Courses
Courses that leave you with real work done.
Each course is built around a task you do at work, like running a SOC 2, answering a breach, or putting AI to use safely. You finish with a working deliverable built on your own organization, whether you are a team of five or five thousand, and a certificate anyone can verify.
87courses
12domains
5credential paths
273ALCs to earn
7included with Associate Membership
The course mapEvery course, by domain. Pick a credential to light up the courses that count toward it.
Included with Associate MembershipPractitionerExecutive Practitioner
Concepts you hear but never learned Included
16 ten-minute lessons, included with Associate Membership. 0.25 ALC each, toward the Foundations Certificate. Open the series.
Bridge letterTPR · 10 minutes
CUECTPR · 10 minutes
Subservice organisation and carve-outTPR · 10 minutes
Global Privacy Control (GPC)PRV · 10 minutes
TCF and consent stringsPRV · 10 minutes
SBOM and VEXCYB · 10 minutes
Statement of ApplicabilityGRC · 10 minutes
ITGCAUD · 10 minutes
Legitimate interest and the balancing testPRV · 10 minutes
Article 28 processor termsPRV · 10 minutes
Business associate agreementPRV · 10 minutes
Risk acceptance and expiryRSK · 10 minutes
Type I versus Type IITPR · 10 minutes
Data processing agreement versus data protection addendumPRV · 10 minutes
Suppression listPRV · 10 minutes
Population and sampleAUD · 10 minutes
Digital Trust Foundations
3 courses · 3 included with Associate MembershipDTF-101Included
What Digital Trust Means in Your Job
Trust, privacy and security obligations land on every job, not just the security team's. Find out exactly which ones your role carries and how to prove you meet…
3 ALCs DTFC CDTP
DTF-110Included
Ethics and Judgment Calls for Practitioners
Sooner or later someone will ask you to sign something you're not sure is true. This course prepares you for the judgment calls that come with trust work.
1.5 ALCs DTFC CDTP
DTF-120Included
Reading a Regulation Without a Lawyer
You don't need a law degree to work out what a regulation asks of you. Turn articles into obligations, owners and evidence you can act on.
2 ALCs DTFC CDTP
Privacy & Data Protection
12 courses · 2 included with Associate MembershipAIW-301Practitioner
AI in Privacy Operations: Requests, Records and Notices
Access requests, records of processing and privacy notices are slow, repetitive work. Let AI speed them up while your team keeps the decisions and the…
4 ALCs
PRV-201Practitioner
GDPR in Practice: From Articles to an Operating Program
GDPR has 99 articles, but running a program comes down to a handful of decisions. Make them, and leave with a working plan for the next 12 months.
4 ALCs CPTP
PRV-202Included
US State Privacy Laws in Practice: CCPA/CPRA and the Rest
More US states have their own privacy law every year. Work out which apply to you and handle opt-outs, GPC and sensitive data with one standard.
3 ALCs
PRV-203Practitioner
HIPAA in Practice for HealthTech and Business Associates
Business associates carry real HIPAA duties, and most learn that in an audit. Know what applies, what your BAA should say and how to apply minimum necessary in…
3 ALCs
PRV-210Practitioner
Data Subject Rights Operations: GDPR, CCPA and HIPAA Access
Access and deletion requests have deadlines, and they arrive in bursts. Handle them across GDPR, CCPA and HIPAA from intake to evidence file.
4 ALCs CPTP
PRV-220Practitioner
Building a Record of Processing and Data Inventory That Survives Audit
Records of processing are usually wrong within months. Build one from real systems and keep it current after the project ends.
3 ALCs CPTP
PRV-230Practitioner
Consent and Cookie Management Platforms in Practice
Cookie banners are one of the most enforced areas of privacy law. Configure your consent platform so the banner, the tags and the policy all match.
3 ALCs CPTP
PRV-240Included
Privacy in Marketing: Consent, Lists and Campaign Compliance
Marketing lists are where privacy complaints start. Run campaigns with clean consent, working suppression and lists you can defend.
3 ALCs CPTP
PRV-250Practitioner
DPIA and PIA: Running One That Changes a Decision
Most impact assessments are paperwork done after the decision. Run a DPIA that actually changes the design.
