Stop Just Learning GRC.
Start Building It.
Build five realistic GRC projects that help you practice technical controls, automation, risk decisions, executive communication, and AI governance. Then turn what you built into portfolio and interview evidence.
No paid GRC tools required. Python optional.
Work through Project 1 with guided activities inside Building in GRC, or download the original Project Pack resources to complete all five projects using your preferred tools.
$29 one-time · 5 projects · Downloadable resources · Guided Project 1 · Lifetime access
Get the Project Pack for $29Start with Standard. It is the complete project experience. Deep Dive is optional when you want additional technical practice.
You probably don't need another GRC course.
You may already know the frameworks, controls, spreadsheets, evidence, access reviews, audits, vendor reviews, policies, and risk registers. The gap shows up when the work gets more technical and decision-oriented. Employers increasingly need practitioners who can ask:
- How should this control actually work?
- Can we monitor it instead of checking it manually?
- Is this finding actually a material risk?
- What should the business do about it?
- How do I explain the tradeoff to an executive?
- How should we govern AI without simply creating another checklist?
That is the gap this Project Pack is designed to help you practice.
Practice the work. Build the solution. Prove the skill.
This is not a collection of blank templates or a single "correct" answer.
You step into Harborline Health, a fictional company with the incomplete information, conflicting evidence, and changing conditions you encounter in actual GRC work. Every project follows a practical learning loop:
Build
Assess the problem and create something that works.
Break
New information changes the situation. Your original solution may no longer be enough.
Improve
Reassess your assumptions, controls, risks, or recommendation.
Defend
Explain what changed, what risk remains, and why your recommendation makes sense.
Translate
Turn the work into something you can honestly discuss in your portfolio and interviews.
You are practicing judgment, not memorizing an answer key.
Here's What You'll Actually Build
Five working artifacts, not generic templates.
JML Control Monitor
Turn employee and access data into actionable identity lifecycle exceptions.
Continuous Control Monitor
Turn source-system evidence into recurring control evaluations, exceptions, and control-health reporting.
Third-Party Risk Decision
Evaluate conflicting evidence, residual risk, and compensating controls to support a defensible vendor decision.
Executive Risk Decision Memo
Turn competing risks, limited capacity, and uncertainty into concise executive decision support.
AI Governance Requirements
Change how an AI use case operates and see the applicable governance requirements change with it.
These are not completed answers you copy. They are the systems, analyses, and decision artifacts you learn to build and defend.
Five projects. Five increasingly valuable capabilities.
Identity Lifecycle & Access Governance
Learn to engineer a control.
Assess Harborline's Joiner, Mover, Leaver process, design stronger access-governance controls, and build a working JML Control Monitor.
New information reveals that the original control may not cover everything you thought it did.
You'll practice
- Identity and access governance
- JML control design
- Exception detection
- Root-cause analysis
- Remediation prioritization
You'll build: JML Control Monitor
Project 1 is also available as a guided, interactive experience inside Building in GRC, with autosave and a visible Save progress button.
Continuous Evidence & Control Monitoring
Learn to engineer assurance.
Turn source-system data into recurring privileged-MFA control evaluations, exceptions, retained evidence, and control-health reporting.
The control logic may be working while the population being monitored is incomplete.
You'll practice
- Continuous control monitoring
- Evidence design
- Control evaluation logic
- Population completeness
- Monitoring assurance
You'll build: Continuous Control Monitor + Evidence Package
Third-Party Risk Decision
Learn to engineer a risk decision.
A business team wants to launch a SaaS vendor under time pressure, but the evidence contains gaps, contradictions, and unresolved risk.
The planned use changes, forcing you to reassess whether your original recommendation still makes sense.
You'll practice
- Third-party risk
- Inherent vs residual risk
- Evidence quality
- Compensating controls
- Risk treatment
You'll build: Third-Party Risk Decision
Executive Risk Decision
Learn to engineer executive decision support.
Leadership has five legitimate risks but limited time and capacity. Determine which two initiatives to fully fund, which one receives interim treatment, and what remains unresolved.
An incident consumes some of the capacity your recommendation depended on.
You'll practice
- Risk prioritization
- Tradeoff analysis
- Residual risk
- Decision framing
- Executive communication
You'll build: Executive Risk Decision Memo
AI Governance Assessment
Learn to engineer governance.
Harborline is already piloting an AI-assisted workflow. Map how the AI actually operates, then design governance requirements around the use rather than starting with a framework checklist.
The technology may remain the same while the authority given to the AI changes.
You'll practice
- AI use-case assessment
- AI risk
- Meaningful human oversight
- Governance requirements
- Monitoring and reassessment
You'll build: AI Governance Requirements Workbook
Optional Deep Dive: translate selected governance requirements into beginner-readable Python as machine-evaluable Governance-as-Code rules. The code surfaces governance requirements. Humans still make governance and risk decisions.
Your Projects. Your Pace. Your Progress.
Learning GRC takes practice. The Project Pack gives you the flexibility to work through realistic scenarios, document your decisions, and build your confidence at your own pace.
Learn by doing
Work through practical scenarios that challenge you to evaluate evidence, identify risks, assess controls, and explain your recommendations.
Start with guided learning
Use the guided experience for Project 1 inside Building in GRC to work through activities step by step.
