GRC: Governance, Risk and Compliance
ISO 27001, NIST CSF, SOC 2 and running a risk register.
Taught by Nisha Poudel · SOC Lead
What you'll learn
- Explain what governance, risk, and compliance mean and how they connect
- Compare ISO 27001, the NIST Cybersecurity Framework, and SOC 2
- Run a risk assessment and maintain a practical risk register
- Write policies and standards that people can actually follow
- Map controls to requirements and collect evidence auditors will accept
- Assess third-party and vendor risk with a repeatable process
About this course
This beginner course is the non-technical route into cybersecurity, built for aspiring analysts, compliance officers, project managers, and anyone moving into a governance, risk, and compliance role. You need no coding background. You will learn what GRC actually means day to day, how the major frameworks fit together, including ISO 27001, the NIST Cybersecurity Framework, and SOC 2, and how to run a risk assessment and keep a living risk register. You will write policies people follow, map security controls to requirements, and collect the evidence auditors expect. You will also learn to assess vendor and third-party risk and to prepare calmly for an audit. By the end you can hold a real GRC conversation, contribute to a compliance programme, and speak the language of frameworks, controls, and risk with confidence.
Course content
7 lessons- 1What GRC Is and Why It MattersHow governance, risk, and compliance connect, and where a GRC role sits in an organisation.Preview
- 2Security Frameworks: ISO 27001, NIST CSF, SOC 2What each major framework is for and how to choose or combine them.
- 3Running a Risk AssessmentIdentifying, scoring, and prioritising risks with a method you can repeat.
- 4The Risk Register in PracticeKeeping risks as a living record with owners, treatments, and review dates.
- 5Policies, Standards, and ControlsWriting documents people follow and connecting them to the controls that enforce them.
- 6Controls, Evidence, and Audit ReadinessCollecting evidence continuously so audits confirm what is already true.
- 7Third-Party and Vendor RiskAssessing the risk your suppliers introduce with a repeatable, proportionate process.