3 ALCs CATP
PRV-260Practitioner
Breach Notification Decisions Under Pressure
You may have 72 hours or less to decide whether to notify. Make breach notification calls under GDPR, HIPAA and US state laws while the clock runs.
3 ALCs CDTP CPTP
PRV-270Practitioner
Retention and Deletion That Actually Deletes
Deletion schedules that nobody runs are worse than none. Set retention, handle legal holds and prove data is deleted, including in backups and SaaS.
2 ALCs
PRV-280Executive
International Transfers: SCCs, Transfer Assessments and the DPF
Sending personal data out of the EU needs a mechanism for every flow. Map your transfers, choose SCCs or the DPF and complete a transfer impact assessment.
2 ALCs
Data Governance
3 courses · 1 included with Associate MembershipDGV-210Practitioner
Data Classification and Handling Rules People Follow
Classification schemes fail when they're too clever. Build three levels people understand, with handling rules your tools actually enforce.
2 ALCs
DGV-220Executive
Data Mapping and Discovery: Connectors, Owners and Drift
Your data inventory starts going stale the day you finish it. Use discovery tools and clear ownership to keep it accurate as systems change.
2 ALCs
DGV-230Included
Secure Data Sharing: Data Rooms, Remanence and What People Miss
Data rooms, shared links and file transfers leave copies behind. Share sensitive data safely, and make sure it's really gone when the deal or project ends.
3 ALCs
Governance, Risk & Compliance
10 coursesAIW-305Practitioner
AI in Compliance Mapping: Crosswalks and Gap Analysis
Mapping controls across SOC 2, ISO 27001, NIST and the rest takes weeks. Let AI draft the crosswalk, and keep it accurate enough to show an auditor.
4 ALCs
GRC-201Practitioner
SOC 2 From the Inside: Scoping, Ownership, Evidence and the Auditor
SOC 2 goes smoothly when scoping and ownership are right from day one. This course takes you through an engagement from the inside, including what the auditor…
4 ALCs CDTP
GRC-202Practitioner
ISO 27001 Implementation, Not Interpretation
Most ISO 27001 projects stall in interpretation. Implement the standard and reach Stage 1 with documents that reflect how you really work.
4 ALCs
GRC-203Practitioner
Control Mapping and Evidence Reuse Across SOC 2, ISO, NIST CSF and HITRUST
Running SOC 2, ISO, NIST CSF and HITRUST separately doubles the work. Map one control set across them and reuse evidence without overclaiming.
3 ALCs CDTP
GRC-210Practitioner
Policies People Read: Writing, Versioning, Acknowledgement and Training Binding
Nobody reads a 40-page policy. Write policies people follow, keep versions straight, and tie acknowledgements and training to the right version.
3 ALCs CDTP
GRC-220Practitioner
Evidence Management and Audit Readiness
Audit readiness is a habit, not a sprint. Manage evidence year-round so audits feel routine.
3 ALCs CDTP
GRC-230Executive
Internal Controls and SOX for Practitioners
SOX control failures often come from IT general controls nobody owns. Scope your ITGCs, run quarterly certifications and handle deficiencies before the auditors…
3 ALCs
GRC-240Practitioner
PCI DSS in Practice: Scoping, SAQs and Compensating Controls
PCI DSS gets expensive when scope grows unchecked. Shrink the cardholder data environment, pick the right SAQ and document compensating controls that hold up.
2 ALCs
GRC-250Executive
HITRUST for HealthTech: Self-Assessment to Validated
HITRUST is often a customer requirement in healthcare. Move from self-assessment to validated, inheriting controls from your cloud provider along the way.
2 ALCs
GRC-260Practitioner
Running a Security Awareness Program Auditors Accept
Auditors look for training evidence mapped to controls, not attendance counts. Run security awareness that satisfies them and actually changes behavior.
2 ALCs
Risk Management
4 coursesRSK-201Practitioner
Risk Assessment as a Craft: Scoping, Scenarios and Judgment
Good risk assessment is judgment, not a spreadsheet. Scope an assessment, build realistic scenarios and write down assumptions others can challenge.
3 ALCs
RSK-210Executive
Quantifying Risk: From Heat Maps to Money
Heat maps can't tell you whether a control is worth the money. Estimate risk in dollars, with ranges you can defend.