Save and continue
Your guided project work saves automatically. You can also select "Save progress" and return later to continue.
Download your resources
Access the original downloadable Project Pack resources for all five projects and work using your preferred tools.
Guided in-app activities are available for Project 1. All five projects are included as downloadable resources, which you save using your own tools.
One purchase. Five projects. Learn at your own pace.
You do NOT need to know Python.
Standard is complete without Python. Spreadsheets and written analysis are legitimate paths, not a lesser one. Choosing the spreadsheet path does not make your GRC judgment less advanced. Python stays optional technical practice.
You don't need paid GRC tools either.
The projects are designed around accessible tools and realistic fictional data so you can practice the underlying skill instead of learning one vendor's interface.
What you'll actually leave with
If you complete all five Standard projects, you will have practiced how to:
But just as importantly: you will have stories to tell about why you made those decisions.
Your portfolio should prove how you think.
Every project includes Career Translation to help you turn the work into an honest professional story. You'll get guidance for:
You will not pretend Harborline was your employer. You will not invent business results. You will not claim production experience you do not have.
"This was an independent portfolio project where I simulated…" and then explain what you actually built, analyzed, changed, and defended.
Built for GRC practitioners who want to become more technical.
This pack is especially useful if you are:
- A GRC Analyst who feels stuck doing manual compliance work.
- A Senior GRC practitioner who wants stronger technical and automation skills.
- A practitioner interested in GRC Engineering or compliance automation.
- A risk professional who wants to get better at making and defending decisions.
- A GRC practitioner developing AI governance capability.
- Someone building a credible GRC portfolio.
You do not need to be a developer. You do need to be willing to think.
Standard or Deep Dive. You decide.
Approximately 4 to 6 hours per project
Complete the core scenario, working artifact, Break, Improve/Defend, and Career Translation.
Standard is the complete project.
Approximately 8 to 12 hours where applicable. Optional.
Additional technical work and analysis where the project supports it.
Spread each project across five days using the included five-day plans. There is no prize for finishing fastest.
This is not another certification study guide.
Certifications help you learn concepts. This pack makes you apply them.
There is no multiple choice answer telling you which risk matters.
There is no answer key deciding vendor approval.
There is no formula choosing the executive risk portfolio.
There is no AI risk score making the governance decision.
Assess the evidence. Make the decision. Defend it.
How It Works
-
1
Purchase the Project Pack
Make a one-time $29 purchase through the secure checkout.
-
2
Check your email
Receive an activation email with instructions for accessing your purchase.
-
3
Activate your account
Create your free Building in GRC account or sign in using the email associated with your purchase.
-
4
Start building
Open the Project Pack, begin the guided Project 1 experience, or download the original resources for all five projects.
No Pro subscription required. Your $29 purchase includes lifetime access to the Project Pack.
Building in GRC
Hands-On GRC Project Pack
One purchase. All five projects.
$29 one-time · 5 projects · Downloadable resources · Guided Project 1 · Lifetime access
No Pro subscription required.
Get the Project Pack for $29Frequently asked questions
What happens after I purchase?
You'll receive an email with instructions to access your Project Pack through Building in GRC. If you don't see the email, check your spam or junk folder.
Do I need a Building in GRC account?
Yes. After purchasing, you'll receive an email with instructions to activate your account or sign in. Your Project Pack purchase is linked to your Building in GRC account. You don't need a Pro subscription.
Is this a subscription?
No. The Project Pack is a $29 one-time purchase with lifetime access to the included projects. It does not require a paid Building in GRC subscription.
Are all five projects guided inside the app?
The Project Pack includes all five projects as downloadable resources. Project 1 also has a guided in-app experience where you can work through activities and save your progress.
Can I save my work and come back later?
Yes. In the guided Project 1 experience, your work saves automatically, and you can also use the visible "Save progress" button. You can sign back into your account to continue. Downloaded project files are managed and saved using your own tools.
Do I need Python?
No. Standard is complete without Python. Some projects offer an optional Python Deep Dive.
Do I need to know how to code?
No. This pack is for GRC practitioners becoming more technical, not developers learning GRC.
Is this for beginners?
You do not need technical GRC experience to start, but the projects require you to think and decide. Use the five-day plan if this is your first hands-on project.
Is this just templates?
No. Each project has scenarios, source data, conflicting evidence, a working artifact, a Break event, and Career Translation.
Will you give me the correct answer?
Not always. Real risk decisions often do not have one. You get facts, constraints, and criteria. You make the defensible call.
Can I put this on my resume or GitHub?
Yes, describe the work you actually completed. Harborline Health is fictional and should never be presented as employment or client work. Purchased materials should not be redistributed.
Do I need enterprise software?
No. The core projects are designed to be completed without expensive enterprise platforms.
How long does it take?
Standard runs about 4 to 6 hours per project. Deep Dive runs about 8 to 12 hours where available. Five-day plans are included for shorter sessions.
Is this a GRC Engineering course?
No. This pack practices the transition toward more technical GRC work. It stops before production engineering topics like deployment infrastructure, CI/CD, and enterprise policy engines.
Stop collecting knowledge you can't demonstrate.
Build something. Break it. Figure out why. Improve it. Defend the decision.
Then walk into your next interview with something real to talk about.
Start Building for $29