Cyber Cultura course
Cyber GRC: Structure, Processes and Indicators
Security and privacy governance, risk and compliance, end to end.
Teaches how to structure governance, processes and indicators to align security and privacy with business objectives and compliance.
- Workload
- 5 hours
- Format
- Online or in-company
- Investment
- On request
We’ll reply with dates, format and investment.
Who it’s for
- CISOs, DPOs and managers who build or reorganize a GRC program.
- Risk, compliance and audit analysts.
- Consultants who structure security and privacy programs.
What you’ll develop
- Define the governance model: committees, RACI, three lines of defense and indicators.
- Run risk management: catalog, assessment, treatment, acceptances and exceptions.
- Connect GRC to SecOps, projects, third parties and privacy (LGPD and ISO/IEC 27701).
- Build executive packages: one-pager, heatmap and decisions.
- Establish the cycle of audits and continual improvement.
Syllabus
5 hours
01GRC fundamentals in security
- GRC concepts and scope; relationship with corporate and IT governance (COBIT)
- Roles and responsibilities: senior management, committees, CISO, DPO and risk owners
- Three lines of defense applied to security and privacy
02Reference standards and frameworks
- ISO/IEC 27001 and 27002 (controls)
- ISO/IEC 27005 and ISO 31000 (risk management)
- NIST CSF 2.0 and CIS Controls v8
- ISO/IEC 27701 (privacy)
- ISO 22301 (continuity) and ISO/IEC 27031 (ICT readiness)
- LGPD and the sector regulatory landscape
03Security and privacy governance structure
- Policies, standards, procedures and technical baselines
- Security and privacy committees and reporting to senior management
- Roles (RACI) and accountability
- Culture, awareness and continuous training
04Cyber risk management
- Criteria: appetite, tolerance, impact and likelihood
- The ISO/IEC 27005 and ISO 31000 process, from context to treatment
- Threat catalog, scenarios and analysis of existing controls
- Third-party and supply chain risk, including cloud
- Privacy risks and impact assessment (DPIA)
- Operational and continuity risk (BIA and critical dependencies)
- Prioritization and roadmap, qualitative and semi-quantitative
05Compliance and audits
- Mapping legal, regulatory and contractual requirements
- Statement of Applicability and control matrix
- Evidence, audit trails and exception management
- Internal and external audits, nonconformities and corrective actions
06Controls, metrics and maturity
- Risk-based selection and prioritization of controls (ISO, NIST and CIS)
- Executive KPIs, KRIs and OKRs; dashboards and risk storytelling
- Maturity models and continual improvement cycles
- Data governance, classification and the information lifecycle
07Third-party and contract management
- Due diligence, criticality criteria and periodic assessments
- Contractual security and privacy requirements and SLAs
- Continuous monitoring, evidence and supplier offboarding
08Integration between GRC, SecOps and engineering
- Risk-driven vulnerability and patch management
- Incident management, lessons learned and change management
- Inventory and CMDB, hardening and DevSecOps
09Continuity, resilience and crisis
- BIA and continuity strategies (ISO 22301)
- ICT readiness (ISO/IEC 27031), DRP and testing
- Crisis management, communication and stakeholders
10Privacy in the GRC program
- Privacy program (LGPD): legal bases, rights and principles
- Privacy by design and by default, minimization and retention
- Governance of consent, data subject rights and personal data incidents
11Executive communication and engagement
- Reports to the board and the executive team, heatmaps and scenarios
- Business cases, investment prioritization and return on security
12Security and privacy training and awareness
- Fundamentals and references
- Program strategy
- Role-based track matrix
- Minimum curriculum and key content
- Methodologies and formats
- Simulations and practice
- Communication and engagement
- Metrics, effectiveness and continual improvement
- Governance and evidence
- Rollout and operation
- Course artifacts
13Workshop and practical artifacts
- Building the risk matrix and criteria
- Statement of Applicability and compliance matrix (guided example)
- Treatment plan and quarterly roadmap
- Executive risk and compliance dashboard template
- Templates: Information Security Policy, RACI Matrix, third-party due diligence, audit checklists and DPIA
What the course includes
- Guided workshop
- Artifact templates
For your team
This course is also offered in-company, on-site or remote, as a private class for your company.
Cyber Cultura course
Cyber GRC: Structure, Processes and Indicators
We’ll reply with dates, format and investment.
cyber@cyberconsulting.com.br