GDo GRCformerly TryGRCLabs
Pricing

Scenarios

Browse every scenario prompt in one place. These scenarios are used in the AI-marked scenario submissions under each job path.

Scenario Index

GRC Core Job Path ScenariosCompliance Analyst / Regulatory Compliance Analyst Job Path ScenariosRisk Manager / Operational Risk Analyst Job Path ScenariosGRC Core Scenario PathAudit & Assurance Scenario PathPrivacy & Data Protection Scenario PathSecurity & Resilience Scenario PathThird-Party & Regulatory Scenario PathProgram Leadership Scenario PathQuantitative Risk Scenario PathInsider Threat Governance Scenario PathISO 27001 Implementation Scenario PathSOC 2 Program Scenario PathNIST CSF 2.0 Scenario PathPCI DSS Compliance Scenario PathESG Governance & Disclosure Scenario PathITGC & SOX Financial Controls Scenario PathDORA ICT Third-Party Oversight Scenario PathVulnerability Management Operations Scenario PathIncident Response Operations Scenario PathZero Trust Implementation Scenario PathCloud Governance, FinOps & Risk Scenario PathIntermediate Vendor Assurance Scenario PathAudit Analytics & Control Assurance Scenario PathBusiness Continuity & Crisis Management Scenario PathData Governance & Quality Controls Scenario PathAI Governance & Model Risk Scenario PathFraud Risk & Internal Controls Scenario PathPolicy Lifecycle Management Scenario PathRegulatory Change Management Scenario PathAccess Governance & IAM Assurance Scenario PathThird-Party Resilience & Exit Planning Scenario PathBoard Risk Reporting Scenario PathControl Testing & QA Scenario PathKRI & Metrics Design Scenario PathIssue Management & Remediation Scenario PathCompliance Operations Scenario PathChange Risk Assessment Scenario PathAudit & Assurance Job Path ScenariosPrivacy & Data Protection Job Path ScenariosSecurity & Resilience Job Path ScenariosThird-Party & Regulatory Job Path ScenariosProgram Leadership Job Path ScenariosISO 27001 / Security Compliance Manager Job Path ScenariosOperational Resilience Analyst Job Path ScenariosExecutive & Board Reporting Job Path ScenariosCloud Governance & Asset Lifecycle Job Path ScenariosQuantitative Risk & Insider Threat Job Path ScenariosESG Governance & Disclosure Job Path Scenarios

GRC Core Job Path Scenarios

grc-analyst

Open scenario room
  1. Scenario 1Draft an enterprise risk statement and identify the top three business drivers.
  2. Scenario 2Build a control map linking key risks to preventive and detective controls.
  3. Scenario 3Create a short evidence checklist for a monthly control health review.
  4. Scenario 4Run a mock issue triage and assign owners with due dates.
  5. Scenario 5Prepare a one-page leadership summary of risk posture and control gaps.
  6. Scenario 6Design a control testing calendar using risk-weighted prioritization criteria.
  7. Scenario 7Define testing procedures with objective evidence requirements and pass/fail rules.
  8. Scenario 8Review sample quality and identify where sample expansion is warranted.
  9. Scenario 9Create a QA checklist for consistency, traceability, and reviewer sign-off.
  10. Scenario 10Summarize recurring control failure themes and preventive action proposals.

Compliance Analyst / Regulatory Compliance Analyst Job Path Scenarios

regulatory-compliance-analyst

Open scenario room
  1. Scenario 1Triage an incoming regulation and map impacted obligations to business functions.
  2. Scenario 2Estimate implementation complexity, deadlines, and dependency risks for each obligation.
  3. Scenario 3Define control and policy changes needed to satisfy new regulatory requirements.
  4. Scenario 4Create stakeholder governance for legal interpretation, implementation, and validation.
  5. Scenario 5Deliver an executive readiness update with risks, blockers, and decision requests.
  6. Scenario 6Map recurring compliance obligations to owner teams and operating cadence.
  7. Scenario 7Design control self-assessment workflows and evidence retention standards.
  8. Scenario 8Evaluate control exceptions and determine compensating control requirements.
  9. Scenario 9Develop a centralized obligations tracker with status and due-date governance.
  10. Scenario 10Prepare an annual compliance effectiveness review with improvement priorities.

