Cybersecurity Governance, Risk & Compliance (GRC) in Practice: Assess Risk, Map Controls and Stand Up to Audit
Signature Course No. 395 — A Signature AI Socratic Coaching Course.
No experience needed — your coach starts where you are.
A New Kind of Learning
Socratic coaching, delivered by an agentic AI coach.
Not a course you watch. An AI coach you work with.
The Lighthouse Coach begins by discovering how you think about the subject, teaches what is missing, and gives you realistic practice before asking you to prove that you can use it. You may test out of concepts you already understand, while capstones turn the learning into a practical plan, decision, conversation, or other real-world result.
The curriculum is deliberately authored; the AI delivers it through coaching. It is not an AI randomly generating lessons.
A coach that teaches by asking — not by lecturing
The Lighthouse Coach is an AI Socratic coach built on Cognosco Learning's Cybersecurity Governance, Risk & Compliance (GRC) in Practice: Assess Risk, Map Controls and Stand Up to Audit course, in the Risk, Safety & Compliance category. It does not play videos at you. It holds a conversation: it asks you a question, listens to your answer, names the misconception it hears, affirms what you got right, and asks the next question — the way a great coach works in the room.
Every organization already has a security program. The question is whether anyone can describe it, defend its choices, and prove it works. This course teaches the program layer of cybersecurity: the governance that decides who owns security decisions and how they get made; the risk work that finds what could hurt the organization, puts honest numbers beside it, records it in a register, and forces a decision — treat it, transfer it, avoid it, or accept it in writing; the control work that turns those decisions into safeguards chosen on purpose and mapped, control by control, to the frameworks the organization answers to; and the assurance work that keeps the proof ready.
It starts with governance and accountability. When a security decision has to be made, who makes it, on what authority, and where is that written down? Everything else in the course — risk scores, registers, controls, audits — assumes that answer exists. You will build the four parts of a working structure: an accountable executive, a decision body, a written charter, and an escalation path — and learn the two failure shapes, diffusion and shadow authority, that account for most governance trouble.
It works in two movements. First, Module 1 — Governing and Assessing the Program — work through Concepts 1–9, finishing with The Governed Risk Assessment; then, Module 2 — Mapping, Proving, and Reporting It — work through Concepts 10–18, finishing with The Audit-Readiness Pack.
Both capstones produce real artifacts — a governed risk assessment and register extract for Calverton Foods' subscription launch, fit to hand to the security council: the governance record and scope sentence, risks assessed in words and in money, and decisions put to the council with authorities and dates; and an audit-readiness and assurance pack for the same program — its crosswalk, evidence plan, vendor review, and board report — defended in writing.
The honesty standard is part of the course. No framework guarantees anything: adopting a framework, passing an audit, or holding an attestation does not make an organization secure, and this course never promises a certification or attestation outcome — it teaches you to refuse that promise wherever you meet it. And this course is not legal advice: regulation content is principle-level, written so you can map obligations to controls and talk to counsel with your facts organized.
The course is self-paced and always on — roughly 30 minutes per concept, about 9 hours in full, taken in as many sittings as you like. You can type your answers, or talk out loud: the Voice Coach speaks its questions and listens to your spoken replies. Learners who already know the material can test out concept by concept.
Cybersecurity Governance, Risk & Compliance (GRC) in Practice: Assess Risk, Map Controls and Stand Up to Audit is part of The Lighthouse Signature Series — the online counterpart to the one-day, in-person learning Cognosco Learning has delivered since 2002.
Course Facts
One full concept, coached end to end — free: verify your email and we’ll send you a link to start.
Already enrolled? Enter the course →
Diagnose → Learn & Practice → Prove → Capstone
Every learner moves through the same discipline a Cognosco instructor would insist on in the room.
Diagnose
The Coach starts where the course starts: with who owns security decisions. Think of the most recent real security decision in your organization — who actually decided it, and is that the person the written structure says should have? If a high risk had to be accepted tonight, whose signature would it carry, and where would that signature be filed? Every concept opens with three questions that locate where you actually stand, and your answers shape how deeply the Coach works the concept with you. Everyone begins with Module 1 — no skipping the foundations you only think you have.
Learn & Practice
Work each concept in conversation with the Coach — spoken or written — then practice it against realistic situations until it holds up.
Prove
Every concept ends in proof: answer the check cold and demonstrate the skill. Know it already? Test out and take credit immediately.
Capstone
Finish with two capstones — The Governed Risk Assessment for Module 1 and The Audit-Readiness Pack for Module 2 — that pull the whole course together, and earn the certificate.
What You'll Learn
One organization, one set of facts. Calverton Foods — a fictional food maker and distributor with three plants, 1,400 people, a four-person security team, 186 in-scope items, 42 third parties, 38 open risks, and a 64-control library — is introduced in full in Concept 2 and never quietly changes. Every risk score, register entry, and crosswalk row in the course is built from those facts, so you can recompute each one yourself.
