Technical controls only work when an organisation knows what it is protecting, why, and who is accountable. Governance, risk and compliance (GRC) is how that happens: governance sets direction and accountability, risk management decides what matters most, and compliance shows the organisation meets the standards and laws that apply to it. You'll start with what GRC is and why it matters, then see how a large organisation runs cybersecurity risk management through a risk register and a lifecycle of identification, assessment, mitigation and monitoring.
Next, you'll look at the frameworks and regulations that give that work structure: ISO 27001 and its information security management system, the NIST Cybersecurity Framework 2.0 with its six functions including the new Govern function, and the seven principles of the GDPR for handling personal data.
This is the final module in the course. Once you've finished it, put everything you've learned into practice in the Projects section.
An introduction to governance, risk and compliance as an overall strategy rather than a single tool, and how the GRC mindset helps an organisation meet compliance, manage risk and stay accountable.
How Microsoft runs its enterprise risk program: the risk management pyramid, a centralised risk register, the four-stage lifecycle of identification, assessment, mitigation and monitoring, and who is accountable at each step.
A beginner-friendly lesson on the information security management system (ISMS), the CIA triad, risk management, Annex A controls, implementation and auditing.
A five-minute overview of CSF 2.0: why the framework exists, what changed in version 2.0, the six functions of the Core, and how Profiles and Tiers are used.
The seven principles that guide how personal data must be handled, from lawfulness, purpose limitation and data minimisation through to integrity, confidentiality and accountability.