Start with either path
Traditional GRC is the judgment work, practiced in the browser. GRC Engineering is the same work done with real tools, in your own Codespace and cloud account, and you keep everything you build. Both are free and both start at beginner.
Traditional GRC
The judgment calls, practiced in the browser.
Categorize a system, answer a vendor review against the clock, inherit a program nobody documented, and put an authorization package in front of the official who signs it. Nothing to install. Every mission is a scenario with a deadline, real artifacts and a call you have to make.
- Drawing a system boundary and categorizing it
- Reading evidence and spotting what it does not prove
- Answering an outside reviewer honestly, on a deadline
- Building an authorization package an AO can sign
- 01 · Scenario
Build your first RMF system
Walk one system through all seven RMF steps and support an authorization decision.
- 02 · Scenario
FIPS 199 categorization
Categorize three federal systems using FIPS 199 impact levels and the high-water mark rule.
- 03 · Scenario
The Vendor Review Room
A customer's vendor review lands at 10:47. Find the logging gap and send an honest answer by 5 PM.
- 04 · Scenario
The Diagnostic Room
Day one. The last GRC lead left six weeks ago and FedRAMP is thirteen weeks out. Find what drifted.
- 05 · Scenario
The Authorization Room
Ninety days to an honest ATO on Summit. Build the package, brief the AO, then plan the move to cATO.
GRC Engineering
Build the controls for real, and keep what you build.
Real tools, in your own GitHub Codespace and your own AWS account, with every click and command written out. Each build ends as a folder in your own public repo, with the code, the evidence and a README, so when you finish you have a portfolio you can walk an interviewer through.
- Writing controls as code and proving they work
- Capturing evidence an assessor would accept
- Scanning, gating and blocking before anything ships
- Least privilege and detection in a live cloud account
- 01 · Build
Set up your workbench
Your portfolio repo and a Codespace with every tool pinned, so every build runs on the same bench.
- 02 · Build
Scan images and gate the pipeline
Scan images and Terraform, produce an SBOM, and build a pipeline gate that blocks critical CVEs.
- 03 · Build
Kubernetes admission policy
Write two policies in Rego and prove risky pods are refused at the door and old ones are caught by audit.
- 04 · Scenario
The Pipeline Room
You have built a gate. Now review five of them against a spec nobody wrote, 48 hours before the assessor arrives.
- 05 · Build
IAM least privilege
Set up your AWS account safely, then build a narrow, time-boxed, read-only role for an assessor.
- 06 · Build
AWS detective controls
CloudTrail, Config, alarms and GuardDuty in Terraform. Set each one off on purpose and keep the proof.