The Practical Exams Are Now Labs — 27 New Environments, 232 More Labs
We've stopped offering the GRC and AI Governance practical exams. Their papers haven't gone anywhere: all 27 are now lab environments, at the three levels you already know from the labs page: Foundation, Practitioner and Advanced.
That's 232 more labs, which brings the labs to 81 environments and 623 labs. As in every environment, the first lab in each is free.
Why
The exam papers and the labs were always built the same way: a fictional organisation's own evidence (its policies, registers, contracts and system exports) and the questions the job actually asks. The papers were some of the most thorough material on the site, and a timed sitting was a narrow way to use them. As labs, you work them at your own pace, come back to them as often as you like, and have your work marked like any other lab.
What's new
Foundation: 11 organisations
Eight GRC organisations: a recruitment agency in Leeds and Sheffield, an English language school in Wellington, an architecture practice, a small-group tour operator in Nova Scotia, a client-portal software company for accountants, a rural electric cooperative, an outpatient physical therapy practice and a campervan hire company. Between them they cover ISO/IEC 27001, SOC 2, NIST CSF 2.0, the HIPAA Security Rule and PCI DSS v4.0.1.
Three AI governance organisations: an online professional education provider, a light-industrial staffing group and a Singapore freight forwarder, under ISO/IEC 42001 and the NIST AI Risk Management Framework.
Each has eight labs, three easy and then five medium, with twelve findings between them. The last lab rates all twelve with the organisation's own method and asks which three are the most serious.
Practitioner: 12 organisations
Eight GRC organisations: a freight forwarder and customs broker, a software company for residential property managers, a records management company, a school software company, a group benefits administrator, a home health and hospice software company, a payroll and HR administration provider and a restaurant ordering software company, under ISO/IEC 27001 and SOC 2 Type II.
Four AI governance organisations: a consumer lender in Valencia, a residential property manager, a company whose case-handling software, AI included, is used by Danish municipalities, and a mutual car insurer, under ISO/IEC 42001 and the NIST AI Risk Management Framework.
Each has ten labs that build from a first look to an independent assessment of every finding, and each ends with every finding mapped to a control and rated, so all twelve carry the Map and rate badge.
Advanced: 4 groups
Four groups of four companies, each spread across four jurisdictions: a card payments group led from Luxembourg (DORA, PCI DSS, SOC 2, the GDPR and Australia's Privacy Act); a UK aerospace and defence engineering group (ISO/IEC 27001, NIST SP 800-171, NIS2 and the GDPR); a telecoms group in Dublin, Warsaw, Lisbon and Belfast; and an online marketplace in Sweden, Finland, Estonia and Lithuania. The last two are AI governance groups, under ISO/IEC 42001, the GDPR and the EU AI Act. At this level you scope the work yourself and find what's wrong without being told where to look.
What this means for you
- If you were preparing for a practical exam, the papers are the labs now: the same organisations and the same evidence, with no clock.
- The new labs earn CPE records like every other lab.
- Exam Prep hasn't changed. It's the practice questions for certifications such as CISA, CISM and CISSP, and it stays.
- A paid membership opens every lab, and the first lab in each environment is free. See pricing.
Pick a level on the labs page and start with a free first lab.