Respond to the prompts below in a post of your own. Be specific and use examples. There are no single right answers here. The goal is to think like a practitioner and learn from how others think. 1. Look back at your most recent role. Name one responsibility you held and the GRC pillar (Governance, Risk, or Compliance) it maps to most closely. Explain the connection in two or three sentences. 2. Cybersilience Bank (CB) faces gaps in all three GRC pillars at once. Which gap would you fix first, and why does fixing it make the other two easier? 3. Find a recent cyber incident at a bank or hospital that reached the news. In one paragraph, describe which CIA Triad property it most affected and one impact dimension (financial, operational, or reputational) that stood out. Then reply to at least one other learner. Add a perspective, ask a question, or build on their point.

This week you built a vendor tiering methodology, designed a due diligence questionnaire, and assessed two of CB's critical vendors. Now bring your own experience into the conversation. Think about an organization you have worked for or worked with. Did that organization rely on external vendors, contractors, or service providers? Respond to the following in your post: 1. Name one vendor relationship from that organization (no confidential details needed; describe the type of vendor and service). What risk tier would you assign them today, and why? 2. What due diligence activities do you think should have been in place for that vendor? Were any of those activities actually happening? 3. How does your experience managing external relationships in your previous career prepare you for vendor risk work in GRC? If you are newer to organizational settings, use the 2013 Target breach as your reference point. The breach traced back to a third-party HVAC vendor with network access. What tier would you assign that vendor? What controls might have caught the risk earlier? Reply to at least one other learner's post this week.

Most GRC courses teach you frameworks. This one puts you inside a real organisation, facing real problems, with a board meeting three weeks away. The GRC Launchpad is a 10-module, hands-on programme built for career starters and career pivoters breaking into cybersecurity governance, risk, and compliance. Every module follows Rivertown Community Bank; a fictional community bank through escalating GRC challenges, from a missing risk register on day one to a full ISMS maturity assessment at the capstone. What you'll cover - ISO 27001:2022 from policy and scope through to the Statement of Applicability and continuous improvement - NIST CSF 2.0 applied as a crosswalk and board-level reporting tool alongside ISO 27001 - Risk registers, governance charters, RACI matrices, and metrics frameworks - Compliance scoping, control crosswalks, and evidence management - Asset classification, control design, and the Statement of Applicability - Control testing, privileged access reviews, and root-cause analysis - Vulnerability management, incident response, vendor risk, and business continuity - A full capstone ISMS maturity assessment and regulatory self-assessment response Who this is for Career starters and professionals pivoting into cybersecurity GRC who want more than theory; analysts, IT professionals, compliance officers, and risk managers ready to build the skills and portfolio that get them hired. What you'll walk away with A portfolio of real GRC artefacts produced across 10 modules; risk registers, governance documents, compliance frameworks, control matrices, and board reports mapped to ISO 27001:2022, NIST CSF 2.0, CISM, and CRISC. Everything you need to walk into a GRC interview and show your work.