Introduction to GRC
You learn what governance, risk and compliance mean, where rules come from, who is responsible for what in an organisation and what a GRC team does day to day, by working on simple documents.
Level 101 · 17 lessons · 15 practice labs
Lessons
Three ideas
- Why organisations need rules
- Governance: setting direction, deciding, holding to account
- Risk: likelihood and impact
- Compliance: laws, contracts and standards
- Quick task: read a news story through governance, risk and compliance
Rules and documents
- The document hierarchy: policy, standard, procedure, guideline
- Frameworks: ISO/IEC 27001, NIST CSF, CIS Controls, SOC 2
- Laws: privacy, sector and notification duties
- What a control is: objective, owner, evidence
- Quick task: put documents in their place in the hierarchy
People and processes
- The three lines model
- GRC roles: analyst, risk manager, auditor, DPO
- The GRC calendar: the yearly cycle
- Registers and tools: from spreadsheets to GRC software
- Quick task: a responsibility table for a small company
Finish
- The GRC career path and certifications
- Capstone: a start-up's first GRC status report
Practice labs
- Read a news story through three lenses: Sort the sentences of a fictional data leak news story under governance, risk and compliance.
- Find the governance gap: From Karaçam Mobilya meeting minutes, find three security topics with no clear decision maker and propose an owner for each.
- Compliance, risk or both: Sort ten requirements by source (law, contract, standard or internal risk decision) and write the consequence of non-compliance for each.
- Put each document in the hierarchy: Classify twelve document titles as policy, standard, procedure or guideline.
- Split a mixed document: Split a password document that mixes policy, standard and step-by-step instructions into three separate documents.
- Find the contradictions in a document set: Find the conflicting rules across five Mercanköşk Otelcilik documents and state which one prevails and why.
- Match the framework to its purpose: Match ISO/IEC 27001, NIST CSF, CIS Controls and SOC 2 to eight statements of need.
- Choose a framework for the company: Choose a starting framework for three fictional company profiles and justify each choice in two sentences.
- Draw up the obligations list: List the privacy, sector and notification obligations, with their sources, for an online shop with customers in three countries.
- Break a control into its parts: Mark the objective, owner and evidence in six control statements.
- Complete the missing control definitions: Complete eight control records that lack an owner, a frequency or evidence.
- Match the evidence to the control: Match fifteen Ayçiçeği Gıda evidence files to ten controls and report controls without evidence and evidence that proves nothing.
- Place the role on its line: Place ten roles on the first, second or third line of the three lines model.
- A responsibility table for a small company: Fill in a table showing who is responsible, who approves and who is informed for eight security tasks in a twenty-person company.
- Build the yearly GRC calendar: Place the risk assessment, policy review, internal audit and management review across twelve months according to their dependencies.
About this course
You learn what governance, risk and compliance mean, where rules come from, who is responsible for what in an organisation and what a GRC team does day to day, by working on simple documents.
What you will learn
- Three ideas
- Rules and documents
- People and processes
- Finish
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.