GRC programmes
Two live programmes in governance, risk and compliance: the world’s standards first, then how the UK, the EU, the US, India and the Gulf apply them.
- Programmes2
- Live classes16 each
- WhenTwo classes a week
- StandardsGlobal first
- BadgesVerifiable
Which one is me?
Pick the line that fits. You get a straight answer, even if it is “not yet”.
Our recommendation
GRC Analyst
GRC Analyst, and no, you are not behind. No GRC or security experience is needed.
- Level
- Entry
- Live classes
- 16
- Fee
- £760
Our recommendation
GRC Analyst
Your experience makes it fast, and you leave with the standards, the method and a portfolio.
- Level
- Entry
- Live classes
- 16
- Fee
- £760
Our recommendation
GRC Specialist
Take its thirty-second self-check on the GRC Specialist page: six of eight and you are ready.
- Level
- Experienced
- Live classes
- 16
- Fee
- £1,000
Analyst, then Specialist
GRC Analyst for a first role in GRC, and GRC Specialist for people already in it who want the consultant or engineer route.
Entry
GRC Analyst
For a first role in governance, risk and compliance.
16 live classes
Experienced
GRC Specialist
For the consultant or engineer route in GRC.
16 live classes
International standards first, regional rules beside them
The same method works in London, Dublin, New York, Pune or Dubai.
International
The standards employers everywhere name. Taught first, in every module.
ISO/IEC 27001 and 27002, ISO/IEC 27005 and ISO 31000, ISO 22301, ISO/IEC 27701, ISO/IEC 42001, NIST CSF 2.0, NIST SP 800-53, NIST AI RMF, CIS Controls, COBIT 2019, SOC 2, PCI DSS v4.0.1, Open FAIR, CSA STAR
Both programmes
United Kingdom
In full detail, beside the international standard in every module.
UK GDPR and the DPA 2018, Data (Use and Access) Act 2025, NIS Regulations and NCSC CAF, Cyber Security and Resilience Bill, Cyber Essentials and Plus, FCA and PRA operational resilience, Cyber Governance Code of Practice
Both programmes
European Union
For firms with EU customers or offices, and for EU roles.
GDPR, NIS2, DORA, EU AI Act, Cyber Resilience Act
Analyst: GDPR, NIS2, DORA, Specialist: all
United States
The rules US-owned employers and US audit teams work to.
SOX IT general controls, HIPAA, State privacy laws, SEC cyber disclosure, NYDFS Part 500, CMMC and FedRAMP
Analyst: SOX, HIPAA, state privacy, Specialist: all
India and Asia-Pacific
Read with the same method, as worked examples.
India DPDP Act, Singapore MAS TRM, Australia Essential Eight, APRA CPS 234
Analyst: India DPDP, Specialist: all
The Gulf
Worked examples for regional roles.
Saudi NCA ECC, UAE Information Assurance standard
GRC Specialist
The programmes side by side
Every row is a real difference.
| Compared | GRC Analyst | GRC Specialist |
|---|---|---|
| Level | Entry | Experienced, consultant and engineer level |
| You’re ready if… | You are new to GRC – from IT, a SOC, audit, finance, law or university | You have about two years in GRC, audit, risk or compliance – or the GRC Analyst badge |
| The core skill | Keeping the register, the policies and the evidence in order | Designing the programme, putting risk in money, leading audits, automating evidence |
| Standards | ISO/IEC 27001 and 27005, NIST CSF 2.0 and SP 800-53, CIS Controls, Cyber Essentials, UK GDPR and GDPR, SOC 2 reports, ISO 22301 | The same, plus COBIT 2019, ISO/IEC 27014, 27701 and 42001, Open FAIR, PCI DSS, NCSC CAF, NIS2, DORA and OSCAL |
| Finishes with | Audit week – an auditor’s requests on a timetable | A capstone on the consultant or engineer route, to a panel |
| Classes | 16, 32 hours | 16, 32 hours |
| Job titles | GRC Analyst, Compliance Analyst, Risk Analyst, IT Audit Associate | Senior GRC Analyst, GRC Consultant, Lead Auditor, Security Risk Manager, GRC Engineer |
Our badges are earned, not issued on attendance
Each badge needs the assessed work passed. Everyone who completes the classes also gets a Certificate of Course Completion.
GRC Analyst
Every assignment, the master assessment and audit week
GRC Specialist
Every assignment and the capstone: 14 of 20 on the rubric
Priced by the class
Nothing hidden: the class rate times the classes, plus your CV rewrite and LinkedIn optimisation. Half now and half midway, or an instalment plan: ask us.
GRC Analyst
£760in total
16 classes × £40, plus your CV rewrite and LinkedIn optimisation (£120).
GRC Specialist
£1,000in total
16 classes × £55, plus your CV rewrite and LinkedIn optimisation (£120).
Questions people ask first
Anything else, ask us. A person replies.
Blue team or GRC – which is for me?
Blue team is hands-on defence: alerts, investigations, building the controls. GRC is how a company decides, proves and reports what it does about risk: the register, the standards, the evidence, the audit and the board. If you like the technical work, start with a blue team programme; if you like policy, people and evidence, start here. Plenty of GRC roles want someone who understands both.
Do I need experience?
Not for GRC Analyst: it is built for people new to GRC. GRC Specialist expects about two years in GRC, audit, risk or compliance – or the GRC Analyst badge – and has a thirty-second self-check on its page.
Is it tied to one country’s rules?
No. Every module teaches the international standard first – ISO/IEC 27001, NIST, SOC 2, PCI DSS – then the UK rules, then how the EU, the US, India and the Gulf differ. The method works with any rulebook, so the skills go wherever you work.
Is GRC technical?
Partly. GRC teams read identity, patching, logging and cloud controls, and nearly a fifth of GRC adverts ask for that – so GRC Analyst teaches them from the ground up. GRC Specialist adds GRC engineering: controls as checks that run on their own.
Do the programmes include an exam?
No. GRC Analyst covers much of the ground of BCS CISMP, ISO/IEC 27001 Foundation and ISC2 CC; GRC Specialist covers ground that CISM, CRISC, CISA and the ISO/IEC 27001 Lead Implementer and Lead Auditor courses also cover. Exams are booked and paid separately – we teach the job, not the exam.
Do you guarantee a job?
No, and be cautious of anyone who does. What is included is a rewritten CV, an optimised LinkedIn profile, mock interviews against real role specifications, Premium Jobs from joining your batch until three months after your final class, and a private job group. Outcomes depend on your effort, your background and the market.
How do I get into my course after I enrol?
Your MyCyberWay account is created when you check out, and it is also your sign-in to the learning portal. Once we have agreed your start date and schedule and placed you in your batch, your classes, recordings, working files, quizzes and calendar are all there.
Can my employer pay?
Yes. Tell us and we will invoice your organisation. Business customers buy on our business terms (section 15 of our Terms and Conditions).
Not sure which GRC programme fits?
Book a free 20-minute call. We will tell you honestly which programme fits, even if it is none of them yet.