Risk Manager / Operational Risk Analyst Job Path Scenarios

risk-manager

Open scenario room
  1. Scenario 1Draft an enterprise risk statement and identify the top three business drivers.
  2. Scenario 2Build a control map linking key risks to preventive and detective controls.
  3. Scenario 3Define a measurable loss event scenario using threat, asset, and effect.
  4. Scenario 4Estimate frequency and probable loss magnitude ranges with assumptions.
  5. Scenario 5Compare treatment options using expected risk reduction and cost.
  6. Scenario 6Classify findings by severity, systemic impact, and regulatory sensitivity.
  7. Scenario 7Define remediation plans with milestones, dependencies, and acceptance criteria.
  8. Scenario 8Assess overdue issues and determine escalation based on residual risk.
  9. Scenario 9Design verification testing to confirm sustainable closure of issues.
  10. Scenario 10Create portfolio reporting on remediation velocity and repeat issue drivers.

GRC Core Scenario Path

grc-core

🔒 Locked for free
  1. Scenario 1Draft an enterprise risk statement and identify the top three business drivers.
  2. Scenario 2Build a control map linking key risks to preventive and detective controls.
  3. Scenario 3Create a short evidence checklist for a monthly control health review.
  4. Scenario 4Run a mock issue triage and assign owners with due dates.
  5. Scenario 5Prepare a one-page leadership summary of risk posture and control gaps.

Upgrade required →

Audit & Assurance Scenario Path

audit-assurance

🔒 Locked for free
  1. Scenario 1Define an audit scope for a high-risk business process.
  2. Scenario 2Select a sample strategy and justify why it is risk-based.
  3. Scenario 3Document one control test with clear pass/fail criteria.
  4. Scenario 4Write a finding with condition, criteria, cause, and impact.
  5. Scenario 5Build a remediation tracker with owner, date, and verification step.

Upgrade required →

Privacy & Data Protection Scenario Path

privacy-data

🔒 Locked for free
  1. Scenario 1Map a data flow and identify controller/processor roles.
  2. Scenario 2Evaluate lawful basis and notice requirements for one processing activity.
  3. Scenario 3Create a DSAR handling checklist with SLA milestones.
  4. Scenario 4Assess vendor transfer risk and define required safeguards.
  5. Scenario 5Draft a privacy incident escalation note with required stakeholders.

Upgrade required →

Security & Resilience Scenario Path

security-resilience

🔒 Locked for free
  1. Scenario 1Prioritize attack scenarios by impact and likelihood.
  2. Scenario 2Map detection coverage to a chosen threat scenario.
  3. Scenario 3Define incident command roles for a simulated outage.
  4. Scenario 4Document business continuity dependencies for one critical service.
  5. Scenario 5Create a post-incident improvement plan with measurable outcomes.

Upgrade required →

Third-Party & Regulatory Scenario Path

third-party-regulatory

🔒 Locked for free
  1. Scenario 1Triage a high-risk vendor onboarding request and identify required due diligence evidence.
  2. Scenario 2Assess anti-bribery red flags and document escalation rationale.
  3. Scenario 3Evaluate an ITGC deficiency and classify impact to financial reporting.
  4. Scenario 4Draft a remediation plan with control owner, due date, and retest criteria.
  5. Scenario 5Prepare a regulator-ready summary with supporting evidence references.

Upgrade required →

Program Leadership Scenario Path

program-leadership

🔒 Locked for free
  1. Scenario 1Define governance forum cadence and decision rights for a new GRC program.
  2. Scenario 2Create KPI/KRI metrics for executive reporting and board visibility.
  3. Scenario 3Prioritize competing remediation initiatives under constrained capacity.
  4. Scenario 4Resolve a cross-functional ownership conflict using a RACI approach.
  5. Scenario 5Write a quarterly GRC update with top risks, actions, and blockers.

Upgrade required →

Quantitative Risk Scenario Path

quant-risk

🔒 Locked for free
  1. Scenario 1Define a measurable loss event scenario using threat, asset, and effect.
  2. Scenario 2Estimate frequency and probable loss magnitude ranges with assumptions.
  3. Scenario 3Compare treatment options using expected risk reduction and cost.
  4. Scenario 4Document uncertainty drivers and sensitivity to key assumptions.
  5. Scenario 5Present a decision recommendation in business terms for leadership.

Upgrade required →

Insider Threat Governance Scenario Path

insider-threat

🔒 Locked for free
  1. Scenario 1Draft insider threat program scope, objective, and governance charter language.
  2. Scenario 2Design intake and triage criteria for suspicious insider activity referrals.
  3. Scenario 3Define privacy guardrails for monitoring and investigations.
  4. Scenario 4Create escalation pathways for legal, HR, and security coordination.
  5. Scenario 5Build monthly oversight metrics and assurance checks.

