Learning GRC in 12 weeks

A complete, free introduction to cybersecurity governance, risk and compliance, taught over twelve sessions by practitioners from the London School of Cybersecurity. The series takes you from what GRC actually is through to running risk assessments, writing policy, maintaining a risk register, supporting audits and reporting to management.

Start at week one and work through in order, or jump to the topic you need. Each session has its own page with the video and a written summary.

The twelve sessions

Week 1 — What is GRC? Governance, Risk and Compliance explained (40 min)
GRC stands for governance, risk and compliance. The three are usually spoken about as one discipline because in practice they are inseparable: governance sets the direction and the accountability, risk management decides what the organisation worries about and in what order, and compliance demonstrates to a third party that the first two are genuinely happening. Take any one away and the other two stop working properly.
Week 2 — Cybersecurity governance: what it is and how it works (41 min)
Governance is the part of security that decides who gets to decide. It covers how security objectives are set, who is accountable when something goes wrong, how exceptions are approved, and how any of that is reported upwards. Without it, security becomes a series of individual judgement calls with nobody clearly answerable for the outcome.
Week 3 — Cyber risk management: an introduction (32 min)
Risk management is the engine of GRC. It is the process by which an organisation works out what could go wrong, how much that would matter, and what — if anything — it intends to do about it. Everything else in GRC either feeds this process or reports on its output.
Week 4 — Cybersecurity compliance explained (36 min)
Compliance is the work of demonstrating that your security obligations are being met — to a regulator, an auditor, a customer, or an insurer. It is often the first part of GRC a new analyst is asked to do, because it is concrete: there is a requirement, and either you can evidence it or you cannot.
Week 5 — Cybersecurity control domains explained (106 min)
Control domains are how the security world organises the very large number of things an organisation might do into categories that can be reasoned about. Access control, asset management, incident response, business continuity, supplier management and so on — each domain groups related controls so that coverage and gaps become visible.
Week 6 — How to write security policies, standards and procedures (71 min)
Security documentation fails for predictable reasons: it is too long, it mixes the three document types together, it is written for auditors rather than for the people expected to follow it, and nobody owns keeping it current. Getting the structure right solves most of that.
Week 7 — Risk frameworks and the human factor (65 min)
A risk framework gives you a common language and a repeatable process. It does not, by itself, make an organisation better at managing risk. What determines that is whether people engage honestly with it — and that is a question about behaviour, incentives and culture rather than methodology.
Week 8 — How to conduct a cyber risk assessment (49 min)
A risk assessment is the point where GRC theory becomes a concrete piece of work with a deliverable. Done well it produces decisions; done badly it produces a document nobody reads. The difference is usually scoping and engagement rather than analytical sophistication.
Week 9 — Management reporting in cybersecurity GRC (31 min)
Reporting is where GRC either earns its influence or loses it. Senior audiences do not want a control inventory; they want to know whether the organisation is exposed, whether that is getting better or worse, and what decision is being asked of them.
Week 10 — What is a risk register and how to use one (22 min)
The risk register is the central artefact of a GRC function. It is the organisation's written record of what it knows could go wrong, who owns each of those things, and what it has decided to do. A well-kept register is the single most useful document a security team produces.
Week 11 — Supporting audit and compliance requirements (43 min)
Audit support is one of the most reliable ways into a GRC career, because the work is well defined and the need is constant. It is also where the quality of everything else in the function becomes visible: if controls are documented and evidence is routine, an audit is administrative. If not, it is a crisis.
Week 12 — Integrating people, process and technology in GRC (27 min)
The closing idea of the series, and the one that determines whether everything before it works. Controls fail at the seams — where a tool hands off to a process, or a process depends on a person understanding something nobody told them.

Want structured support?

The videos are free and always will be. If you want mentor-led support, real case studies, portfolio work and interview preparation to turn this into a job-ready skill set, our GRC Mentorship programme runs over six months.