What Is GRC?
Governance, Risk, and Compliance, explained from the ground up — what each word actually means and why they're bundled together.
Read the guideGRC & Cybersecurity Resources
Free, plain-English guides across governance, risk & compliance and technical cybersecurity — written for people deciding whether this field is the right direction, not for people who already work in it.
Getting Started
The four guides to read first if you're brand new to this.
GRC vs. Cybersecurity
What's actually different between the two, where they overlap, and why GRC is a realistic entry point for career switchers.
Read the guideInfoSec vs. Cybersecurity
Information security is the broader discipline; cybersecurity is the digital-only subset of it.
Read the guideHow to Become a GRC Analyst With No Experience
A realistic, step-by-step path: fundamentals, hands-on reps, a portfolio, then a certification.
Read the guideCore GRC Concepts
The building-block concepts every GRC role touches.
What Is TPRM?
Third-party risk management — why a vendor's weak security can become your breach, and who does the work.
Read the guideERM vs. GRC
How board-level enterprise risk strategy relates to the day-to-day work GRC analysts actually do.
Read the guideWhat Is a Risk Register?
A running list of risks scored by likelihood and impact, used to decide what to accept, mitigate, or escalate.
Read the guideWhat Is a Policy Gap Analysis?
Comparing a policy against a baseline of what it should cover, to find missing controls before an auditor does.
Read the guideWhat Is Audit Evidence?
The proof that a control actually works, not just that a policy says it should — and how it's tested.
Read the guideRisk Management vs. Compliance
Compliance means following existing rules; risk management means predicting what could go wrong before there's a rule about it.
Read the guideInternal Audit vs. GRC
Internal audit independently verifies that risk management is working; GRC actually manages it.
Read the guideFrameworks & Standards
The standards and regulations GRC work is measured against.
SOC 2 vs. ISO 27001
SOC 2 is a US-centric attestation report; ISO 27001 is an internationally recognized certification.
Read the guideWhat Is ISO 27001?
The international standard for an Information Security Management System, built around 93 Annex A controls.
Read the guideWhat Is SOC 2?
A US-centric attestation report built around five Trust Services Criteria — and what Type I vs. Type II means.
Read the guideWhat Is the NIST CSF?
A voluntary framework built around six functions: Govern, Identify, Protect, Detect, Respond, Recover.
Read the guideWhat Is GDPR?
The EU's data protection law, with fines up to 4% of global revenue or €20M, explained from a GRC angle.
Read the guideWhat Is India's DPDP Act?
India's data protection law, finally operational with rules notified in November 2025.
Read the guideSaudi PDPL vs. UAE PDPL
Two Gulf data protection laws that share an acronym but are at very different enforcement stages.
Read the guideWhat Is NESA?
The UAE's information security standard, now administered under a reorganized set of federal bodies.
Read the guideWhat Is PCI DSS?
The industry standard for protecting payment card data, enforced through acquiring banks, not government.
Read the guideWhat Is HIPAA?
The US healthcare data law, split between a Privacy Rule and a Security Rule for electronic records.
Read the guideCareer Paths & Roles
What these jobs actually involve day to day, how to get one, and how far the ladder goes.
What Does a GRC Analyst Do?
A realistic look at the day-to-day work: risk registers, control testing, policy writing, and vendor reviews.
Read the guideWhat Does a Compliance Analyst Do?
Mapping regulations to internal controls, and proving an organization is actually following the rules that apply to it.
Read the guideWhat Does an IT Auditor Do?
Independently testing whether technology controls actually work — and reporting to the board, not the team being reviewed.
Read the guideGRC Career Growth: Can You Become a CISO?
The honest ceiling for a pure-GRC career, and what it actually takes to reach the C-suite.
Read the guideGRC Certifications Explained
Which certifications need experience, which don't, and a realistic order to pursue them in.
Read the guideCybersecurity Track
Technical guides for anyone exploring the hands-on security side of CX Challenges.
What Is OSINT?
Gathering intelligence from publicly available sources — search engines, social profiles, WHOIS records — without hacking.
Read the guideWhat Is Phishing?
How social-engineering attacks actually work, and how to spot the red flags in headers and email text.
Read the guidePenetration Testing vs. Cybersecurity
A targeted, time-boxed engagement vs. the much broader, ongoing discipline it's one part of.
Read the guideReady to go past reading?
Practice for real in CX Challenges, or get a personalized roadmap through 1:1 GRC mentorship.