CGRC Readiness: The Governance, Risk and Compliance Professional
Signature Course No. 513 — A Signature AI Socratic Coaching Course.
For governance, risk, and compliance professionals — your coach starts where you actually stand.
A New Kind of Learning
Socratic coaching, delivered by an agentic AI coach.
Not a course you watch. An AI coach you work with.
The Lighthouse Coach begins by discovering how you think about the subject, teaches what is missing, and gives you realistic practice before asking you to prove that you can use it. You may test out of concepts you already understand, while capstones turn the learning into a practical plan, decision, conversation, or other real-world result.
The curriculum is deliberately authored; the AI delivers it through coaching. It is not an AI randomly generating lessons.
A coach that teaches by asking — not by lecturing
The Lighthouse Coach is an AI Socratic coach built on Cognosco Learning's CGRC Readiness: The Governance, Risk and Compliance Professional course, in the Risk, Safety & Compliance category. It does not play videos at you. It holds a conversation: it asks you a question, listens to your answer, names the misconception it hears, affirms what you got right, and asks the next question — the way a great coach works in the room.
An authorization is not a property a system has. It is a decision an official makes, on evidence, inside a programme — and every step before the signature exists to make that decision defensible. The clerk asks whether the paperwork is complete; the professional asks what risk remains, who is accepting it, and on what evidence. This course builds the second person: the judgment the CGRC examination samples, taught in the order the Risk Management Framework itself runs.
It starts with the programme. Before any boundary is drawn or any control is chosen, the organization has already decided how much risk it will tolerate, in service of what mission, with what common controls available to every system it runs. So the course begins above the system — tolerance, strategy, and common controls — then draws the boundary, prices the loss by the high-water mark, selects and tailors the baseline with privacy as a first-class citizen, implements and documents, assesses, decides, and monitors.
It works in two movements. First, Module 1 — The Framework in Order: From Programme to Decision — work through Concepts 1–9, finishing with The First-Authorization Plan; then, Module 2 — The Professional Altitude: Evidence, Decision, and the Examination — work through Concepts 10–18, finishing with The Readiness Dossier.
Both capstones produce real artifacts — a first-authorization plan for the running case: Dana Reyes bringing the Virelai Group's shipment platform, Virelai Track, to its first authorization decision — programme framing, boundary, categorization, selection, an assessment plan with its findings predicted, and the decision brief her authorizing official can sign without asking what was left out; and a readiness dossier on the same platform a season later — controls re-read at assessor depth, evidence priced, the package reconciled, the re-decision made, and the professional's own examination readiness audited by the same standard.
The honesty standard is part of the course. Readiness is not a guarantee. This book prepares your judgment for the examination; it does not promise you will pass, and no honest readiness book can. Version-specific particulars — domain weights, item counts, eligibility and endorsement mechanics — are fenced in the book's Appendix, dated and labeled, to be verified against the credential body's current guidance before you book. Every case in the course is stipulated for teaching, printed once, and used consistently throughout.
The course is self-paced and always on — roughly 30 minutes per concept, about 9 hours in full, taken in as many sittings as you like. You can type your answers, or talk out loud: the Voice Coach speaks its questions and listens to your spoken replies. Learners who already work an area well can test out concept by concept — the bar does not drop; the route just gets shorter.
CGRC Readiness: The Governance, Risk and Compliance Professional is part of The Lighthouse Signature Series — the online counterpart to the one-day, in-person learning Cognosco Learning delivers.
Course Facts
One full concept, coached end to end — free: verify your email and we’ll send you a link to start.
Already enrolled? Enter the course →
Diagnose → Learn & Practice → Prove → Capstone
Every learner moves through the same discipline a Cognosco instructor would insist on in the room.
Diagnose
The Coach starts where the course starts: with your own programme. Say where risk tolerance is actually stated in your work — a document you could cite, a person's habits you could describe, or nowhere you could point to; name one control your systems inherit from a shared provider, when it was last assessed, and whether you would know if it had failed; and recall a past decision justified as "within our risk appetite" and say whether the appetite was written down before the decision, or described afterward to fit it. Every concept opens with three questions that locate where you actually stand, and your answers shape how deeply the Coach works the concept with you. Everyone begins with Module 1 — no skipping the foundations you only think you have.
Learn & Practice
Work each concept in conversation with the Coach — spoken or written — then practice it against realistic situations until it holds up.
Prove
Every concept ends in proof: answer the check cold and demonstrate the skill. Know it already? Test out and take credit immediately.
Capstone
Finish with two capstones — The First-Authorization Plan for Module 1 and The Readiness Dossier for Module 2 — that pull the whole course together, and earn the certificate.
What You'll Learn
Move, order, role — in that sequence, every time. The examination rewards the move the framework requires, in the order the framework requires it, made by the role the framework assigns it to. Learn to see those three things in any fact pattern — move, order, role — and the syllabus stops being a mountain of material and becomes one discipline, applied eighteen ways.
