Cyber GRC Certificate Program (Self-Paced)

Self-paced online training with expert support Certificate with 4 courses

Four self-paced courses through the full GRC arc — quantifying cyber risk in money rather than colors, pushing risk management out into the supply chain, running security and privacy as one program, and measuring yourself against CMMC before an assessor does.

$2,999 39 clock hours Live Support Start anytime

This program includes

  • 39 hours of project-based training from experts
  • Answers from real instructors
  • Retake for free within 1 year
  • Access to class recordings (30 days)
  • Verified digital certificate of completion
  • Learn at an accredited institution

This is the self-paced version. For live instruction, enroll in Cyber GRC Certificate Program.

Cybersecurity money gets approved in risk language, not technical language. This self-paced path is built for the person who has to make that translation, and it runs the whole arc rather than a slice of it. You define governance and accountability, assess risk, analyze and prioritize it, choose a response, record it in a register, map it to controls, and report it upward. The federal stack is taught next to its commercial and international counterparts throughout, so NIST SP 800-30, 800-39 and the IR 8286 series sit alongside COSO, ISO 31000 and ISO/IEC 27005.

Where most compliance training stops at red, amber and green, this path keeps going. You apply the FAIR model to real loss exposure and then work a materiality determination against the SEC disclosure criteria, which is the question boards are asking their security teams right now. The supply chain half goes equally deep, covering not SBOM as a buzzword but the artifacts you will be handed and asked to judge, and the underrated skill of checking whether a federal rule you are about to cite still applies at all. The path then steps up from practitioner to program work and closes on CMMC 2.0, so you finish knowing where an organization stands before an assessment rather than after one.

Read more

This course has a prerequisite

Foundational cybersecurity knowledge. The program management course additionally assumes working familiarity with security and privacy fundamentals.

Courses in this Certificate Program

This is the recommended order, but some courses may be taken in a different order.

Download Syllabus PDF

Unit 1 3 Hours

Understanding CMMC 2.0 for Federal Contractors (Self-Paced)

A plain-language overview of CMMC 2.0 for federal contractors - what it is, who must comply, the maturity levels, and the rollout timeline you need to plan around.

  • Explain what CMMC 2.0 is and why it exists.
  • Identify who must comply.
  • Describe the maturity levels and what they require.
  • Understand the assessment and certification path.
  • Know the rollout timeline and key deadlines.
  • Plan your organization's next steps.

Unit 2 12 Hours

Cyber Risk Management & GRC: From Risk to Assurance Course (Self-Paced)

Intermediate cyber governance, risk and compliance covering the full arc from governance and risk assessment through quantification, registers, controls, assurance, third-party risk, and reporting to leadership.

  • GRC defined, and cybersecurity risk distinguished from enterprise risk
  • Governance structures, risk appetite and tolerance, and who holds decision authority
  • Scoping and conducting a cyber risk assessment end to end
  • Prioritizing by organizational impact and selecting a defensible response
  • Qualitative ratings versus quantification, with the FAIR model applied
  • Materiality determinations under the SEC disclosure criteria
  • Risk registers structured to NIST IR 8286A and staged for enterprise oversight
  • Risk-to-control mapping, and implementation versus effectiveness
  • Enterprise-level third-party and supply-chain risk
  • Key risk indicators, thresholds, and communicating risk to nontechnical audiences

Unit 3 12 Hours

Cybersecurity Supply Chain Risk Management (C-SCRM) Course (Self-Paced)

An intermediate practitioner course in cybersecurity supply chain risk management built on NIST SP 800-161r1, spanning criticality, supplier assessment, acquisition, controls, software supply chain and lifecycle monitoring.

  • Cybersecurity supply chain risk distinguished from traditional supply chain risk
  • Supply chain threat sources, including counterfeit components, firmware tampering and supplier compromise
  • Criticality and dependency analysis, single points of failure and concentration risk
  • Organization, mission and business-process, and system-level C-SCRM, and escalation to the right decision-maker
  • C-SCRM strategy, policy and system-level planning across security, acquisition, legal and procurement
  • Evidence-based supplier due diligence and risk scoring
  • Security requirements written into agreements, with flow-down to subcontractors
  • The NIST SP 800-53 SR control family, SR-1 through SR-12
  • Software supply chain risk via SBOM, VEX, build-integrity levels and project-health tooling
  • AI and machine learning supplier assessment, including model and training-data provenance
  • Cryptographic inventory and agility as due-diligence questions
  • Continuous supplier monitoring, incident response, end-of-life and supplier transitions

Unit 4 12 Hours

Security & Privacy Program Management: From Governance to Assurance Course (Self-Paced)

Program-level training that runs security and privacy as a single organization-wide program, from governance and strategy through risk, controls, assurance, monitoring, and leadership reporting.

  • Program management versus system operations, and cybersecurity risk versus privacy risk
  • Governance structure, decision rights, escalation, and risk acceptance authority
  • CISO and SAOP statutory responsibilities separated from CIO and agency head
  • Program strategy, roadmap, and resourcing tied to mission outcomes
  • FIPS 199 categorization driving baseline selection
  • Information lifecycle mapping, data minimization, and PIA triggers
  • Baseline selection and tailoring defensible under oversight
  • Assessment evidence, findings, and POA&M remediation tracking
  • Security and privacy across each SDLC phase
  • Monitoring strategy and actionable, manipulation-resistant metrics
  • Determining when an incident is a PII breach and the reporting that follows
  • Delivering and defending a decision-framed leadership risk briefing
A group of adult learners sits in a classroom, smiling and engaged in a government training session.
A government training instructor in a suit gestures while teaching in front of a whiteboard covered with notes and diagrams.
A person in professional attire holds a Graduate School USA folder, symbolizing participation in government training programs.

Group Training

Since 1921, Graduate School USA has partnered with over 125 federal agencies and trained more than one million federal employees. Led by instructors with deep, real-world knowledge of federal regulations, policies, and practices, our private group programs are practical, mission-driven, and tailored to your agency’s objectives. We offer expertise across key federal domains—including human resources, financial management, acquisition and contracting, leadership, and more—to deliver training where and how your team needs it.

Complete this form and we’ll get back to you within 1 business hour.

The Fact Is – We’ve Been Government’s Training Partner Since 1921

400+ Courses & Certificates 125+ Federal Agencies Served 200+ Subject-Matter Experts