Path 23: GRC & Compliance — KashSec Academy

Governance, Risk, and Compliance — the non-coding path into security. ISO 27001, NIST CSF, SOC 2, vendor risk, and how to actually break into a GRC career. 18 free lessons, all levels level, starting with "What is GRC?"

Level: All levels · 18 lessons · Free, no account needed.

Lessons in this path

  1. What is GRC? — Governance, Risk, and Compliance — and why it's a real, growing entry point into security.
  2. GRC Career Economics & Demand — Why compliance directly gates revenue, and why hiring demand has outpaced supply.
  3. Security Governance Basics — Who decides, and how — policy, standard, procedure, and who's in the room.
  4. RACI & Security Committees — The structural tools that make governance function, not just exist on paper.
  5. Risk Management Fundamentals — Risk registers, treatment options, and inherent vs. residual risk.
  6. Quantitative Risk Analysis & FAIR — Turning risk into real dollar figures for big-ticket decisions.
  7. ISO 27001 Overview — The world's most recognised ISMS standard — Annex A, the SoA, and the audit process.
  8. ISMS Documentation & Internal Audit — What actually keeps a certification genuine between annual audits.
  9. NIST Cybersecurity Framework Overview — Govern, Identify, Protect, Detect, Respond, Recover — the six functions and maturity tiers.
  10. NIST 800-53 & Control Families — The granular control catalog CSF's functions get mapped onto in practice.
  11. SOC 2 and Audits — Type I vs Type II, Trust Services Criteria, and what an auditor actually checks.
  12. Other Compliance Frameworks: PCI-DSS, HIPAA & Beyond — Why one framework rarely covers an entire organisation.
  13. Writing Policies People Actually Follow — The anatomy of a policy that survives contact with a real engineering team.
  14. Security Awareness Training Programs — Why annual compliance training mostly fails, and what actually works.
  15. Third-Party & Vendor Risk — Why vendors are the weak link, and how to actually assess them.
  16. Breach Notification & Disclosure Law — Fragmented state laws, the 72-hour clock, and who makes the call.
  17. GRC Tools, Certifications & Careers — Vanta/Drata, CISA/CRISC/CISM, and how to break into a GRC role.
  18. GRC Automation Platforms, Deep Dive — How continuous evidence collection actually works mechanically.