GRC Engineering Labs — 21 New Environments, 158 More Labs

The labs page has a third subject: GRC engineering. It has 21 new organisations at the three levels you already know, Foundation, Practitioner and Advanced, with 158 labs between them.

That brings the labs to 102 environments and 781 labs. As in GRC and AI governance, six Foundation, four Practitioner and two Advanced organisations have a free first lab, and the labs page marks them.

What GRC engineering is

More and more compliance runs as code: a policy rule that stops a change in the pipeline, a scan that checks every cloud account each night, a script that gathers the evidence an auditor will ask for, a dashboard that turns all of it into a figure the board reads. The job is to make that automation work, and to know when it doesn't: a gate that can never fail a build, a rule with a gap a change slips through, a check that reads the wrong setting and reports a pass.

What's different

The evidence is the files a GRC engineer works with: Terraform code and plans, policy-as-code rules, pipeline definitions and their run logs, cloud configuration scans, identity exports and credential reports, Kubernetes admission policies, SBOMs and signatures, OSCAL documents, and the scripts and queries that collect the evidence. Every finding is still mapped to a framework and rated with the organisation's own method, as in every lab.

At Foundation you read the files and write your findings in plain words. Nobody writes code. At Practitioner and Advanced, two of the written answers in each organisation are a rule, check or query you write. They are marked on their logic, not their syntax.

Foundation: 8 organisations

A Dundee web agency that hosts portals for housing associations on Azure (ISO/IEC 27001:2022), a Virginia appointments software company for veterinary clinics (SOC 2), a Hobart outdoor retailer (PCI DSS v4.0.1), an Illinois public library district (NIST CSF 2.0), an Oregon physical therapy group whose exercise app runs on AWS (the HIPAA Security Rule), a Dayton engineering design firm in Microsoft's GCC High cloud (NIST SP 800-171), a North Carolina county's permits and inspections department (the low baseline of NIST SP 800-53) and a Dublin payment institution (DORA).

Each has six labs with ten findings between them. The last lab rates all ten with the organisation's own method and asks which three are the most serious.

Practitioner: 9 organisations

A purchasing software company with a compliance gate in its pipeline (SOC 2), a ticketing company on Google Cloud that is a PCI DSS service provider, a fleet telematics company on Azure and Kubernetes (ISO/IEC 27001:2022), a case management company in AWS GovCloud whose system security plan is in OSCAL (NIST SP 800-53), a remote patient monitoring company (the HIPAA Security Rule), a public university whose security scorecard is built from its own queries (NIST CSF 2.0), an aerostructures manufacturer with a CUI enclave (NIST SP 800-171), a Utrecht payment institution whose register of information and incident classifier are its own scripts (DORA), and a software company whose customers run its agent from the container images it builds, signs and describes (SOC 2).

Each has ten labs that build from a first look to an independent assessment of all 24 findings, mapped to a control and rated.

Advanced: 4 groups

Four groups of three companies, each sharing one cloud platform, its pipelines and its compliance automation: a payments group in London, Dublin and Austin (PCI DSS and SOC 2); a care coordination software group in Maine, Ontario and Pune (HIPAA, SOC 2 and ISO/IEC 27001); a payments group in Amsterdam, Frankfurt and Porto (DORA, NIS2 and ISO/IEC 27001); and a government services group in Newcastle, Virginia and Canberra (ISO/IEC 27001, NIST SP 800-53 and NIST CSF 2.0). Their group findings are the ones only a group shows: a control one company relies on that the platform company never tested for it, a policy library pinned at different versions, evidence mapped to another company's controls. At this level you scope the work yourself.

How they were checked

Every organisation was built with AI and then checked by AI reviewers who had not seen it built: a blind sitting of every lab and, at Practitioner and Advanced, a second blind rating of every finding. The reviewers re-ran the organisation's own policies, scans, scripts and queries with the real tools to check that the files say what the answers claim. All 21 were then audited together before they opened. What that audit found is on the About page.

What this means for you

• Pick GRC Engineering on the labs page and choose a level. Twelve of the organisations have a free first lab.
• The new labs earn CPE records like every other lab.
• Stage 15 of the learning journey, Security GRC Engineering, now links the labs, and the GRC Engineering Job Path's ten scenarios are GRC engineering tasks.
• A paid membership opens every lab. See pricing.