Module 1 runs the framework in its own order. The Programme Comes First; The Boundary Is the Promise; Categorize by Impact; Select, Then Tailor; Privacy Is Not an Annex; Implementation Is a Claim You Must Be Able to Show; Assessment Turns Claims into Findings; Authorization Is a Risk Decision, Not a Stamp; and Authorization Is a Lease, Not a Deed.
Module 2 raises the altitude. Read a Control Like an Assessor; Tailoring Without Breaking the Baseline; Evidence Is Judged, Not Collected; Write Findings in Risk Language; The Package Must Agree with Itself; No One Grades Their Own Work; Inherited Is Not the Same as Handled; Significant Change Reopens the Decision; and Sit the Exam Like a Professional.
And it holds its boundary throughout. This course assumes you already work, or have worked, around information systems and their controls. It is a readiness course, not an introduction to security: it defines every framework term it uses, but it does not pause to teach what a firewall is. If your ground is the day-to-day running of a compliance programme, the library's GRC practice course is the better first seat; this one begins where that one ends.
What you will learn
- Frame any authorization inside the organization's risk management programme — its tolerance, its strategy, and its common controls — before touching the system itself
- Draw and defend a system scope and authorization boundary, naming every interconnection and dependency outside it, and categorize by impact using the high-water-mark rule, for security and privacy together
- Select controls from the correct baseline and tailor them — overlays, scoping, and compensating controls — without breaking the claim the baseline makes
- Implement and document controls so the evidence an assessor needs exists, is findable, and says what is actually true; plan and read an assessment at its true severity
- Build the authorization decision honestly — residual risk named, weaknesses scheduled, and acceptance owned by the role accountable for it — and keep the package coherent and its roles separated
- Run continuous monitoring that keeps an authorization alive, judge inherited controls and significant change, and sit the examination as a professional: governing move, framework order, assigned role
Everything in the course
- All 18 concepts of CGRC Readiness: The Governance, Risk and Compliance Professional, in 2 modules
- A starting-point check first — the Coach finds where you actually stand before teaching
- Learn, Practice, Prove for every concept — no passive video watching
- A test-out on every concept: prove you know it and move on
- The Voice Coach: talk with the Coach out loud — it speaks, listens, and replies
- A personal Learner Record of your work across the course
- Two capstone exercises: The First-Authorization Plan and The Readiness Dossier
- A printable session summary whenever you pause
- The Lighthouse Coach completion certificate (Signature Series)
- Your progress is saved as you go — stop anytime, resume where you left off
Built for professionals who authorize, assess, and defend
Governance, risk, and compliance professionals preparing to sit the CGRC examination — who have real workplace exposure to security or compliance work and now need the examination's frame around that experience; and security control assessors, system owners, and authorization staff in federal, contractor, and regulated environments who work inside the Risk Management Framework and want the credential that certifies that work.
Experienced practitioners moving up a rung — you can run compliance work; the examination asks you to reason about it at programme and decision level, and this course makes that step deliberately.
Career changers with adjacent depth — auditors, risk analysts, and privacy professionals whose work touches authorization and who are preparing to meet the credential's experience expectations honestly, with the book's Appendix stating plainly what it can and cannot do about eligibility.
Prefer to learn live and in person? The same material anchors Cognosco's one-day programs — browse the in-person catalog.
Start with The Programme Comes First
$195 — introductory price. One payment. No subscription, no password to manage.
Here is exactly what happens when you enroll:
- Pay securely with Stripe — you are taken straight into the course
- Create your learner profile and begin the Module 1 starting-point check
- Save the access key you are given — it restores your enrollment on any device
- Learn at your pace; your progress is stored in your browser on your device
For the full voice experience, use Chrome and allow the microphone when asked. Typing your answers works everywhere, all the time. Questions before you enroll? Email hello@cognoscolearning.com.
Before you enroll
What is a Socratic coaching session?
A conversation, not a video. Your coach asks a question; you answer — out loud by voice, or by typing — and the coach responds to what you said: naming the misconception it hears, affirming what you got right, and asking the next question. You advance only when you have mastered each concept, so a finished course means the learning held.
How long does it take — and how long do I have?
About 30 minutes per concept. Learn in sittings of any length; your progress is saved as you go. You have a full year from purchase to finish, and you can revisit and retake within that year.
What does the certificate verify?
That you completed every concept and both capstones of this course. Anyone can confirm a Cognosco certificate online — enter its certificate ID on our verification page.
What if it isn't for me — what are the refunds?
If you have not started, cancel for a full refund within seven days of purchase. Once you have started, there is no cash refund — stop before finishing and we credit the full amount you paid toward any other course in the library (credit valid one year from your original purchase). Once you complete the course, no refund or credit applies.
More Signature Courses are coming
CGRC Readiness: The Governance, Risk and Compliance Professional is Signature Course No. 513. Leave your email and we'll send you news of future Signature Courses and Lighthouse updates as they are announced — nothing else.