Free · Open · From L8Insights

The GRC Mindset

Most courses teach frameworks. This course teaches judgement.

Learn cyber GRC by making decisions.

What to expect

Learn cyber GRC by making decisions.

As Scaldimet's first CISO, you'll define what matters, weigh the risks and set the strategy, then build the management system that empowers the people who are accountable to make their decisions.

Govern

Design the direction, structure and policy, and make the case for who owns what.

Manage risk

Judge the risks your controls don't cover, and turn them into options a board can defend and own.

Comply

Separate the laws that bind the business from the standards worth adopting, and run them without drowning in checklists.

Your place in the course¶

Select your profile to highlight your learning path:

Pick up where you left off, or start at the beginning. Your progress is stored only in this browser.

01ConceptsThe four ideas everything is built on, and how they connect. 02GovernanceSetting direction, authority and accountability across the organisation. 03ComplianceChoosing and operating the regulatory and standards baseline. 04RiskAssessing what the baseline does not cover, with scenario analysis.

05AdvancedQuantification, tooling, board communication, building from scratch.

A note from the author

Why this course exists

I held several roles before becoming a Chief Information Security Officer, and this course is one way of giving back: sharing what I have learnt with the people and organisations that need it.

I kept seeing the same gap. Organisations are under more pressure than ever to improve their security but struggle to find people who can do the work. At the same time, many capable people are ready to move into cybersecurity from other fields with no clear path in. So I wrote this for two groups: small companies that must manage real risk without a large team or budget, and people looking to change career.

While coaching people moving into cyber, I noticed that good training on Governance, Risk and Compliance is often either expensive or dismissed as the dullest part of the field. Technical skills get most of the attention; the management side gets far less, even though it is where many of the important decisions are made.

I built this course from material I already had: lectures I have given, articles I have written, and lessons from daily practice. It is practical and grounded in experience, with a European focus and strong roots in Belgium, where I work. It is not meant to replace the established courses that already exist; it is a free starting point, offered in gratitude to a field where I have learnt from many good people.

I hope you find it useful.

— Xavier Paulus