GRC Analyst Programme

What you will be able to do

• Run a risk assessment with the people who own the risks, and keep a register they act on.
• Read ISO/IEC 27001 and NIST CSF 2.0 side by side, and write a Statement of Applicability and the policies behind it.
• Check the technical controls behind a policy – identity, patching, logging, cloud – through Cyber Essentials and CIS Controls.
• Collect and grade audit evidence from Microsoft 365, Azure and AWS, and help run an internal audit from plan to corrective actions.
• Handle the GRC side of a data breach and a supplier review, under UK GDPR and GDPR.
• Write the monthly GRC pack and a one-page board summary, and present them.

The curriculum – 6 modules, 16 classes

1. 01GRC Foundations

   How governance, risk and compliance fit together, the Three Lines Model, and policies, standards and procedures. The international frameworks employers name – ISO/IEC 27001, NIST CSF 2.0, CIS Controls, COBIT, SOC 2, PCI DSS – and the laws organisations answer to in the UK, the EU, the US and India.

2. 02Risk Management

   ISO 31000, ISO/IEC 27005 and NIST SP 800-30 in practice: likelihood and impact, appetite and tolerance, the risk workshop, a register owners act on, exceptions, key risk indicators and the monthly risk report.

3. 03Standards & Controls

   ISO/IEC 27001:2022 – clauses, Annex A and the Statement of Applicability – mapped to NIST CSF 2.0 and SP 800-53; policies people follow, AI use included; and the technical controls GRC staff must read, through Cyber Essentials and CIS Controls.

4. 04Evidence & Audit

   What counts as evidence, sampling and workpapers, SOX general IT controls, evidence from Microsoft 365, Azure and AWS with a query as proof, and an internal audit from plan to corrective actions.

5. 05Privacy, Suppliers & Resilience

   Privacy at work under UK GDPR and GDPR, and how US and Indian law differ; DPIAs and breach clocks; supplier risk, SOC 2 reports and contract clauses; business impact analysis, continuity and who reports what, when.

6. 06GRC in Practice

   KPIs and KRIs, the monthly GRC pack and the board one-pager, then audit week: an external auditor’s requests on a timetable and a nonconformity to answer.

Every module, class by class, on the programme page

What is included

• Live, tutor-led teaching
• Every session recorded
• Working files you keep
• Hands-on practice
• Assignments marked by your tutor
• CV rewrite and LinkedIn optimisation
• Mock interviews
• Job feed while you are registered
• Verifiable certification badge
• Support after you are placed

What is not included

• Third-party certification exam fees, such as ISO/IEC 27001 Lead Implementer or Lead Auditor, BCS CISMP, CISM or CRISC.
• Copies of the ISO standards themselves, which ISO sells – the classes teach them, and show you where to read them.
• Your own computer, Microsoft Excel and Word (or a free equivalent) and an internet connection.

Certification

To earn the MCW Certified GRC Analyst badge you attend at least 80% of classes and pass every assignment and the master assessment, each handed in by the final class. Everyone who completes the classes also receives a Certificate of Course Completion, which confirms the programme and the hours you attended. The badge is MyCyberWay’s own verifiable credential. It is not a regulated or accredited qualification, and it is not an ISO, ISACA, ISC2 or BCS certification.

Paying

The price here is the full programme fee, paid in full at checkout. To spread the cost, choose PayPal at checkout: PayPal may offer Pay Later, subject to its own checks.

What happens after you buy

1. You get an order confirmation by emailStraight away.
2. We agree your start date and scheduleClasses run twice a week, arranged around your job.
3. Your learning portal opensSign in with your MyCyberWay account. Once you are in your batch, your classes, Teams links, recordings, labs and quizzes are all in the learning portal.
4. Your tutor sends the primer and your filesA short primer and the working files for module one reach you before your first class.

We do not guarantee employment, a particular salary, or a pass in any third-party exam. Outcomes depend on your own effort, your background and the job market – what we can promise is the teaching, the feedback and the support described above.