Upgrade required →

ISO 27001 Implementation Scenario Path

iso-27001

🔒 Locked for free
  1. Scenario 1Define ISMS scope boundaries, exclusions, and ownership for a realistic organization.
  2. Scenario 2Draft a risk assessment approach and treatment decision model aligned to business context.
  3. Scenario 3Build a practical control selection rationale and Statement of Applicability structure.
  4. Scenario 4Design evidence requirements for policy operation, control execution, and monitoring.
  5. Scenario 5Prepare an internal audit and management review agenda with clear outputs.

Upgrade required →

SOC 2 Program Scenario Path

soc-2

🔒 Locked for free
  1. Scenario 1Define system boundaries and trust services criteria priorities for a SaaS environment.
  2. Scenario 2Create a control and evidence plan for access, change, and incident processes.
  3. Scenario 3Evaluate vendor risk dependencies and define monitoring and exception handling controls.
  4. Scenario 4Draft internal and external communication expectations for security events and commitments.
  5. Scenario 5Design a readiness review checklist for evidence quality and control consistency.

Upgrade required →

NIST CSF 2.0 Scenario Path

nist-csf

🔒 Locked for free
  1. Scenario 1Map business context and critical assets to CSF Govern and Identify outcomes.
  2. Scenario 2Define risk governance roles, accountability, and policy integration decisions.
  3. Scenario 3Design protection and detection priorities with measurable assurance indicators.
  4. Scenario 4Draft incident response and recovery coordination expectations across stakeholders.
  5. Scenario 5Build an executive reporting view showing maturity, gaps, and prioritized actions.

Upgrade required →

PCI DSS Compliance Scenario Path

pci-dss

🔒 Locked for free
  1. Scenario 1Define cardholder data environment boundaries and identify connected systems in scope.
  2. Scenario 2Evaluate network segmentation controls and document residual exposure assumptions.
  3. Scenario 3Draft evidence requirements for vulnerability scans, penetration testing, and remediation.
  4. Scenario 4Create a shared responsibility matrix for service providers handling payment data.
  5. Scenario 5Prepare an assessor-ready narrative linking controls to PCI DSS requirements and testing.

Upgrade required →

ESG Governance & Disclosure Scenario Path

esg-governance

🔒 Locked for free
  1. Scenario 1Identify material ESG topics and map accountable executive owners for each topic.
  2. Scenario 2Design controls for source data quality, versioning, and disclosure approvals.
  3. Scenario 3Evaluate a climate-risk scenario and define decision triggers for adaptation planning.
  4. Scenario 4Build an issue log for disclosure gaps with remediation owner and due date.
  5. Scenario 5Draft an audit committee briefing summarizing ESG reporting readiness and residual risks.

Upgrade required →

ITGC & SOX Financial Controls Scenario Path

itgc-sox

🔒 Locked for free
  1. Scenario 1Define in-scope applications and key reports supporting financial statement assertions.
  2. Scenario 2Test one access management control and document exceptions with root-cause analysis.
  3. Scenario 3Assess change management evidence for emergency fixes impacting financial systems.
  4. Scenario 4Create deficiency severity criteria and determine likely impact to control reliance.
  5. Scenario 5Build a management action plan with milestones through quarter-end certification.

Upgrade required →

DORA ICT Third-Party Oversight Scenario Path

dora-third-party

🔒 Locked for free
  1. Scenario 1Classify an ICT provider's criticality and document rationale against DORA expectations.
  2. Scenario 2Draft minimum contract clauses for resilience testing, incident notification, and exit rights.
  3. Scenario 3Evaluate concentration risk across key ICT providers and propose mitigation options.
  4. Scenario 4Design a third-party resilience monitoring dashboard with threshold-based escalation rules.
  5. Scenario 5Prepare a supervisory briefing on ICT third-party risk posture and planned improvements.

Upgrade required →

Vulnerability Management Operations Scenario Path

vulnerability-management

🔒 Locked for free
  1. Scenario 1Define a risk-based triage model for critical, high, and medium vulnerabilities.
  2. Scenario 2Assess patching SLA performance and identify bottlenecks by system owner.
  3. Scenario 3Create an exception workflow for compensating controls and formal risk acceptance.
  4. Scenario 4Design a validation approach to confirm remediation effectiveness across environments.
  5. Scenario 5Build a monthly report linking exposure reduction to business-critical assets.

