mentorshipgrcformeremortalscom https://mentorship.grcformeremortals.com Mon, 03 Aug 2026 21:13:44 +0000 en-US hourly 1 https://wordpress.org/?v=7.1.2 https://mentorship.grcformeremortals.com/30-2/ https://mentorship.grcformeremortals.com/30-2/#respond Mon, 03 Aug 2026 21:13:44 +0000 https://mentorship.grcformeremortals.com/?p=30




Phase 1 Workbook — GRC For Mere Mortals


GRC For Mere Mortals · Phase 1 Workbook

Build the Program — Fill It In Yourself

Same structure as the lecture, blank. Work through Days 1–5 in order — each day builds on what you filled in the day before, so don’t skip ahead.
Your answers stay in this page while it’s open. Export before you close the tab.

Day 1Business & Regulatory Requirements
Establish what your system needs to do, and what law says it must do.

Business Requirements

One requirement per row. Keep each one to a single, specific need.
ID Business Description

Regulatory Requirements

Cite the specific rule or article — not just the regulation’s name.
ID Regulation Requirement Description

Requirements Mapping

Pick at least 3 pairs — one business requirement, one regulatory requirement — and name the security requirement that would satisfy both.
Business ID Regulatory ID Security Requirement This Points To

Day 2Security Requirements
Translate what the law/business needs into what security must actually do about it.

Security Requirements Table

Trace every row back to the business/regulatory IDs from Day 1.
Sec. ID Security Requirement Business ID Regulatory ID NIST CSF Ref

Day 3Risk Assessment — Identification
Find out what could actually go wrong. Identify and score — don’t mitigate yet, that’s tomorrow.

Risk Register — Identification

Risk ID Risk Statement Threat Source Vulnerability Likelihood Impact

Day 4Risk Mitigations
Decide what to actually do about each risk you identified yesterday.

Risk Register — Treatment Plans

Reuse the Risk IDs from Day 3.
Risk ID Mitigation Strategy Priority Control Mapping Owner

Day 5Defense in Depth
Design the layered architecture that actually enforces everything you’ve decided so far.

Security Architecture Layers

For each layer, list the specific controls or tools that belong there for your system.
GRC

IAM

Security Ops

Endpoint

Application

Data

Compliance Crosswalk

Confirm your architecture actually covers what Day 1’s regulatory requirements demanded.
NIST CSF Subcategory Regulatory Ref Met? Notes
Phase 1 Workbook — GRC For Mere Mortals. Export your answers before closing this tab.


]]> https://mentorship.grcformeremortals.com/30-2/feed/ 0 Hello world! https://mentorship.grcformeremortals.com/hello-world/ https://mentorship.grcformeremortals.com/hello-world/#comments Mon, 03 Aug 2026 15:32:54 +0000 https://mentorship.grcformeremortals.com/?p=1 Welcome to WordPress. This is your first post. Edit or delete it, then start writing!

]]> https://mentorship.grcformeremortals.com/hello-world/feed/ 1