Courses
Courses that leave you with real work done.
Each course is built around a task you do at work, like running a SOC 2, answering a breach, or putting AI to use safely. You finish with a working deliverable built on your own organization, whether you are a team of five or five thousand, and a certificate anyone can verify.
87courses
12domains
5credential paths
273ALCs to earn
7included with Associate Membership
The course mapEvery course, by domain. Pick a credential to light up the courses that count toward it.
Included with Associate MembershipPractitionerExecutive Practitioner
Concepts you hear but never learned Included
16 ten-minute lessons, included with Associate Membership. 0.25 ALC each, toward the Foundations Certificate. Open the series.
Bridge letterTPR · 10 minutes
CUECTPR · 10 minutes
Subservice organisation and carve-outTPR · 10 minutes
Global Privacy Control (GPC)PRV · 10 minutes
TCF and consent stringsPRV · 10 minutes
SBOM and VEXCYB · 10 minutes
Statement of ApplicabilityGRC · 10 minutes
ITGCAUD · 10 minutes
Legitimate interest and the balancing testPRV · 10 minutes
Article 28 processor termsPRV · 10 minutes
Business associate agreementPRV · 10 minutes
Risk acceptance and expiryRSK · 10 minutes
Type I versus Type IITPR · 10 minutes
Data processing agreement versus data protection addendumPRV · 10 minutes
Suppression listPRV · 10 minutes
Population and sampleAUD · 10 minutes
Governance, Risk & Compliance
10 coursesAIW-305Practitioner
AI in Compliance Mapping: Crosswalks and Gap Analysis
Mapping controls across SOC 2, ISO 27001, NIST and the rest takes weeks. Let AI draft the crosswalk, and keep it accurate enough to show an auditor.
4 ALCs
GRC-201Practitioner
SOC 2 From the Inside: Scoping, Ownership, Evidence and the Auditor
SOC 2 goes smoothly when scoping and ownership are right from day one. This course takes you through an engagement from the inside, including what the auditor…
4 ALCs CDTP
GRC-202Practitioner
ISO 27001 Implementation, Not Interpretation
Most ISO 27001 projects stall in interpretation. Implement the standard and reach Stage 1 with documents that reflect how you really work.
4 ALCs
GRC-203Practitioner
Control Mapping and Evidence Reuse Across SOC 2, ISO, NIST CSF and HITRUST
Running SOC 2, ISO, NIST CSF and HITRUST separately doubles the work. Map one control set across them and reuse evidence without overclaiming.
3 ALCs CDTP
GRC-210Practitioner
Policies People Read: Writing, Versioning, Acknowledgement and Training Binding
Nobody reads a 40-page policy. Write policies people follow, keep versions straight, and tie acknowledgements and training to the right version.
3 ALCs CDTP
GRC-220Practitioner
Evidence Management and Audit Readiness
Audit readiness is a habit, not a sprint. Manage evidence year-round so audits feel routine.
3 ALCs CDTP
GRC-230Executive
Internal Controls and SOX for Practitioners
SOX control failures often come from IT general controls nobody owns. Scope your ITGCs, run quarterly certifications and handle deficiencies before the auditors…
3 ALCs
GRC-240Practitioner
PCI DSS in Practice: Scoping, SAQs and Compensating Controls
PCI DSS gets expensive when scope grows unchecked. Shrink the cardholder data environment, pick the right SAQ and document compensating controls that hold up.
2 ALCs
GRC-250Executive
HITRUST for HealthTech: Self-Assessment to Validated
HITRUST is often a customer requirement in healthcare. Move from self-assessment to validated, inheriting controls from your cloud provider along the way.
2 ALCs
GRC-260Practitioner
Running a Security Awareness Program Auditors Accept
Auditors look for training evidence mapped to controls, not attendance counts. Run security awareness that satisfies them and actually changes behavior.
2 ALCs