Your free access includes
- Start Here: welcome and orientation
- Step 0: Know Your Frameworks
- Program Resources
Explore the Studio before deciding whether to join the full program. Your Step 0 progress stays with you when you continue.
Start with Step 0 free | Full Studio: $497 | 12 months of access
GRC Portfolio Studio
Build an Organization's Security Program, and a Portfolio You Can Explain
A self-paced program where you design an information security management system for a fictional company and build a portfolio you can show employers and clients.
Take on the role of the GRC analyst at TechFlow Solutions. Move from Step 0 through Step 11, use short videos and practical templates, and build a connected twelve-part portfolio that shows what you can do and why you made each decision.
Beginners welcome. Plan for 2 to 3 hours per week. Most learners aim to finish in 10 to 12 weeks.
Try the work before you enroll
Start With Step 0 — Free
Watch the Step 0 videos, try the practice questions, and complete the first page of your portfolio.
Continue into the Full Studio
Unlock Start Here, Steps 0 to 11, Finish the Studio, Support, and Program Resources.
- 12 months of access
- 90 days of mentor support
- A Certificate of Achievement when your portfolio passes the Completion Check
One company from beginning to end
Learn GRC by Building for TechFlow
TechFlow Solutions is a realistic fictional company. You build its information security management system in the order the organization needs it, then explain the reasons behind your choices.
Each step adds a connected piece to your portfolio. Instead of unrelated templates, you finish with one professional story you can discuss with an employer or a future client.
Self-pacedMove through the lessons on your schedule.
2 to 3 hours weeklyMost learners aim to finish in 10 to 12 weeks.
12 months of accessReturn to every lesson and program resource.
90 days of supportOffice hours every two weeks and optional Saturday feedback.
One method, applied at every step
The GRC Build-and-Defend Method™
Every step follows the same three-part process:
Learn It
Learn the GRC concepts, understand the TechFlow situation, and know what the assignment requires.
Build and Defend It
Use the TechFlow case file and portfolio template to create your piece. Explain your decisions and prepare to answer questions about your work.
Use It Professionally
Turn the completed assignment into resume and interview evidence now, or a work sample you can use as you build toward advisory work later.
The short version is:
Learn it. Build and defend it. Use it professionally.
One company, twelve parts
Step Into the Role of TechFlow's GRC Analyst
TechFlow needs to establish its security program, understand its risks, review suppliers, choose controls, write policies, collect evidence, answer customer questions, and report to leadership. You are the analyst assigned to all of it.
Because you follow one company from beginning to end, each piece connects to the one before it. Your portfolio tells a single professional story instead of showing separate exercises.
That is why it is called a Studio. A studio is a working room: you come in, you build, and you leave with finished pieces.
By the end you have twelve connected examples of GRC work, from Step 0 through Step 11.
Step 0 to Step 11
Your Path and the Work You Will Produce
Each step builds on the work completed before it. By the end of the Studio, you will have a twelve-part portfolio based on the TechFlow company case.
Step 00Know Your Frameworks
Compare the purpose of major GRC frameworks and create the first page of your portfolio.
Step 01TechFlow Information Security Program Charter
Establish the security program’s authority, leadership roles, responsibilities, requirements, and escalation process.
Step 02TechFlow Security Program Scope and Asset Profile
Define what the security program covers and identify the systems, information, people, and suppliers that matter most.
Step 03TechFlow Current-State Gap Assessment
Compare TechFlow’s current practices with applicable expectations and prioritize the most important gaps.
Step 04TechFlow Information Security Risk Identification Package
Set the rules for assessing risk and identify the information security risks that could affect TechFlow’s operations and objectives.
Step 05TechFlow Evaluated and Prioritized Information Security Risk Register
Analyze and score the identified risks, compare them with TechFlow’s risk criteria, and rank them for action.
Step 06TechFlow Risk Treatment and Control Selection Package
Decide how each risk should be treated, select appropriate controls, and document why the controls apply.
Step 07TechFlow Control Design and Policy Package
Design how the selected controls will work and prepare the policies and procedures needed to support them.
Step 08TechFlow Control Implementation and Access Review Package
Plan how the controls will be implemented, conduct a simulated access review, address identified issues, and organize recurring security activities.
Step 09TechFlow Third-Party Risk Assessment and Supplier Review Package
Assess two suppliers, identify their security gaps, and recommend whether TechFlow should accept the risks, require corrective action, or reconsider the supplier relationship.
Step 10TechFlow Audit Readiness and Customer Assurance Package
Organize control evidence, identify audit-readiness gaps, and prepare accurate responses to customer security questions.
Step 11TechFlow Internal Assessment, Management Review, and Remediation Package
Assess whether the controls are working, report the findings, present the results to leadership, and track corrective actions.
Each step includes short videos, practice questions, and a portfolio template.
