Governance, risk and compliance (GRC) is the part of cybersecurity that decides what the security work has to prove, and then proves it. It’s a real way into the field, and one that rewards people who write well as much as people who code.
This roadmap is the order we’d learn it in. Every step links to something you can do, starting with a free course.
What GRC analysts actually do
A GRC analyst turns requirements into practice and then shows the evidence. The requirement might come from a regulation, a contract, a framework the company chose, or its own leadership. The day-to-day work:
- Read an obligation and work out what it asks for.
- Scope the systems and data it applies to.
- Assess the gap between what’s required and what’s in place.
- Keep the risk register honest and help leadership decide what to do about each risk.
- Write and maintain policy that people can follow.
- Collect evidence an assessor will accept.
- Manage vendor risk and run tabletop exercises.
- Brief leadership in plain language.
The titles vary: GRC analyst, compliance analyst, IT auditor, risk analyst, and in government and defense work, ISSO (Information System Security Officer).
The GRC ladder
- GRC analyst. Run the program’s day-to-day work for one organization.
- ISSO / RMF practitioner. Own a system’s security documentation and carry it through authorization.
- Security control assessor. Test controls independently and write the findings.
- GRC lead / security manager. Run the program, the team and the budget. From here the path continues into security leadership and the vCISO path.
The GRC roadmap, phase by phase
Phase 1: Learn the language and do the work (free)
Start with the vocabulary every GRC conversation runs on: control, evidence, SSP, POA&M, risk register and CUI. Our GRC Analyst Fundamentals post walks through all six and traces one NIST SP 800-171 control from requirement to evidence.
Then do the job. GRC Analyst Prep is free. You do the work a GRC analyst is actually handed: obligations, scope, risk, policy, gap assessment, evidence, vendors, tabletop and the board brief. You practice all of it end to end on one organization.
Phase 2: Learn the federal process (RMF and ATO)
GRC work in government and defense runs on the Risk Management Framework (RMF). RMF & ATO: From Categorize to Authorize ($249) puts you in the ISSO seat for a DoD system and has you carry it from task order to the Authorizing Official’s (AO) decision, one deliverable at a time. It includes CGRC exam prep and 26 CPE hours.
Phase 3: Assess like an assessor
Security Control Assessor: From Evidence to Findings ($499) teaches you to assess security controls the way working assessors do: plan the assessment, test controls, gather evidence and write findings that stand up.
Phase 4: Prove it
Cover6 GRC Challenge ($299): assess an unseen system from its evidence alone in 72 hours, brief the AO, then defend your findings.
Certifications on this path
You don’t need a certification to start. They help you get past résumé filters once you’re applying.
- ISC2 CGRC: governance, risk and compliance, built around the RMF. CGRC Exam Prep + Study Guide
- ISACA CRISC: IT risk management. CRISC Exam Prep + Study Guide
- ISACA CISA: IT audit. CISA Exam Prep + Study Guide
- ISO/IEC 27001 (PECB): if your work is international or ISO-based, start with ISO/IEC 27001 Foundation; Lead Implementer and Lead Auditor come after.
GRC or SOC? How to choose
If you’d rather read a requirement, interview the people who run a system and write the finding, GRC fits. If you’d rather work the alert queue and chase what happened, look at the SOC Analyst Roadmap. Still not sure? Take the free career path assessment.
Start here
GRC Analyst Prep is free. Enroll on that page, then work through it one deliverable at a time. When you’re ready for the federal side, RMF & ATO is the next step.