Module 1 governs and assesses. Governance and Accountability; The Running Organization; Policy That Governs; Know What You Have; Risk Thinking; Risk Arithmetic; The Risk Register; Treat or Accept; and Controls and Frameworks — the decisions first, then the risk work in words and in money, recorded so decisions happen.
Module 2 maps, proves, and reports. Framework Mapping; Evidence and Audit Readiness; Internal Review; Third-Party Risk; People and Access Governance; Change and Vulnerability Governance; Incident Governance; Metrics, Reporting, and the Board; and The GRC Professional's Standard — Module 1's decisions turned into proof that would still stand if the person who wrote it left tomorrow.
And it holds its boundary throughout. This course owns the security program layer — governance, risk, controls, and proof. It does not teach technical analyst craft, any single regulation's deep rules, or a senior credential's exam blueprint; regulations appear at framework-mapping level only, and the only incident content is incident governance: who declares, who decides, and what gets written down.
What you will learn
- Govern a security program: name who decides, set policy that governs real behavior, and define the scope everything else stands on
- Assess risk end to end: identify assets and threats, judge likelihood and impact, and put honest numbers beside the risks that carry a price
- Run a risk register that drives decisions: score consistently, assign owners, record treatments, and handle exceptions and acceptances in writing
- Select controls and map them across frameworks — NIST Cybersecurity Framework 2.0, ISO/IEC 27001, and SOC 2 — so one control can satisfy many obligations
- Stand up to audit: build evidence as a habit, test your own controls first, hold vendors to your standard, and govern incidents and change at the decision layer
- Report the program truthfully: measure what matters, tell leadership what the numbers mean, and hold the professional standard when pressure pushes the other way
Everything in the course
- All 18 concepts of Cybersecurity Governance, Risk & Compliance (GRC) in Practice: Assess Risk, Map Controls and Stand Up to Audit, in 2 modules
- A starting-point check first — the Coach finds where you actually stand before teaching
- Learn, Practice, Prove for every concept — no passive video watching
- A test-out on every concept: prove you know it and move on
- The Voice Coach: talk with the Coach out loud — it speaks, listens, and replies
- A personal Learner Record of your work across the course
- Two capstone exercises: The Governed Risk Assessment and The Audit-Readiness Pack
- A printable session summary whenever you pause
- The Lighthouse Coach completion certificate (Signature Series)
- Your progress is saved as you go — stop anytime, resume where you left off
Built for the people who run the program layer
GRC analysts — who run assessments, maintain registers, gather evidence, and need the whole method, not a pile of templates; and security compliance staff — who map controls to frameworks and prepare for audits, attestations, and customer questionnaires.
Risk and security managers — who own the program, report to leadership, and sign for the decisions this course teaches you to make explicit.
Internal reviewers and audit liaisons — who test controls from inside and need to know what good evidence and a fair finding look like. This course assumes you work around security already — you know what a firewall, an account, and a backup are. It does not assume you can configure any of them, and it never asks you to.
Prefer to learn live and in person? The same material anchors Cognosco's one-day programs — browse the in-person catalog.
Start with Governance and Accountability
$195 — introductory price. One payment. No subscription, no password to manage.
Here is exactly what happens when you enroll:
- Pay securely with Stripe — you are taken straight into the course
- Create your learner profile and begin the Module 1 starting-point check
- Save the access key you are given — it restores your enrollment on any device
- Learn at your pace; your progress is stored in your browser on your device
For the full voice experience, use Chrome and allow the microphone when asked. Typing your answers works everywhere, all the time. Questions before you enroll? Email hello@cognoscolearning.com.
Before you enroll
What is a Socratic coaching session?
A conversation, not a video. Your coach asks a question; you answer — out loud by voice, or by typing — and the coach responds to what you said: naming the misconception it hears, affirming what you got right, and asking the next question. You advance only when you have mastered each concept, so a finished course means the learning held.
How long does it take — and how long do I have?
About 30 minutes per concept. Learn in sittings of any length; your progress is saved as you go. You have a full year from purchase to finish, and you can revisit and retake within that year.
What does the certificate verify?
That you completed every concept and both capstones of this course. Anyone can confirm a Cognosco certificate online — enter its certificate ID on our verification page.
What if it isn't for me — what are the refunds?
If you have not started, cancel for a full refund within seven days of purchase. Once you have started, there is no cash refund — stop before finishing and we credit the full amount you paid toward any other course in the library (credit valid one year from your original purchase). Once you complete the course, no refund or credit applies.
More Signature Courses are coming
Cybersecurity Governance, Risk & Compliance (GRC) in Practice: Assess Risk, Map Controls and Stand Up to Audit is Signature Course No. 395. Leave your email and we'll send you news of future Signature Courses and Lighthouse updates as they are announced — nothing else.