GRC & Compliance: Risk, Frameworks and Audits
Governance, risk and compliance for security testers: turning findings into business decisions
One-time payment · lifetime access · lessons, labs, exam and certificate included · no subscription.
About this course
This course shows security testers and IT staff how organisations decide what to protect and how findings become business decisions. You learn the three pillars of governance, risk and compliance, then the risk loop of identify, assess, treat and monitor, with likelihood times impact scoring and the four treatments: mitigate, transfer, accept and avoid. You compare ISO/IEC 27001 and its Annex A, the six functions of NIST CSF 2.0, SOC 2 and the CIS Controls, and see which rules apply when you handle personal or card data, including GDPR, the Swiss nFADP and PCI DSS. A lesson on audits explains evidence and how to turn a pentest finding into an audit-ready item mapped to a control. A capstone risk register exercise, quizzes and a final exam lead to a certificate.