3 ALCs
RSK-220Practitioner
Treatment, Acceptance and Exceptions That Expire
Accepted risks that never expire become permanent holes. Make every acceptance name an owner, a compensating control and an end date.
2.5 ALCs
RSK-230Executive
Risk Appetite, KRIs and the Board Conversation
Most appetite statements are too vague to guide a decision. Tie appetite to indicators and thresholds, and have a sharper risk conversation with the board.
2.5 ALCs
Audit & Assurance Operations
8 coursesAIW-303Executive
AI in Audit and Assurance: Sampling, Evidence and Workpapers
AI can test whole populations and draft workpapers in minutes. Use it and still meet professional standards for evidence, sampling and independence.
4 ALCs
AUD-201Practitioner
Owning a Control: Accountability, Delegation and Follow-Through
Controls fail when everyone thinks someone else owns them. Give every control one accountable owner, delegate the work, and follow it through to evidence.
3 ALCs
AUD-210Practitioner
Populations, Completeness and Sampling
Auditors start by asking how you know the list is complete. Have the answer ready, along with samples they'll accept without redoing them.
3 ALCs
AUD-220Practitioner
Evidence That Holds: Collection, Freshness and Reuse
Most audit pain is evidence collected late, stale or twice. Run an evidence calendar so the right proof is ready before anyone asks.
3 ALCs
AUD-230Executive
Automated Audit Tests and Continuous Control Monitoring
Automated tests can check controls every day instead of once a year. Decide what to automate, what each test must prove and what happens when it fails.
3 ALCs
AUD-240Practitioner
Working With Auditors: Walkthroughs, Questions and Findings
A walkthrough can win or lose an audit. Walk in prepared, answer consistently, and respond to findings without a fight.
2.5 ALCs
AUD-250Practitioner
Framework Scope as a Guardrail, Not a Burden
Scope decisions made in a hurry come back as findings. Set framework scope on purpose and write down why each exclusion is safe.
2.5 ALCs
AUD-260Executive
Control Maturity and Status Reporting
Red, amber and green don't tell a board anything. Define control maturity and report status in a way that shows real movement.
2.5 ALCs
Cybersecurity & Threat
8 coursesAIW-304Practitioner
AI in Security Operations: Triage and Detection
AI can triage alerts and write detections, and attackers can target the AI itself. Get faster without ever letting a model close a real incident.
4 ALCs
AIW-306Practitioner
AI-Assisted Vulnerability Remediation: SAST, Secrets and SCA
Security scanners bury developers in findings. Use AI to triage SAST, secrets and dependency alerts and write fixes developers trust, without auto-suppressing…
6 ALCs
CYB-201Executive
Software Supply Chain: SBOMs, VEX and Component Monitoring in Practice
Customers and regulators are starting to ask for SBOMs. Generate them, ingest your vendors', and use VEX to know what's really exposed.
3 ALCs CTTP
CYB-210Executive
Threat Intelligence for Risk Decisions
Threat intelligence is useless if it doesn't change a decision. Turn breach and vulnerability news into risk register changes and vendor actions.
3 ALCs
CYB-220Practitioner
Vulnerability Management Governance: SLAs, Exceptions and Evidence
Vulnerability SLAs only work if exceptions expire. Set remediation deadlines engineering can meet, manage exceptions, and have the evidence ready when auditors…
2 ALCs
CYB-230Practitioner
Incident and Breach Readiness: Tabletop to Regulator
The first hours of an incident decide how the regulator sees you. This course takes you from a tabletop exercise to the decisions, logs and notices a real…
3 ALCs CDTP
CYB-240Practitioner
Access Reviews That Pass Audit
Access reviews fail audits for the same few reasons every year. Get the population right, collect real reviewer decisions and prove revoked access is gone.
2 ALCs
CYB-250Practitioner
Cyber Insurance Applications and Attestations
Cyber insurance applications ask yes-or-no questions with big consequences. Answer them honestly with evidence, and find the gaps before the insurer does.
1.5 ALCs
Third-Party & Supply Chain Risk
10 coursesAIW-302Practitioner
AI in Third-Party Risk: Questionnaires and Evidence
Vendor reviews pile up because questionnaires and SOC reports take hours to read. Let AI do the reading while your team makes the risk calls.
