Roadmaps Security roadmaps Governance, risk, compliance and audit
Write the policies, run the control framework, map to standards such as ISO 27001 and SOC 2, and keep the organisation continuously compliant without drowning it in paperwork.
Estimated time: 15–27 months · At about 10 hours a week.
Click a topic to see what to learn and where. Mark topics as you go; your progress is saved in this browser only.
Governance sets direction and accountability: who decides, who owns risks, and how security supports business goals. Everything else in GRC hangs off it.
Policies say what must happen, standards say how well, procedures say how. Keep each short, owned and reviewed, or nobody reads them.
ISO 27001, NIST CSF, SOC 2 and CIS Controls each organise security controls differently. Learn the shape of the main ones and how they overlap.
GDPR, PCI DSS, HIPAA, NIS2, DORA and sector rules each impose security duties. Know which apply to your organisation and what they demand.
A control is only as good as the proof it is operating. Learn what evidence looks like for common controls and how to collect it without heroics.
Spreadsheets work at first; GRC platforms scale. Learn what the tools do so you can choose when to move and what to demand of them.
An information security management system is a cycle: assess risk, choose controls, operate them, measure and improve. Learn the clauses and Annex A.
SOC 2 reports attest to controls over security and related criteria. Learn the Trust Services Criteria, Type 1 versus Type 2, and the audit cycle.
One well-designed control set, mapped to each framework, means you test once and report many times. Build and maintain the crosswalk.
Compare where you are with where the framework says you should be, rate the gaps, and turn them into a plan. Be honest; auditors will be.
Organise evidence, brief control owners, and run a mock audit. Most audit pain comes from disorganisation, not from missing controls.
Not every control can be met everywhere. Run a formal exception process with owners, expiry dates and compensating controls.
Pull evidence automatically from cloud, identity and HR systems, test controls continuously and flag drift. This is how compliance stops being a yearly scramble.
New laws and updated standards arrive constantly. Track them, assess impact and update controls before the deadline, not after.
PCI DSS, HIPAA, FedRAMP, CMMC and similar schemes have their own rules and assessors. Learn the ones that matter to your sector.
Report control effectiveness, open gaps, exceptions and audit findings in a way leadership can act on. Numbers beat narrative.
Compliance fails when it is imposed on engineers from outside. Express controls as code and requirements they can build and test.
Choose and run a platform for controls, evidence, risks and audits. Pick for integration and usability, not for feature lists.
Decide the frameworks, the operating model, the tooling and the reporting lines, aligned to what the business sells and where.
Boards want risk, compliance status and decisions, in a page. Learn to translate control detail into business language.
The best GRC programmes make the organisation safer, not just certified. Keep the link between controls and real risk visible to everyone.
Governance, risk and compliance is the management layer of security: deciding what the organisation must do, writing it down as policy and controls, checking it is done, and proving it to auditors, customers and regulators.
The work ranges from drafting policies and mapping controls across several frameworks to running an ISMS, preparing for certifications and automating evidence collection. It needs organisation, clear writing and enough technical understanding to know whether a control actually works.
Customers, regulators and insurers all demand evidence of security. GRC turns security work into that evidence and keeps the organisation honest about gaps. It is also one of the more accessible routes into security.
Take them in roughly this order. Costs and details for the ones marked with a link are on the Certifications page.
A common progression. Titles vary between companies.
All security roadmaps Back to top
Last reviewed: . Found a mistake, or want a roadmap written sooner? Contact