Primary-source-grounded cybersecurity course
GRC and Compliance Fundamentals
A primary-source-grounded six-module path into governance, risk, and compliance work: NIST CSF 2.0, the Risk Management Framework, the major regulatory regimes (HIPAA, PCI DSS, SOC 2, FedRAMP, GDPR), and the GRC career ladder.
What this cybersecurity course is
GRC and Compliance Fundamentals is a 6-module cybersecurity course for analysts entering governance, risk, and compliance work or pivoting from internal audit, IT operations, or legal-adjacent roles. Every module is grounded in primary-source frameworks rather than vendor white papers. Topics cover NIST Cybersecurity Framework version 2.0 (NIST 2024), the NIST Risk Management Framework in SP 800-37 Revision 2 (Joint Task Force 2018), the canonical control catalog in NIST SP 800-53 Revision 5 (Joint Task Force 2020), the major regulatory regimes a GRC analyst will encounter (HIPAA Security Rule, PCI DSS v4.0, SOC 2 Trust Services Criteria, FedRAMP Rev. 5, EU GDPR), and how to write the working artifacts of the role: a control narrative, a risk register entry, an audit response, and a third-party risk assessment. Designed by Julian Calvo, Ed.D. in Applied Learning Sciences (University of Miami, 2026), with reference to his master's-level work in policy and program management at Barry University.
The course sequences six modules around the GRC operational lifecycle: framework selection, control implementation, risk assessment, audit, monitoring, and improvement. Each module pairs a primary-source standard with a hands-on artifact: read the standard, draft the control narrative or risk register row, mark up a sample audit response. The pedagogical pattern follows Knowles' andragogy (1970), Mezirow's transformative learning (1991), and the Dreyfus skill acquisition model (1980): adults learn GRC fastest by working real artifacts against an authoritative standard rather than by reading the standard cover-to-cover first. Every claim cites NIST, the regulatory text itself, AICPA Trust Services Criteria, BLS, ISC2, or peer-reviewed research. No vendor compliance-platform marketing.
Six modules
Target audience
- Career changers from internal audit, IT operations, or legal-adjacent work entering cybersecurity GRC
- Junior GRC analysts and compliance specialists who need a primary-source-grounded reference for the major frameworks
- Cybersecurity practitioners moving from technical roles into program management and policy
- Sales engineers at GRC platform vendors who need fluency in the regulatory regimes their software supports
- Information security officers preparing for the CISA, CISM, or CRISC examinations
Prerequisites
- Working comfort with reading standards documents (NIST SPs, ISO summaries, regulatory text)
- Basic understanding of cybersecurity terminology (firewalls, IAM, encryption-at-rest)
- Willingness to commit 8 to 10 weeks of 4 to 6 hours per week study
- Familiarity with one or more enterprise operating environments (cloud-native, on-prem, hybrid)
Related cybersecurity content
Sources
- NIST Cybersecurity Framework 2.0 (CSF v2.0) · NIST (2024). Public-domain US Government work.
- NIST SP 800-53 Rev. 5: Security and Privacy Controls · Joint Task Force (2020). Public-domain.
- NIST SP 800-37 Rev. 2: Risk Management Framework · Joint Task Force (2018). Public-domain.
- NIST SP 800-53A Rev. 4: Assessment Procedures · Joint Task Force (2014). Public-domain.
- NIST SP 800-161 Rev. 1: C-SCRM Practices · Boyens et al. (2022). Public-domain.
- HIPAA Security Rule (45 CFR Parts 160, 164) · U.S. Department of Health and Human Services.
- PCI DSS v4.0 · PCI Security Standards Council (2022).
- AICPA Trust Services Criteria (TSP 100) · American Institute of CPAs (2017).
- FedRAMP Rev. 5 Baselines Have Been Approved and Released · FedRAMP, U.S. General Services Administration (2023).
- EU GDPR (Regulation 2016/679) · European Parliament and Council (2016).
- BLS OES May 2024: Information Security Analysts (15-1212) · U.S. Bureau of Labor Statistics.
- ISC2 Cybersecurity Workforce Study 2024 · Workforce gap and compensation by tier and region.
Disclaimer
This course is for educational purposes only. It does not constitute legal advice, regulatory interpretation, or a substitute for engagement with a qualified compliance counsel, certified public accountant, or licensed information security auditor. Regulatory text changes; readers should consult primary sources for currency. NIST and US Government materials are public works. ISO/IEC standards referenced here are summarized for educational purposes; readers must purchase the standards from ISO for working use. PCI DSS is a trademark of the PCI Security Standards Council; SOC 2 is a trademark of the AICPA; HIPAA is administered by the US Department of Health and Human Services; FedRAMP is administered by the US General Services Administration. DecipherU is not affiliated with any standards body or regulatory agency.
Practice exams for this course
- ISC2 Certified in Cybersecurity (CC)Scenario practice for the ISC2 Certified in Cybersecurity (CC) exam, one domain at a time, with the primary source cited after every answer.
- ISC2 CISSPScenario practice for the ISC2 CISSP exam, one domain at a time, with the primary source cited after every answer.
- ISACA CISMScenario practice for the ISACA CISM exam, one domain at a time, with the primary source cited after every answer.
This course is part of a packaged path
Or see the full packaged path that uses this course
Each path bundles the curriculum sequence, the pay change it leads to, and the recommended courses (this one is on the list). If you are not sure which path matches your starting point, the 2-minute AI Risk Score routes you to the right one.
Course content is for educational purposes only and does not constitute professional advice. Where a lesson states a fact, it names its source, and not every source is a peer-reviewed study. Verify the sources independently.