4 ALCs
TPR-201Practitioner
Building a Third-Party Risk Program: From Zero and At Scale
You can't review every vendor the same way. Build a third-party risk program, from scratch or at scale, with tiering that puts effort where the risk is.
4 ALCs CDTP CTTP
TPR-210Practitioner
Reading a SOC 2 Report: Opinion, Scope, Exceptions, CUECs and Subservice Organizations
A SOC 2 report can look clean while missing exactly what you rely on. Read the opinion, scope, exceptions, CUECs and carve-outs like an auditor.
3 ALCs CTTP
TPR-215Practitioner
Handling CUECs: Turning Complementary User Entity Controls Into Your Own Obligations
Every SOC report hands you controls you're expected to run. Turn complementary user entity controls into your own obligations, with owners and evidence.
2 ALCs CTTP
TPR-220Practitioner
Vendor Due Diligence Questionnaires: SIG, CAIQ, Custom and Scoring
Long questionnaires waste everyone's time and still miss the risk. Build tiered questionnaires, score them with partial credit and ask only for evidence that…
3 ALCs CTTP
TPR-230Practitioner
Contracting for Risk: DPAs, BAAs, Security Schedules and Right to Audit
Contracts are the only leverage you have after signature. Know which clauses matter in DPAs, BAAs and security schedules, and how hard to push by vendor tier.
3 ALCs
TPR-240Executive
Continuous Vendor Monitoring: Breach Intelligence, Attestation Expiry and Recertification
Vendor risk changes between annual reviews. Monitor vendors continuously, catch expiring reports and DPAs, and offboard cleanly.
3 ALCs CTTP
TPR-250Executive
Fourth-Party and Concentration Risk
Your vendors' vendors can take you down. Map subprocessors and spot concentration risk in the services you depend on most.
2 ALCs
TPR-260Practitioner
Answering Customer Security Questionnaires: The Other Side of the Table
Security questionnaires from customers can stall deals for weeks. Answer them fast and accurately, and use a trust center to cut the volume.
3 ALCs
TPR-270Executive
Regulated Outsourcing: DORA, OCC and FCA Registers in Practice
Regulators now expect registers of your ICT third parties and exit plans that would work. Meet DORA, OCC and FCA outsourcing requirements in practice.
3 ALCs
AI Governance
11 courses · 1 included with Associate MembershipAIG-201Included
AI Inventory and Use-Case Intake in Practice
You can't govern AI you don't know about. Find every AI system in use and set up an intake form product teams will actually fill in.
3 ALCs CATP
AIG-210Executive
AI Risk and Impact Assessment: NIST AI RMF and EU AI Act Tiers Applied
Before an AI system goes live, someone has to decide how risky it is and what that means. This course walks you through an impact assessment and an EU AI Act…
4 ALCs CATP
AIG-220Executive
Third-Party AI and Model Vendor Governance
Most of your AI risk arrives through vendors. Learn what to ask AI suppliers, which contract terms matter, and how to approve tools without grinding the…
3 ALCs CATP
AIG-230Practitioner
AI Acceptable Use and Policy That Engineers Follow
Most AI policies are ignored because they're vague. Write one engineers and staff will follow, with approval tiers and monitoring that fit how they work.
2 ALCs CATP
AIG-240Executive
Running an AI Management System to ISO/IEC 42001
ISO/IEC 42001 gives you a way to manage AI that certifiers and customers recognize. Stand up an AI management system and run it, not just write it down.
4 ALCs
AIG-250Executive
EU AI Act Obligations by Role
The EU AI Act puts different duties on providers, deployers and others. Work out which role you hold for each AI system and exactly what it requires, with the…
4 ALCs
AIG-260Executive
AI Documentation That Holds Up: Model Cards and Impact Assessments
Regulators, customers and auditors all want AI documentation, each for different reasons. Write model cards and impact assessments once, and keep them true as…
4 ALCs
AIG-270Executive
Testing and Red-Teaming AI Systems
Testing AI isn't like testing code. Set acceptance criteria before you test, red-team generative systems and make a release decision you can defend.
4 ALCs
AIG-280Executive
Monitoring AI in Production
AI systems change after launch as data drifts and vendors update models. Know what to watch, when to act, and who has the authority to switch a system off.