Upgrade required →

Incident Response Operations Scenario Path

incident-response

🔒 Locked for free
  1. Scenario 1Classify a security event and determine escalation based on impact and confidence.
  2. Scenario 2Draft an incident timeline capturing detection, containment, eradication, and recovery.
  3. Scenario 3Define communications for legal, executive, customer, and regulator stakeholders.
  4. Scenario 4Evaluate evidence preservation and chain-of-custody requirements for investigation.
  5. Scenario 5Write a post-incident review with root cause, lessons learned, and prioritized actions.

Upgrade required →

Zero Trust Implementation Scenario Path

zero-trust

🔒 Locked for free
  1. Scenario 1Map identity, device, network, and application trust decisions for a sensitive workflow.
  2. Scenario 2Prioritize policy controls for least privilege and continuous access verification.
  3. Scenario 3Evaluate telemetry gaps that limit adaptive authentication and policy enforcement.
  4. Scenario 4Design a phased rollout plan balancing user friction, security gains, and cost.
  5. Scenario 5Present success metrics for access risk reduction and operational stability.

Upgrade required →

Cloud Governance, FinOps & Risk Scenario Path

cloud-governance-finops

🔒 Locked for free
  1. Scenario 1Identify cloud account governance gaps and define ownership guardrails by business unit.
  2. Scenario 2Assess cost anomalies and map optimization options without weakening control coverage.
  3. Scenario 3Design policy-as-code checks for tagging, encryption, and network exposure controls.
  4. Scenario 4Create a risk register for cloud misconfiguration trends and unresolved exceptions.
  5. Scenario 5Prepare an executive update on cloud spend, risk posture, and remediation progress.

Upgrade required →

Intermediate Vendor Assurance Scenario Path

vendor-assurance

🔒 Locked for free
  1. Scenario 1Build a tiering model to align due diligence depth with vendor criticality.
  2. Scenario 2Evaluate SOC, ISO, and questionnaire evidence for control design and operating effectiveness.
  3. Scenario 3Define trigger events for reassessment, continuous monitoring, and contract review.
  4. Scenario 4Draft a remediation plan for material findings with accountability and verification steps.
  5. Scenario 5Create a governance summary of vendor risk trends and concentration exposures.

Upgrade required →

Audit Analytics & Control Assurance Scenario Path

audit-analytics

🔒 Locked for free
  1. Scenario 1Select key risk indicators and data sources to test control performance at scale.
  2. Scenario 2Design an analytic test to detect segregation-of-duties conflicts in transactional data.
  3. Scenario 3Evaluate false positives and tune thresholds while preserving assurance quality.
  4. Scenario 4Document reproducibility requirements for scripts, queries, and evidence snapshots.
  5. Scenario 5Present actionable findings that connect analytic results to remediation priorities.

Upgrade required →

Business Continuity & Crisis Management Scenario Path

business-continuity

🔒 Locked for free
  1. Scenario 1Define critical business services and map maximum tolerable downtime for each.
  2. Scenario 2Document dependency chains across people, process, technology, and third parties.
  3. Scenario 3Design crisis command roles and decision thresholds for service disruption events.
  4. Scenario 4Run a tabletop exercise scenario and capture response timeline strengths and gaps.
  5. Scenario 5Build a continuity improvement backlog with ownership, due dates, and validation tests.
  6. Scenario 6Classify a security event and determine escalation based on impact and confidence.
  7. Scenario 7Draft an incident timeline capturing detection, containment, eradication, and recovery.
  8. Scenario 8Define communications for legal, executive, customer, and regulator stakeholders.
  9. Scenario 9Identify critical outsourced services and map recovery requirements for each.
  10. Scenario 10Evaluate supplier resiliency evidence and define minimum assurance thresholds.

Upgrade required →

Data Governance & Quality Controls Scenario Path

data-governance

🔒 Locked for free
  1. Scenario 1Define data ownership roles for critical datasets used in risk and compliance reporting.
  2. Scenario 2Create quality rules for completeness, accuracy, timeliness, and consistency checks.
  3. Scenario 3Design exception handling workflows for failed data controls and unresolved defects.
  4. Scenario 4Assess lineage documentation gaps and prioritize remediation for audit-relevant flows.
  5. Scenario 5Prepare a governance dashboard for quality trend monitoring and accountability.
  6. Scenario 6Map a data flow and identify controller/processor roles for a business-critical system.
  7. Scenario 7Design control self-assessment workflows and evidence retention standards for data assets.
  8. Scenario 8Classify findings by severity, systemic impact, and regulatory sensitivity for data quality issues.
  9. Scenario 9Define risk screening criteria for data migration and system change requests.
  10. Scenario 10Build a policy taxonomy aligned to data governance obligations and retention requirements.

