Moves learners from framework awareness to framework fluency. Learners build a working understanding of ISO/IEC 27001:2022, NIST CSF 2.0, SOC 2, and NIST RMF as complete operating models, not just reference lists. Teaches learners how frameworks relate to each other and how to explain them clearly to non-technical stakeholders. This module is the conceptual backbone that every subsequent module builds on.

This module covers how organizations identify, classify, and maintain an inventory of their information assets. Asset management is the operational prerequisite for risk identification, control selection, and compliance mapping. Every subsequent module depends on the asset register built here. Adds explicit coverage of system ownership and criticality classification, which are the two most common gaps in real-world asset inventories.

This module covers how organizations structure their infosec programs and govern access to systems and data. Policy development and access governance are combined because both are fundamentally policy and controls design problems that GRC Analysts own operationally. Security awareness program governance is included here because it is a policy and program design responsibility, not a technical one. Access reviews are among the most common recurring GRC Analyst tasks in financial services.

This module covers the risk management lifecycle from identification through treatment documentation. Emphasis is on the skills most frequently tested in GRC interviews: running a risk workshop, writing a clear risk statement, scoring risks consistently, and documenting risk appetite and formal acceptance decisions.

This module covers how organizations select, design, and document security controls in response to identified risks, and how GRC Analysts govern vulnerability remediation as a control effectiveness responsibility. Learners build a Control Mapping Matrix, a Statement of Applicability, a Risk Treatment Plan, and a Vulnerability Remediation Tracker. Vulnerability management governance sits here because patch compliance is a direct output of control gap identification and risk treatment decisions.

This module covers how GRC Analysts test controls and collect audit-quality evidence. Sits immediately after Module 6 so learners move directly from designing controls to testing whether those controls work as designed. This is the most frequently missing skill in entry-level GRC programs. Continuous control monitoring is treated as a substantive operating skill that connects directly to the compliance calendar in Module 8.

Covers how organizations demonstrate compliance to regulators, auditors, and customers. Learners arrive at this module having already designed controls and tested their effectiveness. Gap assessment, evidence management, issue tracking, and compliance monitoring now connect directly to the control work completed in Modules 6 and 7. Restores the Compliance Monitoring Calendar as a named artifact. Adds regulatory change monitoring as a practical operational skill.

This movers how organizations assess and manage risk introduced by vendors, cloud providers, and other third parties. Adds cloud shared responsibility model coverage directly relevant to CB (Microsoft Azure) and CF (AWS). Introduces fourth-party risk, which appears with increasing frequency in financial services regulatory guidance. The CF organization features prominently as a stretch challenge, representing the fintech and cloud-native environment that many learners will enter.

Covers how organizations govern, classify, and protect sensitive data. Connects data classification to privacy obligations and GRC program requirements across multiple jurisdictions. Focused on the classification and inventory skills most relevant to entry-level GRC roles in financial services, where data governance is an increasingly expected competency and privacy knowledge is a differentiator in hiring.

Covers how organizations prepare for, respond to, and recover from security incidents and business disruptions. Learners build an incident response plan and complete a tabletop exercise simulation. The tabletop exercise report demonstrates the ability to validate plans, not just write them. Business continuity coverage focuses on the GRC Analyst's specific role: maintaining plans, coordinating business impact analysis, and tracking recovery objectives.

Covers how GRC Analysts communicate program status, risk posture, and decision needs to executives and boards. Learners build a governance dashboard and executive security report using the KPIs and KRIs generated across all prior modules, creating a genuine throughline from the risk register to the boardroom. The capstone runs as parallel CB and CF tracks so learners gain experience in both traditional financial services and fintech or cloud-native environments.

Available from day one throughout the program. Covers everything learners need to translate their new GRC skills and portfolio into a job offer: resume writing, LinkedIn optimization, interview preparation, certification planning, and the first 90 days in a GRC role. Designed to be visited multiple times as the portfolio grows.

Every organization relies on third parties. Banks use payment processors, cloud providers, fraud detection platforms, and dozens of other vendors. Each of those relationships introduces risk. This module gives you the skills to identify that risk, assess it systematically, and manage it throughout the vendor lifecycle.

Explore the principles of risk identification, assessment, and mitigation within organizational frameworks. This module covers control design, implementation, and testing methodologies to evaluate effectiveness and close gaps. Learners will apply risk-based thinking to real-world scenarios, develop testing plans, and interpret results to support informed decision-making and strengthen internal controls.

In this module, you'll learn how to build and maintain a structured vulnerability management program that continuously identifies, prioritizes, and remediates security weaknesses across your environment before attackers can exploit them.

In this module, you will learn how to manage the human layer of cybersecurity risk; the one no technical control can fully fix. Covering social engineering threats, phishing simulation design, role-segmented awareness training, and behavioural metrics, this module equips you to build and measure a security awareness programme that holds up to board scrutiny