the practice file from lesson 0.4 with lesson 0.3's versions register at its top, decide your route, and choose where to begin: lesson 1.1 What Governance, Risk and Compliance Each Decide for most readers, Module 2 for a running program, or the module for a specific task.

The exam draws 35 questions from a pool of 60 across all 11 modules, with one case study, in 120 minutes, and passes at 70%; it tests method and judgment, not recall. Prepare from the index pages and the exercises, and keep the practice file as well as the certificate.

Versions this lesson relies on: NIST SP 800-53 Rev. 5, release 5.2.0 (27 August 2025); ISO/IEC 27001:2022 with Amd 1:2024.