GRC

1. Cybersecurity Professionals

Connect technical controls with risk, compliance and audit evidence.

2. Banking & Financial Services

Build technology and cyber-risk assurance skills.

3. IT Professionals

Translate infrastructure, application and cloud experience into control assessment.

4. Audit, Risk & Compliance

Strengthen security frameworks, control testing and evidence review.

5. Privacy & Legal

Connect privacy obligations with security controls and vendor oversight.

6. Graduates & Career Changers

Build foundational GRC capability through guided exercises.

Suggested starting knowledge: Basic familiarity with business processes and IT concepts.

40-Day Training Journey

Module 1 — Days 1-5

GRC Fundamentals

• Governance, Risk and Compliance: purpose and relationships
• Roles, responsibilities and stakeholders
• Policies, standards and procedures
• Control objectives, control types and accountability
• Three lines model and governance gaps

Portfolio Output:
Governance Gap Assessment + Stakeholder & Responsibility Map

Module 2 — Days 6-10

Cyber Risk Management

• Assets, threats and vulnerabilities
• Likelihood, impact and risk scoring
• Inherent risk vs residual risk
• Risk appetite and tolerance
• Treatment, acceptance, owners and monitoring

Portfolio Output:
Risk Register + Risk Treatment Plan

Module 3 — Days 11-15

ISO 27001:2022 – ISMS Foundations

• ISO 27001 structure and ISMS concepts
• Organizational context and interested parties
• ISMS scope and boundaries
• Leadership, responsibilities and objectives
• Risk-based approach and required documentation
• Gap assessment planning

Portfolio Output:
ISMS Scope Statement + ISO 27001 Gap Assessment

Module 4 — Days 16-20

ISO 27001 – Controls & Internal Audit

• Control selection and applicability
• Statement of Applicability (SoA)
• Policies, procedures and supporting evidence
• Internal audit planning and execution
• Findings, non-conformities and root cause analysis
• Corrective actions and follow-up tracking

Portfolio Output:
Sample SoA + Audit Checklist + Findings & Corrective Action Tracker

Module 5 — Days 21-25

SOC 2 and Control Testing

• Trust Services Criteria
• Type I and Type II reports
• Control descriptions and evidence requirements
• Design effectiveness vs operating effectiveness
• Testing steps and sampling concepts
• Exceptions, findings and remediation

Portfolio Output:
Evidence Request List + Control Testing Worksheet + Exception Log

Module 6 — Days 26-30

NIST CSF 2.0 & Third-Party Risk

• Govern, Identify, Protect, Detect, Respond and Recover
• Current and Target Profiles
• Gap assessment and improvement planning
• Vendor lifecycle and due diligence
• Vendor questionnaires and evidence review
• Risk scoring, treatment and ongoing monitoring

Portfolio Output:
NIST Gap Assessment + Vendor Risk Assessment + Vendor Risk Summary

Module 7 — Days 31-35

DPDP and Privacy GRC

• DPDP concepts and personal data
• Data flows and processing activities
• Notices, consent and applicable obligations
• Data fiduciaries, processors and vendors
• Security safeguards and breach management
• Privacy evidence, tracking and GDPR comparison

Portfolio Output:
Personal Data Inventory + DPDP Compliance Assessment + Privacy Action Plan

Module 8 — Days 36-40

Mock Audit, Capstone & Career Preparation

• Audit lifecycle, scope and evidence requests
• Stakeholder interviews and evidence evaluation
• Findings, root causes and corrective actions
• Compliance tracking and management reporting
• GRC interview scenarios
• Final capstone presentation

Portfolio Output:
Mock Audit Report + Capstone Submission + Management Summary