Learning context
In GRC Mastery coursework, I worked through simulated assessments and case studies covering information security management and audit concepts. This page summarizes that coursework separately from my professional IT experience.
The exercises provided practice with the documentation that connects organizational scope, security risks, controls and review activities.
Readiness documentation
- Information security management system (ISMS) scope definition.
- Risk assessment and treatment documentation.
- A Statement of Applicability supporting control selection.
- Inputs for internal audit and management review.
- Corrective-action documentation within the simulated scenario.
These were educational deliverables. They are not evidence that an employer or client achieved ISO 27001 certification.
Internal-audit practice
The simulated audit work included an audit program, checklist, evidence sampling, findings classification and nonconformity reporting. It gave me a structured way to practise separating the requirement, the evidence and the finding.
The distinction matters: completing an audit exercise develops familiarity with the process, but is not the same as conducting an independent audit for a client.
Connection to professional work
My professional NIST assessment provides experience identifying organizational security gaps and implementing improvements. The ISO coursework adds practice with ISMS and audit documentation.
I keep these two sources of experience separate so that the scope of each is clear.
Read the professional assessment summary