Upgrade required →

AI Governance & Model Risk Scenario Path

ai-governance

🔒 Locked for free
  1. Scenario 1Classify an AI use case by risk tier and define required governance checkpoints.
  2. Scenario 2Document model inventory fields including owner, purpose, data sources, and controls.
  3. Scenario 3Evaluate bias, explainability, and performance monitoring requirements for deployment.
  4. Scenario 4Draft incident response procedures for harmful output, drift, or control failure events.
  5. Scenario 5Prepare board-level reporting on model risk exposure and mitigation status.
  6. Scenario 6Build a control map linking AI-specific risks to preventive and detective controls.
  7. Scenario 7Define approval workflows, review cadence, and exception governance for model deployments.
  8. Scenario 8Define risk screening criteria for AI use cases entering production environments.
  9. Scenario 9Map recurring AI compliance obligations to owner teams and operating cadence.
  10. Scenario 10Resolve a cross-functional ownership conflict for shared AI models using a RACI approach.

Upgrade required →

Fraud Risk & Internal Controls Scenario Path

fraud-controls

🔒 Locked for free
  1. Scenario 1Map high-risk fraud schemes to preventive and detective controls across the process.
  2. Scenario 2Define red-flag indicators and escalation logic for suspicious activity monitoring.
  3. Scenario 3Assess effectiveness of approval controls and segregation-of-duties boundaries.
  4. Scenario 4Create an investigation case template with evidence standards and documentation fields.
  5. Scenario 5Recommend control enhancements and quantify expected fraud-loss reduction impact.

Upgrade required →

Policy Lifecycle Management Scenario Path

policy-management

🔒 Locked for free
  1. Scenario 1Build a policy taxonomy aligned to regulatory obligations and internal risk themes.
  2. Scenario 2Define approval workflows, review cadence, and exception governance requirements.
  3. Scenario 3Assess policy-to-control traceability and identify implementation coverage gaps.
  4. Scenario 4Design employee attestation and targeted training requirements by role risk level.
  5. Scenario 5Prepare a policy health report with overdue reviews and remediation actions.

Upgrade required →

Regulatory Change Management Scenario Path

regulatory-change

🔒 Locked for free
  1. Scenario 1Triage an incoming regulation and map impacted obligations to business functions.
  2. Scenario 2Estimate implementation complexity, deadlines, and dependency risks for each obligation.
  3. Scenario 3Define control and policy changes needed to satisfy new regulatory requirements.
  4. Scenario 4Create stakeholder governance for legal interpretation, implementation, and validation.
  5. Scenario 5Deliver an executive readiness update with risks, blockers, and decision requests.

Upgrade required →

Access Governance & IAM Assurance Scenario Path

access-governance

🔒 Locked for free
  1. Scenario 1Define joiner-mover-leaver control objectives and required evidence artifacts.
  2. Scenario 2Test privileged access reviews for timeliness, completeness, and revocation quality.
  3. Scenario 3Design role mining criteria to reduce entitlement sprawl and toxic combinations.
  4. Scenario 4Assess MFA and conditional access coverage across high-risk user populations.
  5. Scenario 5Build a quarterly IAM assurance report with exceptions and remediation tracking.

Upgrade required →

Third-Party Resilience & Exit Planning Scenario Path

third-party-resilience

🔒 Locked for free
  1. Scenario 1Identify critical outsourced services and map recovery requirements for each.
  2. Scenario 2Evaluate supplier resiliency evidence and define minimum assurance thresholds.
  3. Scenario 3Design exit playbooks for high-impact suppliers with transition milestones.
  4. Scenario 4Assess substitutability risk and identify concentration hotspots by service type.
  5. Scenario 5Prepare leadership decisions on resilience investments and contractual improvements.

Upgrade required →

Board Risk Reporting Scenario Path

board-reporting

🔒 Locked for free
  1. Scenario 1Define board-level risk appetite indicators and threshold breach triggers.
  2. Scenario 2Create a concise risk dashboard balancing trend clarity with decision relevance.
  3. Scenario 3Translate technical control findings into strategic business impact statements.
  4. Scenario 4Draft decision memos for top risk tradeoffs and funding implications.
  5. Scenario 5Build a quarterly board pack with accountability, status, and escalation items.