These are simulated work samples from a fictional company. Label them as fictional case-study work when you show them to an employer.
When you complete the Studio
A Portfolio You Can Explain
You will also carry the fluency that comes from doing the work: reading a company and spotting what matters, connecting risks to requirements, controls, and evidence, deciding with incomplete information, and explaining any of it in plain business language.
The portfolio is what you show. The fluency is what you carry.
- A twelve-part portfolio from one company case
- Decision records showing how you think
- Resume and interview evidence from work you completed yourself
- Work samples you can discuss with employers now or clients later
- A Certificate of Achievement after your portfolio passes the Completion Check
Everything supports one goal
What Is Included
Step 0 to Step 11: short videos, practice questions, and a portfolio template for each step
The TechFlow Solutions case file
A twelve-part portfolio you can show employers now, or clients later
90 days of mentor support: office hours every two weeks and optional Saturday feedback
12 months of access to all lessons and materials
A Certificate of Achievement when your portfolio passes the Completion Check
Four distinctions
What Makes the Studio Different
One company from start to finish.
Your portfolio tells one professional story.
You practice explaining your choices.
Your portfolio work records what you did, why, and what would change your mind.
Your career materials come from your own work.
Your examples already exist when the interview comes.
Work that draws on NIST guidance and reflects common GRC responsibilities.
A Path Toward the ISO/IEC 27001 Foundation Exam
Your TechFlow work runs on the core ideas the Foundation exam covers: scope, risk, controls, policies, evidence, and audit. If you choose to sit for and pass the exam afterward, you can show an employer both completed work and a recognized credential. The exam is offered separately by certification bodies, with its own requirements and fee.
Recognition You Can Earn
Complete the Studio and pass the portfolio Completion Check to earn The Tech Academy's Certificate of Achievement.
Is the Studio right for you
Is the Studio Right for You?
It fits if you want a non-coding cybersecurity role, need professional work samples rather than more theory, and can set aside 2 to 3 hours each week. Learners come from teaching, healthcare, finance, project management, compliance, auditing, IT, and other fields.
The Studio asks you to do the work, make the decisions, and explain them. That is where the value is.
Your first 90 days
Mentor Support While You Build
Your Full Studio enrollment includes office hours every two weeks and optional Saturday feedback during your first 90 days.
Your mentor is Dr. Rose Shumba, a cybersecurity educator and computing professor with more than 20 years of experience preparing people for technology and cybersecurity careers. She designed the Studio and created the TechFlow case.
Read Dr. Shumba's BioUse the self-paced lessons on your schedule, with mentor support during your first 90 days.
Choose how to begin
Start Free or Join for $497
Try Step 0 at no cost. When you are ready, join the Full Studio for 12 months of access and 90 days of mentor support.
Pay $497 today for the Full Studio.
Refund policy: This is a digital product. You can request a full refund within 14 calendar days of purchase if you have not opened any of Steps 1 to 11. Opening free Step 0 does not affect refund eligibility. Once you open paid content, no refund is available. Email [email protected].
Questions
Frequently Asked Questions
Can I join if I am completely new to cybersecurity?
Yes. The guidance, case materials, templates, and coaching introduce the ideas you need at each step.
Is the Studio self-paced?
Yes. Complete Step 0 through Step 11 on your schedule during 12 months of access. Most learners aim to finish in 10 to 12 weeks by setting aside 2 to 3 hours per week.
What mentor support is included?
Your first 90 days include office hours every two weeks and optional Saturday feedback.
What is a Decision Brief?
A one-page explanation of your thinking: what you found, what you considered, what you recommended, and what new information could change it.
Are the pieces based on a real company?
TechFlow is a realistic fictional company, which keeps real employer and client information out of your work. Label it as a fictional case study when sharing it.
Can I take the ISO/IEC 27001 Foundation exam after the Studio?
Yes. The Studio gives you practical experience behind the concepts the exam covers. Registration and fees are handled by the certification bodies.
What is included in the free Step 0?
Start Here, Step 0: Know Your Frameworks, and Program Resources. You keep your Step 0 progress when you continue into the Full Studio.
Does the Studio provide a professional certification or guarantee a job?
No. The Tech Academy's Certificate of Achievement recognizes completion of this practical program. It is not a professional certification or a guarantee of employment.
What is the refund policy?
You can request a full refund within 14 calendar days of purchase if you have not opened Steps 1 to 11. Opening free Step 0 does not affect refund eligibility. Once you open paid content, no refund is available.
What happens when my 12 months end?
Your access to the lessons and materials ends. Download your completed portfolio before then. The TechFlow materials and templates may not be shared or redistributed.
One company, twelve connected pieces
Build Work That Shows How You Think
Step into the role of a GRC analyst. Help TechFlow build its security program from the ground up, and finish with work samples you can explain.
Start with Step 0 free, or join the Full Studio for $497.
