🎯 Key Takeaways for quick navigation:

00:00 🎯 Gerald Auger introduces the topic of GRC (Governance, Risk, and Compliance) in cybersecurity and aims to answer questions about it in the video.
01:11 🏢 GRC (Governance, Risk, and Compliance) is a crucial aspect of cybersecurity and offers a great career path, allowing professionals to engage with the business side of an organization.
05:48 📜 Compliance Analysts focus on checking whether specific controls are in place, while Risk Analysts assess the likelihood and impact of potential risks, enabling a smooth career progression in the GRC field.
08:42 🧩 GRC fits into an organization under the CISO, handling governance, policy, procedures, and audit aspects, while Security Operations (SecOps) handles incident response and blue team functions.
10:47 🌟 Entry-level GRC roles, like Compliance Analyst positions, are a great on-ramp into cybersecurity, especially for individuals without an IT background. Federal IT contractors often offer entry-level GRC positions and are open to training candidates.
19:41 💼 CMMC (Cybersecurity Maturity Model Certification) is becoming crucial for organizations working with the government, and being certified or familiar with it can be a valuable skill for cybersecurity professionals.
21:05 🎓 Recommended certifications for GRC Analysts include CISA (Certified Information Systems Auditor) and HIPAA-related certifications.
22:01 🛡️ GRC roles require some basic technical knowledge, such as understanding networking and operating systems, to ensure effective audits and assessments.
23:24 📚 NIST (National Institute of Standards and Technology) Cybersecurity Framework is a great starting point for learning GRC standards and best practices.
24:22 💼 Practical Enterprise Risk Assessment course by the speaker is a resource for learning compliance auditing and risk assessment in GRC.
25:51 📝 Excellent written and verbal communication skills are essential for GRC Analysts to effectively communicate with the organization and information security teams.
29:51 💡 NIST CSF (Cybersecurity Framework) and ISO 27001 are recommended standards for GRC, with CSF having more community collaboration and industry practice behind it.
30:06 🔀 CMMC (Cybersecurity Maturity Model Certification) is a subset of controls within NIST CSF, and compliance with CSF would cover the requirements of CMMC.
34:10 📚 NIST Special Publications 800 series provides comprehensive documentation on various cybersecurity topics, including risk assessments and supply chain risk management.
39:03 🗣 Effective communication skills are critical for GRC Analysts to bridge the gap between information security and the organization's business needs.
41:48 ☁️ Cloud security and identity and access management are in-demand areas within cybersecurity, making certifications in these fields valuable for GRC-focused roles.
42:31 📑 GRC (Governance, Risk, and Compliance) is a great entry point into cybersecurity and offers an easier on-ramp.
43:12 🎓 Recommended certifications for GRC include CMMC certified practitioner, ISACA CISA, and industry-specific compliance certifications.
43:41 🚀 GRC roles do not require a minimum certification, making it a flexible and forgiving career path.
45:34 💡 Transitioning from a network security role to GRC can involve integrating GRC-type activities into your current role to showcase expertise and interest.
46:59 📝 Before conducting any assessment, create an audit plan, identify key stakeholders, and schedule focused interviews to gather necessary information.
51:14 📊 Familiarize yourself with risk management frameworks like MITRE ATT&CK and NIST 800-171 to enhance your understanding of GRC processes.
52:10 📝 Don't be overly attached to risk assessments, as some organizations may not prioritize cybersecurity until they face a significant incident.
57:35 🏛

Made with HARPA AI

GRC is the interface between the information security department and the organisation

I’m a IT Specialist asked to do cyber audits because they don’t want to pay third party. Just paid for this class.

Can you do another one of these please?😊

Great content. Amazing setup. Thanks

Hey! Don Junior will be our GRC coach! Haha!

Thank You Gerald

Wow what an amazing video!!

Thank you for this. Contemplating to pivot careers from the academe/research to cybersecurity and I have very minimal technical know-how and your discussion of this path is very helpful. :)

Awesome video to watch in conjunction with The Definitive GRC Master Plan

Great work!

Loved the balance between the GRC talk and the kids demanding attention. Thanks!

Keep the chat please.

Thank you Mr. Auger, great AND timely content. You are appreciated

Thanks Gerald. I am struggling with my current role in GRC. Watching your videos to know more lay my feet firmer.

Hey Gerald,what are the tools to succeed as a GSC Analyst coming from a zero background in IT?

Thank You! I have been making this too hard! I am actually working in a GRC environment and didnt know it... I am a contractor for BAH, working with the VA hospital.  You have simplified my approach to my job... Thank you !

Thanks for this informative video, see you next time.

thanky you

Excellent. Any online resources for NIST