Governance, Risk, and Compliance (GRC) Portfolio Studio

What you build

One portfolio for TechFlow Solutions, a fictional company that serves healthcare and financial services clients and has no formal security program yet. Each step adds one portfolio piece, and the work moves through four stages:

• Set up the security program: who leads security, what the program covers, and where the company falls short today.
• Assess and treat risk: build a risk register, assess a vendor, and choose the safeguards that address the top risks.
• Put safeguards into practice: write clear policies and plan how the company puts its safeguards in place.
• Check the work and report to leadership: gather evidence, answer customer security questions, and brief leadership.

An information security management system (ISMS) is the set of people, rules, safeguards, and checks an organization uses to protect its information: who decides, what could go wrong, which safeguards are used, how they are checked, and how leaders stay informed.

Your portfolio is a proposed design for a fictional company. Present it as a case-based project.

How it works

Every step follows the same three parts.

• Learn It. Short videos explain the ideas and show them on TechFlow.
• Build and Defend It. You complete that step's portfolio piece and write a short defense of one key decision.
• Use It for Your Career. You practise explaining your work, as you would to an employer or a client.

Each step also has an optional short podcast on how that work is being carried out in organizations now, so you have something to say about it in interviews and with clients.

What guides the work

• The NIST Cybersecurity Framework (CSF) 2.0. You use its six functions, Govern, Identify, Protect, Detect, Respond, and Recover, to organize TechFlow's security work, from leadership and risk to controls, evidence, and review.
• ISO/IEC 27001 and SOC 2. You get a plain description of how ISMS certification and SOC 2 reports work, so you can speak about them accurately with employers, clients, and auditors.
• The organization's own requirements. Every decision also answers to TechFlow's goals, client commitments, contracts, and policies.
• The limits of your role. You assess and recommend. Leadership decides, and legal and technical questions go to specialists.

Two ways to use your portfolio

• A job inside a company. Use your portfolio pieces in interviews to show how you assess risk, choose controls, and prepare for audits.
• Advisory work. Use the same method to help organizations build or improve their ISMS, once you have the experience to offer it as a service.

What makes it different

Complete all the work in every step, and you earn more than a portfolio:

• A Certificate of Achievement from The Tech Academy, when your complete portfolio passes the Completion Check by Dr. Shumba
• A reference letter from Dr. Shumba, your mentor, on request once you have completed all the work, describing what you built
• A foundation for ISO/IEC 27001 Foundation. The Studio covers the ideas the standard is built on, and we encourage every learner to take ISO/IEC 27001 Foundation training and sit the exam through a training provider. When you pass the exam, you receive the provider's ISO/IEC 27001 Foundation certificate and digital badge.

Who it is for

• Entering GRC: recent graduates and career changers who want a non-coding role and practical work to show.
• Handling GRC tasks at work: people in IT, security, audit, or compliance who are taking on risk registers, audits, or security questionnaires.
• Preparing for advisory work: people who want to start their own services, helping organizations build their ISMS.

What you get

• The TechFlow case file and video lessons for every step
• An optional short podcast for every step on how the work is used in organizations now
• One portfolio template, in Word, with a part for every step
• Practice interview questions with explanations, two plain-English reference guides (NIST CSF 2.0, and certification and SOC 2), and a word list
• Individual feedback on your portfolio during your first 90 days
• Office hours with Dr. Shumba on the 2nd and 4th Saturday of each month during your first 90 days, for members only
• 12 months of access to all lessons and materials

Founding price: $497, or 2 payments of $249 (total $498). On a payment plan, Steps 1 to 5 open with your first payment, and Steps 6 to 11 open after your second payment.