Practice GRC situations before you're thrown into them.
Scenarios you work through in the browser, and controls you build with Trivy, Gatekeeper and Terraform in your own repo.
Free. Read anything without an account; sign in when you start a mission.
How a mission works
Start with a situation
Sarah at Clearwater wants an access review by 5 PM, or an assessor wants to know how known-critical vulnerabilities stay out of production.
Do the work it asks for
Read the evidence and make the call, or write the policy yourself and watch the privileged pod get refused.
Replay any scenario from the start
Make the wrong call and see what it costs, then run it again. Every lab can be torn down and rebuilt.
Keep what you made
Scenarios leave a record of your calls. Builds leave code, evidence and a README in your own repo.
Traditional GRC
The judgment calls, practiced in the browser.
Categorize a system, answer a vendor review against the clock, inherit a program nobody documented, and put an authorization package in front of the official who signs it. Nothing to install. Every mission is a scenario with a deadline, real artifacts and a call you have to make.
What you'll practice
- Drawing a system boundary and categorizing it
- Reading evidence and spotting what it does not prove
- Answering an outside reviewer honestly, on a deadline
- Building an authorization package an AO can sign
- Build your first RMF systemWalk one system through all seven RMF steps and support an authorization decision.Beginner, 60–90 min, in the browserStart this scenario
- FIPS 199 categorizationCategorize three federal systems using FIPS 199 impact levels and the high-water mark rule.Beginner, 45–60 min, in the browserStart this scenario
- The Vendor Review RoomA customer's vendor review lands at 10:47. Find the logging gap and send an honest answer by 5 PM.Beginner, 45–60 min, in the browserStart this scenario
- The Diagnostic RoomDay one. The last GRC lead left six weeks ago and FedRAMP is thirteen weeks out. Find what drifted.Intermediate, about 45 min, in the browserStart this scenario
- The Authorization RoomNinety days to an honest ATO on Summit, then ninety more to make the case for ongoing authorization.Advanced, about 50 min, in the browserStart this scenario
GRC Engineering
Build the controls for real, and keep what you build.
Real tools, in your own GitHub Codespace and your own AWS account, with every click and command written out. Each build ends as a folder in your own public repo, with the code, the evidence and a README, so when you finish you have a portfolio you can walk an interviewer through.
grc-engineering-labs/ README.md evidence/ 01-tool-versions.txt 02-checksums-verified.txt 03-checksum-mismatch-blocked.txt 01-vuln-scanning/evidence/ 02-nginx-sbom.cdx.json 06-ci-blocked-critical.txt 02-kubernetes-policy/evidence/ 01-denied-privileged.txt 03-audit-findings.yaml 03-iam-least-privilege/evidence/ 08-denied-missing-external-id.txt 04-detection-aws/evidence/ 02-config-drift-detected.json 06-guardduty-findings.json
The Pipeline Room is a scenario, so it runs in the browser and leaves a record instead of a folder.
Open GRC Engineering- Set up your workbenchYour portfolio repo and a Codespace with every tool pinned, so every build runs on the same bench.Build, beginner, 1–1.5 hours, GitHub, freeStart this build
- Scan images and gate the pipelineScan images and Terraform, produce an SBOM, and build a pipeline gate that blocks critical CVEs.Build, beginner, 2–3 hours, Codespace, freeStart this build
- Kubernetes admission policyWrite two policies in Rego and prove risky pods are refused at the door and old ones are caught by audit.Build, intermediate, 2–3 hours, Codespace, freeStart this build
- The Pipeline RoomYou have built a gate. Now review five of them against a spec nobody wrote, 48 hours before the assessor arrives.Scenario, advanced, about 90 min, in the browserStart this scenario
- IAM least privilegeSet up your AWS account safely, then build a narrow, time-boxed, read-only role for an assessor.Build, intermediate, 3–4 hours, AWS, freeStart this build
- AWS detective controlsCloudTrail, Config, alarms and GuardDuty in Terraform. Set each one off on purpose and keep the proof.Build, advanced, 3–4 hours, AWS, under $1Start this build
The first scenario takes about an hour.
Start with a scenario in the browser, or set up your workbench and start building. Both paths are open, and you can start either one today.