Upgrade required →

Control Testing & QA Scenario Path

control-testing

🔒 Locked for free
  1. Scenario 1Design a control testing calendar using risk-weighted prioritization criteria.
  2. Scenario 2Define testing procedures with objective evidence requirements and pass/fail rules.
  3. Scenario 3Review sample quality and identify where sample expansion is warranted.
  4. Scenario 4Create a QA checklist for consistency, traceability, and reviewer sign-off.
  5. Scenario 5Summarize recurring control failure themes and preventive action proposals.

Upgrade required →

KRI & Metrics Design Scenario Path

kris-metrics

🔒 Locked for free
  1. Scenario 1Select KRIs linked to top enterprise risks and owner accountability.
  2. Scenario 2Define metric calculation logic, data lineage, and refresh cadence.
  3. Scenario 3Set tolerance bands and escalation triggers with management response actions.
  4. Scenario 4Validate metric quality through back-testing and anomaly review.
  5. Scenario 5Present metric insights that drive concrete risk treatment decisions.

Upgrade required →

Issue Management & Remediation Scenario Path

issue-management

🔒 Locked for free
  1. Scenario 1Classify findings by severity, systemic impact, and regulatory sensitivity.
  2. Scenario 2Define remediation plans with milestones, dependencies, and acceptance criteria.
  3. Scenario 3Assess overdue issues and determine escalation based on residual risk.
  4. Scenario 4Design verification testing to confirm sustainable closure of issues.
  5. Scenario 5Create portfolio reporting on remediation velocity and repeat issue drivers.

Upgrade required →

Compliance Operations Scenario Path

compliance-operations

🔒 Locked for free
  1. Scenario 1Map recurring compliance obligations to owner teams and operating cadence.
  2. Scenario 2Design control self-assessment workflows and evidence retention standards.
  3. Scenario 3Evaluate control exceptions and determine compensating control requirements.
  4. Scenario 4Develop a centralized obligations tracker with status and due-date governance.
  5. Scenario 5Prepare an annual compliance effectiveness review with improvement priorities.

Upgrade required →

Change Risk Assessment Scenario Path

change-risk

🔒 Locked for free
  1. Scenario 1Define risk screening criteria for business and technology change requests.
  2. Scenario 2Assess control impacts from major releases and process redesign initiatives.
  3. Scenario 3Design pre-implementation assurance checks for high-risk changes.
  4. Scenario 4Create post-implementation monitoring to detect unintended control degradation.
  5. Scenario 5Document change governance lessons and optimize approval decision paths.

Upgrade required →

Audit & Assurance Job Path Scenarios

it-audit-assurance

🔒 Locked for free
  1. Scenario 1Define an audit scope for a high-risk business process.
  2. Scenario 2Select a sample strategy and justify why it is risk-based.
  3. Scenario 3Document one control test with clear pass/fail criteria.
  4. Scenario 4Write a finding with condition, criteria, cause, and impact.
  5. Scenario 5Build a remediation tracker with owner, date, and verification step.
  6. Scenario 6Select key risk indicators and data sources to test control performance at scale.
  7. Scenario 7Design an analytic test to detect segregation-of-duties conflicts in transactional data.
  8. Scenario 8Evaluate false positives and tune thresholds while preserving assurance quality.
  9. Scenario 9Document reproducibility requirements for scripts, queries, and evidence snapshots.
  10. Scenario 10Present actionable findings that connect analytic results to remediation priorities.

Upgrade required →

Privacy & Data Protection Job Path Scenarios

privacy-operations

🔒 Locked for free
  1. Scenario 1Map a data flow and identify controller/processor roles.
  2. Scenario 2Evaluate lawful basis and notice requirements for one processing activity.
  3. Scenario 3Create a DSAR handling checklist with SLA milestones.
  4. Scenario 4Assess vendor transfer risk and define required safeguards.
  5. Scenario 5Draft a privacy incident escalation note with required stakeholders.
  6. Scenario 6Define data ownership roles for critical datasets used in risk and compliance reporting.
  7. Scenario 7Create quality rules for completeness, accuracy, timeliness, and consistency checks.
  8. Scenario 8Design exception handling workflows for failed data controls and unresolved defects.
  9. Scenario 9Assess lineage documentation gaps and prioritize remediation for audit-relevant flows.
  10. Scenario 10Prepare a governance dashboard for quality trend monitoring and accountability.

