GRC Analyst Programme

GRC Analyst prepares you for a first role in governance, risk and compliance. It teaches the international standards employers everywhere name – ISO/IEC 27001, NIST CSF 2.0, SOC 2 and PCI DSS – with the rules of the UK, the EU, the US and India beside them, then builds the work a GRC analyst is handed: a risk register owners act on, a Statement of Applicability and the policies behind it, audit evidence, privacy and supplier reviews, and the monthly report. It closes with audit week – an external auditor’s requests answered on a timetable.

What you will be able to do

• Run a risk assessment with the people who own the risks, and keep a register they act on.
• Read ISO/IEC 27001 and NIST CSF 2.0 side by side, and write a Statement of Applicability and the policies behind it.
• Check the technical controls behind a policy – identity, patching, logging, cloud – through Cyber Essentials and CIS Controls.
• Collect and grade audit evidence from Microsoft 365, Azure and AWS, and help run an internal audit from plan to corrective actions.
• Handle the GRC side of a data breach and a supplier review, under UK GDPR and GDPR.
• Write the monthly GRC pack and a one-page board summary, and present them.
• Answer an external auditor’s requests on a timetable, and respond to a nonconformity.

The curriculum — 6 modules, 16 classes

1. 01

   GRC Foundations 2 classes

   How governance, risk and compliance fit together, the Three Lines Model, and policies, standards and procedures. The international frameworks employers name – ISO/IEC 27001, NIST CSF 2.0, CIS Controls, COBIT, SOC 2, PCI DSS – and the laws organisations answer to in the UK, the EU, the US and India.

2. 02

   Risk Management 3 classes

   ISO 31000, ISO/IEC 27005 and NIST SP 800-30 in practice: likelihood and impact, appetite and tolerance, the risk workshop, a register owners act on, exceptions, key risk indicators and the monthly risk report.

3. 03

   Standards & Controls 3 classes

   ISO/IEC 27001:2022 – clauses, Annex A and the Statement of Applicability – mapped to NIST CSF 2.0 and SP 800-53; policies people follow, AI use included; and the technical controls GRC staff must read, through Cyber Essentials and CIS Controls.

4. 04

   Evidence & Audit 3 classes

   What counts as evidence, sampling and workpapers, SOX general IT controls, evidence from Microsoft 365, Azure and AWS with a query as proof, and an internal audit from plan to corrective actions.

5. 05

   Privacy, Suppliers & Resilience 3 classes

   Privacy at work under UK GDPR and GDPR, and how US and Indian law differ; DPIAs and breach clocks; supplier risk, SOC 2 reports and contract clauses; business impact analysis, continuity and who reports what, when.

6. 06

   GRC in Practice 2 classes

   KPIs and KRIs, the monthly GRC pack and the board one-pager, then audit week: an external auditor’s requests on a timetable and a nonconformity to answer.

What is included

• Live, tutor-led teaching – two hours per class: 1 hour 45 minutes of teaching, then 15 minutes for your questions. Not pre-recorded video.
• Every session recorded – a missed class or a second pass over a difficult topic is never a problem.
• Working files you keep – the risk register, Statement of Applicability, policies, audit workpapers and reports you build in class, all on one fictional company, ready to talk through at interview.
• Hands-on practice – Excel and Word labs, evidence queries in our KQL lab, and live tutor demonstrations of Microsoft Purview, Azure Policy and a GRC platform.
• Assignments marked by your tutor – reviewed by a person, with written feedback. They are what the certification is assessed on.
• CV rewrite and LinkedIn optimisation – ATS-friendly and written for the roles you are applying to. £120 of separately priced work, included.
• Mock interviews – run against real GRC analyst specifications, with direct feedback afterwards.
• Job feed while you are registered – vetted openings through MyCyberWay Premium Jobs, free from joining your batch until three months after your final class.
• Verifiable certification badge – issued through Sertifier on passing the assessed work, with a unique ID and a public verification link.
• Support after you are placed – most people have questions in their first weeks in a new role, and that is when having somebody to ask is worth the most.

What is not included

• Third-party certification exam fees, such as ISO/IEC 27001 Lead Implementer or Lead Auditor, BCS CISMP, CISM or CRISC.
• Copies of the ISO standards themselves, which ISO sells – the classes teach them, and show you where to read them.
• Your own computer, Microsoft Excel and Word (or a free equivalent) and an internet connection.

Certification

To earn the MCW Certified GRC Analyst badge you attend at least 80% of classes and pass every assignment and the master assessment, each handed in by the final class. Everyone who completes the classes also receives a Certificate of Course Completion, which confirms the programme and the hours you attended. The badge is MyCyberWay’s own verifiable credential. It is not a regulated or accredited qualification, and it is not an ISO, ISACA, ISC2 or BCS certification.

Roles it prepares you for

GRC Analyst · Compliance Analyst · Risk Analyst · IT Audit Associate · Supplier (Third-Party) Risk Analyst · Junior Information Security Officer · Privacy or Data Protection Coordinator.

Paying

The price here is the full programme fee, paid at checkout (Option A in your enrolment agreement). Prefer to pay half now (£380) and the balance by class 8, or spread it over an instalment plan? Book a call and we will send you the enrolment agreement with those options instead. The per-class rate is the same whichever way you pay, and the total of £760 never changes.

What happens after you buy

1. You get an order confirmation by email Straight away.
2. We agree your start date and schedule Classes run twice a week, arranged around your job.
3. Your learning portal opens Sign in with your MyCyberWay account. Once you are in your batch, your classes, Teams links, recordings, labs and quizzes are all in the learning portal.
4. Your tutor sends the primer and your files A short primer and the working files for module one reach you before your first class.