Elective E2 GRC Engineering
What you will be able to do
- Explain GRC engineering, its benefits, and its limits.
- Describe the OSCAL models and read a simplified fragment.
- Sort controls by how far they can be automated and define a trustworthy check.
- Start automation projects small and protect the tooling itself.
Lessons
The lessons, exercise, and quiz are for registered learners. Create a free account or sign in to read them.
- 1. What GRC Engineering Is, and Is Not · 30 min Completed
- 2. OSCAL and Machine-Readable Packages · 40 min Completed
- 3. Automating Evidence and Control Checks · 40 min Completed
- 4. Building Responsibly · 30 min Completed
Practice and quiz
- Practical exercise: An Automation Plan for TreasuryFlow
- Module quiz (10 questions, pass mark 80 percent)
Overview
GRC engineering applies engineering practice (structured data, version control, automation) to governance, risk, and compliance work. This elective shows what that means for an ISSO: machine-readable security packages in OSCAL, automated evidence and control checks, and the discipline that keeps automation trustworthy.
It is not needed for the capstone. It needs Module 5, because it builds on assessment methods and evidence.
Lessons
| # | Lesson | Time | Status |
|---|---|---|---|
| 1 | What GRC Engineering Is, and Is Not | 30 min | Adapted |
| 2 | OSCAL and Machine-Readable Packages | 40 min | Adapted |
| 3 | Automating Evidence and Control Checks | 40 min | Adapted |
| 4 | Building Responsibly | 30 min | New |
What is binding here, and what is guidance
| Source cited in this elective | Kind | Why it has that status |
|---|---|---|
| NIST OSCAL | Guidance and technical specification | A standard format; use is directed by programs and agencies |
| FedRAMP rules on machine-readable evidence | Binding on providers in the program | Program rules (Module 8) |
| NIST SP 800-53A, 800-137, IR 8011, 800-218 | Guidance | Assessment, monitoring, automation, and secure development methods |
| NIST SP 800-53 controls applied to GRC tooling | Guidance, required in practice | The tooling is itself a system that needs controls |
| Agency GRC tool and evidence policies | Binding within the agency | Set the tools and formats you use |
| The three-tier automation classification | Course method | A teaching device, not a NIST category |
Module summary
- GRC engineering treats security information as data and evidence as something a system can produce on demand.
- It is not a tool purchase, not automation of judgment, and not a way around assessor independence.
- OSCAL has seven models in three layers (control, implementation, assessment) that mirror the documents you already know and link them together.
- Sort controls into fully automatable, partly automatable, and judgment-based. Be honest about the third.
- Define every check: data source, coverage, test, frequency, threshold, evidence, owner, independent reviewer.
- Policy as code prevents problems at deployment; checks find what slips through.
- Start small with a painful, technical, owned problem. Protect the tooling: least privilege, version control, review, and monitoring of the job itself.
What comes next
The other elective, E1 Operational Technology, needs Module 3.
Last reviewed 2026-11-12. Federal requirements, dates, and web addresses change. Before you rely on a date, deadline, or figure, open the source linked in the lesson.