Upgrade required →

Security & Resilience Job Path Scenarios

security-grc-engineer

🔒 Locked for free
  1. Scenario 1Prioritize attack scenarios by impact and likelihood.
  2. Scenario 2Map detection coverage to a chosen threat scenario.
  3. Scenario 3Define incident command roles for a simulated outage.
  4. Scenario 4Document business continuity dependencies for one critical service.
  5. Scenario 5Create a post-incident improvement plan with measurable outcomes.
  6. Scenario 6Classify a security event and determine escalation based on impact and confidence.
  7. Scenario 7Draft an incident timeline capturing detection, containment, eradication, and recovery.
  8. Scenario 8Define communications for legal, executive, customer, and regulator stakeholders.
  9. Scenario 9Evaluate evidence preservation and chain-of-custody requirements for investigation.
  10. Scenario 10Write a post-incident review with root cause, lessons learned, and prioritized actions.

Upgrade required →

Third-Party & Regulatory Job Path Scenarios

third-party-risk

🔒 Locked for free
  1. Scenario 1Triage a high-risk vendor onboarding request and identify required due diligence evidence.
  2. Scenario 2Assess anti-bribery red flags and document escalation rationale.
  3. Scenario 3Evaluate an ITGC deficiency and classify impact to financial reporting.
  4. Scenario 4Draft a remediation plan with control owner, due date, and retest criteria.
  5. Scenario 5Prepare a regulator-ready summary with supporting evidence references.
  6. Scenario 6Build a tiering model to align due diligence depth with vendor criticality.
  7. Scenario 7Evaluate SOC, ISO, and questionnaire evidence for control design and operating effectiveness.
  8. Scenario 8Define trigger events for reassessment, continuous monitoring, and contract review.
  9. Scenario 9Draft a remediation plan for material findings with accountability and verification steps.
  10. Scenario 10Create a governance summary of vendor risk trends and concentration exposures.

Upgrade required →

Program Leadership Job Path Scenarios

grc-program-manager

🔒 Locked for free
  1. Scenario 1Define governance forum cadence and decision rights for a new GRC program.
  2. Scenario 2Create KPI/KRI metrics for executive reporting and board visibility.
  3. Scenario 3Prioritize competing remediation initiatives under constrained capacity.
  4. Scenario 4Resolve a cross-functional ownership conflict using a RACI approach.
  5. Scenario 5Write a quarterly GRC update with top risks, actions, and blockers.
  6. Scenario 6Define a measurable loss event scenario using threat, asset, and effect.
  7. Scenario 7Estimate frequency and probable loss magnitude ranges with assumptions.
  8. Scenario 8Compare treatment options using expected risk reduction and cost.
  9. Scenario 9Document uncertainty drivers and sensitivity to key assumptions.
  10. Scenario 10Present a decision recommendation in business terms for leadership.

Upgrade required →

ISO 27001 / Security Compliance Manager Job Path Scenarios

iso-27001-security-compliance

🔒 Locked for free
  1. Scenario 1Define ISMS scope boundaries, exclusions, and ownership for a realistic organization.
  2. Scenario 2Draft a risk assessment approach and treatment decision model aligned to business context.
  3. Scenario 3Build a practical control selection rationale and Statement of Applicability structure.
  4. Scenario 4Design evidence requirements for policy operation, control execution, and monitoring.
  5. Scenario 5Prepare an internal audit and management review agenda with clear outputs.
  6. Scenario 6Design a control testing calendar using risk-weighted prioritization criteria.
  7. Scenario 7Define testing procedures with objective evidence requirements and pass/fail rules.
  8. Scenario 8Evaluate control exceptions and determine compensating control requirements.
  9. Scenario 9Build a policy taxonomy aligned to regulatory obligations and internal risk themes.
  10. Scenario 10Define approval workflows, review cadence, and exception governance requirements.

Upgrade required →

Operational Resilience Analyst Job Path Scenarios

operational-resilience

🔒 Locked for free
  1. Scenario 1Define critical business services and map maximum tolerable downtime for each.
  2. Scenario 2Document dependency chains across people, process, technology, and third parties.
  3. Scenario 3Design crisis command roles and decision thresholds for service disruption events.
  4. Scenario 4Run a tabletop exercise scenario and capture response timeline strengths and gaps.
  5. Scenario 5Build a continuity improvement backlog with ownership, due dates, and validation tests.
  6. Scenario 6Classify a security event and determine escalation based on impact and confidence.
  7. Scenario 7Draft an incident timeline capturing detection, containment, eradication, and recovery.
  8. Scenario 8Define communications for legal, executive, customer, and regulator stakeholders.
  9. Scenario 9Classify an ICT provider's criticality and document rationale against DORA expectations.
  10. Scenario 10Evaluate concentration risk across key ICT providers and propose mitigation options.