4 ALCs
AIG-290Executive
Governing Agentic AI: Permissions, Tools and Oversight
AI agents don't just answer, they act. Decide what an agent may do, control its tools and permissions, and stop it safely when something goes wrong.
4 ALCs
AIG-300Executive
Securing LLM Applications
Prompt injection will succeed eventually, so design for it. Threat model an LLM application and build controls that hold even when the model is fooled.
4 ALCs
Trust & Assurance
3 coursesTRS-201Practitioner
Building and Running a Trust Center
A good trust center answers buyers' questions before they ask. Decide what to publish, what to gate and how to keep it current.
3 ALCs
TRS-210Executive
Program Attestations and Certificates of Diligence for Buyers, Insurers and Regulators
Buyers, insurers and regulators want proof of diligence, not promises. Know what you can honestly claim and back it with evidence that stays current.
2 ALCs
TRS-220Executive
M&A Cyber Diligence: Buy Side and Sell Side
Cyber problems found after an acquisition become the buyer's problems. Run cyber diligence on either side of a deal.
3 ALCs
Practitioner Methods
4 coursesOPS-201Practitioner
A Risk Register Executives Use
Executives stop reading risk registers that never lead to a decision. Build one they use, with scoring, appetite and indicators that trigger action.
3 ALCs CDTP
OPS-210Practitioner
Findings That Get Fixed: Task, Remediation and Evidence Management
Findings pile up when nobody owns them. Run remediation so every finding has an owner, a deadline and proof it was fixed.
2 ALCs
OPS-220Practitioner
Digital Trust Metrics and Board Reporting
Boards want to know whether the organization is safer than last quarter. Choose the metrics that answer that and fit them on one page they'll actually read.
2 ALCs
OPS-290Executive
Capstone: Build a 90-Day Trust Program for a Real Organization
Put everything together. This capstone has you build a 90-day trust program for a real organization, from obligations and controls to vendors, privacy and board…
6 ALCs
Applied AI at Work
11 coursesAIW-201Practitioner
Practical Application of AI in Marketing
Your team is already using AI for copy, campaigns and research. This course turns scattered experiments into a playbook that makes the work faster and better…
3 ALCs
AIW-202Practitioner
Practical Application of AI in Sales
AI can research accounts, draft outreach and prep calls in minutes. Use it to build more pipeline without sending claims you can't back up or breaking contact…
4 ALCs
AIW-203Practitioner
Practical Application of AI in Accounting
AI can match invoices, draft reconciliations and research accounting questions. Learn where it's safe to use in the close, and how to keep your controls and…
4 ALCs
AIW-204Practitioner
Practical Application of AI in Finance
Forecasts, variance commentary and board packs can come together in hours instead of days. Get there with AI and still defend every number.
4 ALCs
AIW-205Practitioner
Practical Application of AI in HR
AI screening, interview tools and HR chatbots come with real legal exposure. Get the time savings and stay on the right side of discrimination, privacy and…
4 ALCs
AIW-206Practitioner
Practical Application of AI in Legal and Compliance
AI can draft, review and research in a fraction of the time. Use it without citing cases that don't exist, waiving privilege or leaking client data.
4 ALCs
AIW-207Practitioner
Practical Application of AI in Procurement and Supply Chain
AI can analyze spend, screen suppliers and prep negotiations. Put it to work well, and know what to insist on when you're the one buying AI.
4 ALCs
AIW-208Practitioner
Practical Application of AI in IT and Security
IT and security teams are both using AI and defending against it. This course covers the service desk, scripting, access reviews and company-wide AI use, plus…
4 ALCs
AIW-209Practitioner
Practical Application of AI in Operations and Project Delivery
Status reports, plans, meeting notes and procedures are ideal AI work. Hand them over without losing accuracy or accountability.
4 ALCs
AIW-210Practitioner
Practical Application of AI in Customer Service and Support
Chatbots and agent-assist tools can cut wait times, or promise refunds you never approved. Deploy AI that answers from policy and hands off to a person at the…
4 ALCs
AIW-211Executive
Practical Application of AI for Executives and Boards
Boards are being asked what their AI strategy is and how they oversee it. This course gives directors and executives a clear answer, and the reporting to back…
3 ALCs