Welcome to the GRC Labs repository. This project was created as a personal portfolio to showcase my knowledge, practical understanding, and hands-on experience with various major Governance, Risk, and Compliance (GRC) frameworks.
It serves as a comprehensive collection of simulated audit scenarios, risk assessments, and compliance documentation templates designed to demonstrate proficiency in navigating complex regulatory landscapes and translating theoretical security standards into actionable processes.
The primary goal of this repository is to illustrate a deep understanding of how security controls are mapped, audited, and automated across different compliance regimes. It provides concrete examples of executing readiness assessments, determining compliance scope, and formalizing risk management.
This repository covers multiple major industry standards and compliance frameworks. Each directory contains specific scenarios and exercises:
01-pci-dss-network-segmentation: Scenarios related to the Payment Card Industry Data Security Standard (PCI DSS) and how network segmentation applies to compliance scope.02-iso27001-statement-of-applicability: Focuses on ISO 27001 and the Statement of Applicability (SoA) for implementing information security controls.03-eu-ai-act-high-risk-assessment: Exercises and assessments for high-risk AI systems in accordance with the European Union Artificial Intelligence Act.04-grc-control-automation: Explores the automation of GRC controls and continuous compliance monitoring.05-risk-acceptance-documentation: Documentation and formal processes for identifying and accepting business or security risks.06-nist-csf-audit-scenario: An audit scenario based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF).07-soc2-compliance-audit-scenario: An audit scenario relating to System and Organization Controls (SOC 2) Type 2 readiness and compliance.
Navigate to any of the directories above to find markdown files detailing the specific scenarios, audit requirements, or documentation templates for that topic.