Upgrade required →

Executive & Board Reporting Job Path Scenarios

executive-board-reporting

🔒 Locked for free
  1. Scenario 1Define board-level risk appetite indicators and threshold breach triggers.
  2. Scenario 2Create a concise risk dashboard balancing trend clarity with decision relevance.
  3. Scenario 3Translate technical control findings into strategic business impact statements.
  4. Scenario 4Draft decision memos for top risk tradeoffs and funding implications.
  5. Scenario 5Build a quarterly board pack with accountability, status, and escalation items.
  6. Scenario 6Create KPI/KRI metrics for executive reporting and board visibility.
  7. Scenario 7Select KRIs linked to top enterprise risks and owner accountability.
  8. Scenario 8Set tolerance bands and escalation triggers with management response actions.
  9. Scenario 9Validate metric quality through back-testing and anomaly review.
  10. Scenario 10Present metric insights that drive concrete risk treatment decisions.

Upgrade required →

Cloud Governance & Asset Lifecycle Job Path Scenarios

cloud-governance-asset-lifecycle

🔒 Locked for free
  1. Scenario 1Identify cloud account governance gaps and define ownership guardrails by business unit.
  2. Scenario 2Assess cost anomalies and map optimization options without weakening control coverage.
  3. Scenario 3Design policy-as-code checks for tagging, encryption, and network exposure controls.
  4. Scenario 4Create a risk register for cloud misconfiguration trends and unresolved exceptions.
  5. Scenario 5Prepare an executive update on cloud spend, risk posture, and remediation progress.
  6. Scenario 6Define joiner-mover-leaver control objectives and required evidence artifacts.
  7. Scenario 7Test privileged access reviews for timeliness, completeness, and revocation quality.
  8. Scenario 8Define risk screening criteria for business and technology change requests.
  9. Scenario 9Assess control impacts from major releases and process redesign initiatives.
  10. Scenario 10Design pre-implementation assurance checks for high-risk changes.

Upgrade required →

Quantitative Risk & Insider Threat Job Path Scenarios

quant-risk-insider-threat

🔒 Locked for free
  1. Scenario 1Define a measurable loss event scenario using threat, asset, and effect.
  2. Scenario 2Estimate frequency and probable loss magnitude ranges with assumptions.
  3. Scenario 3Compare treatment options using expected risk reduction and cost.
  4. Scenario 4Document uncertainty drivers and sensitivity to key assumptions.
  5. Scenario 5Present a decision recommendation in business terms for leadership.
  6. Scenario 6Draft insider threat program scope, objective, and governance charter language.
  7. Scenario 7Design intake and triage criteria for suspicious insider activity referrals.
  8. Scenario 8Define privacy guardrails for monitoring and investigations.
  9. Scenario 9Create escalation pathways for legal, HR, and security coordination.
  10. Scenario 10Build monthly oversight metrics and assurance checks.

Upgrade required →

ESG Governance & Disclosure Job Path Scenarios

esg-governance-disclosure

🔒 Locked for free
  1. Scenario 1Identify material ESG topics and map accountable executive owners for each topic.
  2. Scenario 2Design controls for source data quality, versioning, and disclosure approvals.
  3. Scenario 3Evaluate a climate-risk scenario and define decision triggers for adaptation planning.
  4. Scenario 4Build an issue log for disclosure gaps with remediation owner and due date.
  5. Scenario 5Draft an audit committee briefing summarizing ESG reporting readiness and residual risks.
  6. Scenario 6Triage an incoming regulation and map impacted obligations to business functions.
  7. Scenario 7Define control and policy changes needed to satisfy new regulatory requirements.
  8. Scenario 8Create stakeholder governance for legal interpretation, implementation, and validation.
  9. Scenario 9Deliver an executive readiness update with risks, blockers, and decision requests.
  10. Scenario 10Prepare an annual compliance effectiveness review with improvement priorities.

Upgrade required →

Do GRCformerly TryGRCLabs
Privacy PolicyTerms of ServiceCookie PolicyRefund PolicyDisclaimerContact Us

Do GRC (formerly TryGRCLabs) is an independent project and is not affiliated with, endorsed by, or sponsored by TryHackMe or Hack The Box.

© 2026 Do GRC. All rights reserved.