Practice GRC situations before you're thrown into them.
Scenarios you work through in the browser, and controls you build with Trivy, Gatekeeper and Terraform in your own repo.
Free. Read anything without an account; sign in when you start a mission.
A terminal session from the Kubernetes build. Applying a privileged pod is refused with the message: Container web is privileged, blocked under NIST 800-53 AC-6. A compliant pod is created. The audit reports one violation, the pod that was already running. The evidence is committed to Git.
From the Kubernetes build: a privileged pod refused by a policy the learner wrote, and the proof committed.
Traditional GRC, worked in the browser
A vendor review lands at 10:47 with a 5 PM deadline, a program nobody documented needs a baseline, and an authorization package is waiting on the AO's desk. You read the evidence and make the call.
- 01 · Scenario
Build your first RMF system
- 02 · Scenario
FIPS 199 categorization
- 03 · Scenario
The Vendor Review Room
- 04 · Scenario
The Diagnostic Room
- 05 · Scenario
The Authorization Room
The Vendor Review Room
Vendor review. Please send your access control policy, our current access list, and 90 days of access review logs by 5 PM.
- not checkedAccess control policy
- not checkedClearwater access list
- not checked90-day access review logs
Nothing to install. The meter moves on the call you make.
GRC Engineering, built in your own repo
Real tools in a GitHub Codespace, then your own AWS account. Every click and command is written out. Each build ends as a folder in your own repo, so you finish with a portfolio.
- 01 · Build
Set up your workbench
- 02 · Build
Scan images and gate the pipeline
- 03 · Build
Kubernetes admission policy
- 04 · Scenario
The Pipeline Room
- 05 · Build
IAM least privilege
- 06 · Build
AWS detective controls
- Check out coderunning
- Build image FROM node:14queued
- Scan image, fail on CRITICALqueued
01-nginx-image-scan.txt02-nginx-sbom.cdx.json03-sbom-rescan.txt04-app-image-scan.txt05-iac-scan-practice.txt06-ci-blocked-critical.txt07-ci-history.txt
One mission, start to finish
- 10:47 AM
Start with a situation
Sarah at Clearwater wants an access review by 5 PM, or an assessor wants to know how known-critical vulnerabilities stay out of production.
- AC-6
Do the work it asks for
Read the evidence and make the call, or write the policy yourself and watch the privileged pod get refused.
- Credibility −1
Replay any scenario from the start
Make the wrong call and see what it costs, then run it again. Every lab can be torn down and rebuilt.
- evidence/
Keep what you made
Scenarios leave a record of your calls. Builds leave code, evidence and a README in your own repo.
The first scenario takes about an hour.
Start with a scenario in the browser, or set up your workbench and start building. Both paths are open, and you can start either one today.