Governance, risk and compliance (GRC)
You assess risk, write policy, map controls to ISO/IEC 27001, NIST CSF 2.0 and CIS Controls, and run internal audits with evidence.
Level 201 · 22 lessons · 18 practice labs
Lessons
Governance
- What governance, risk and compliance mean: You can explain how governance, risk and compliance feed each other and where the security team sits in that cycle.
- Security governance: committees, roles and RACI: You can build a RACI table showing who decides, who does the work and who is kept informed.
- Writing policies, standards, procedures and guidelines: You can write a short, workable security policy with a clear owner and a procedure that supports it.
- Asset inventory and ownership: You list information assets and give each an owner and a value, laying the groundwork for risk work.
- Quick task: a security RACI matrix
Risk management
- The risk process: identify, analyse, evaluate, treat: Following the ISO/IEC 27005 approach, you identify a risk and assess it by likelihood and impact.
- Qualitative and quantitative risk: from heat maps to FAIR: You compare the pros and cons of showing risk on a heat map or as an estimated money loss.
- Keeping a risk register and assigning risk owners: You can keep a risk register that tracks each risk’s owner, score, treatment and review date.
- Risk treatment options and risk appetite: You can justify reducing, transferring, avoiding or accepting a risk against the organisation’s risk appetite.
- Quick task: assess and record five risks
Frameworks and standards
- ISO/IEC 27001: the information security management system: You can explain the scope, leadership, planning, operation and improvement steps of a management system.
- ISO/IEC 27001 Annex A controls and the statement of applicability: You tailor the Annex A controls and prepare a statement showing which apply and why.
- NIST CSF 2.0: govern, identify, protect, detect, respond, recover: You map the organisation’s current and target profiles across the six functions and prioritise the gap.
- CIS Controls and implementation groups: You choose the implementation group that fits the organisation’s size and pick the first essential safeguards to apply.
- Mapping frameworks: one control, many requirements: You can show in a table how one control meets ISO/IEC 27001, NIST CSF and legal requirements at once.
- Quick task: map one control to three frameworks
Compliance and audit
- Building a register of compliance obligations: You can gather the legal, contractual and standard requirements that bind the organisation into one obligations list.
- Planning and running an internal audit: You prepare an audit scope, checklist and interview plan, and run an impartial internal audit.
- Collecting audit evidence: records, screenshots, sampling: Using sampling, you collect enough reliable evidence to show that a control really works.
- Nonconformities, corrective actions and continual improvement: You find the root cause of a finding, plan the corrective action and track whether it worked.
- Security metrics and management review: You pick a few meaningful metrics for management and prepare the agenda for the review meeting.
- Capstone: risk assessment and gap analysis for a small company: You map a fictional company’s assets, risks and ISO/IEC 27001 gaps and present a prioritised improvement plan.
Practice labs
- Place the RACI letters: Fill in a RACI table for six security activities and five roles from the given description.
- Fix the RACI mistakes: Find and fix the mistakes in a RACI table with rows that have two accountable roles or no responsible role.
- Terms of reference for the security committee: Write committee terms of reference for Kuzeyyıldızı Kargo covering members, decision rights, meeting frequency and reporting.
- Complete the asset inventory: Complete fifteen asset rows with a blank owner, location or classification from the notes provided.
- Reconcile the inventory with a discovery export: Compare a network discovery export with the asset inventory and list unrecorded devices and records that no longer exist.
- Assign value and owner to assets: Give ten Demirsu Enerji information assets confidentiality, integrity and availability values and assign each a business owner.
- Assess and record five risks: Score five scenarios on the likelihood and impact scales and enter them in the risk register.
- Find the risks above appetite: In a twenty-line register, find the risks that exceed the risk appetite statement and propose a treatment option for each.
- From heat map to money: For three high risks, calculate expected annual loss from frequency and loss-range estimates and note whether the ranking changes.
- Match the control to a CSF function: Match fifteen controls to one of the six NIST CSF 2.0 functions.
- Map one control to three frameworks: Map the multi-factor authentication control to ISO/IEC 27001 Annex A, NIST CSF and CIS Controls items and record them in a table.
- Statement of applicability entries: Write the applicability and justification of ten Annex A controls for a cloud-only software company.
- Link each obligation to its source: Match ten obligation statements to a law, contract or standard as their source.
- Extract obligations from a contract: From the security annex of a customer contract, enter the notification period, audit right and retention clauses in the obligations register.
- Tie the obligations register to controls: Map twelve Yelkovan Bankası obligations to the existing control list and report the obligations with no matching control.
- Choose the type of evidence: For eight controls, choose the most suitable evidence among a record, a screenshot, a configuration export or an interview.
- Write a nonconformity and corrective action: From evidence that the access review was skipped for two quarters, write the nonconformity, root cause and corrective action.
- Metrics for the management review: Calculate five security metrics from raw patching, incident and training data and interpret them on one page for the management review.
About this course
You assess risk, write policy, map controls to ISO/IEC 27001, NIST CSF 2.0 and CIS Controls, and run internal audits with evidence.
What you will learn
- Governance
- Risk management
- Frameworks and standards
- Compliance and audit
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.