GRC Implementer & Assessor Combined Bootcamp
Become job-ready across ISO 27001, RMF and Third-Party Risk.
Three flagship bootcamps in one self-paced, 6-week (42-day) program: run the full NIST RMF as an ISSO / security assessor, assess third-party vendors, then implement an ISO 27001 ISMS, with hands-on labs, three capstones, an integrated capstone, and a curated day-by-day plan.
Choose how you learn
One bootcamp. Three ways to take it.
3Same role-based outcome. Pick the format that fits your life. Read it at your own pace with graded feedback, watch the video track, or join the live quarterly cohort.
Instructor-led
Watch the instructor teach on video: a guided track with self-checks, per-module interview prep and a hands-on lab.
In development
Self-paced
Read the full course in the portal at your own pace: lessons, graded quizzes and assignments your instructor reviews.
Available now in the Fourth Tech Hub
Live cohort
Real-time sessions with the practitioner on a quarterly schedule: accountable, interactive, and capped for attention. We open these as cohorts are scheduled.
Next cohort · Enroll anytime
How it works
Enroll once. Learn at your pace.
Enroll below and this bootcamp opens in your portal right away. Work through the modules, do the hands-on labs, and track your progress on your Schedule. Everything is self-paced.
Roles this prepares you for
- GRC Analyst
- ISO 27001 Implementer / Internal Auditor
- ISSO / Security Control Assessor
- Third-Party Risk Analyst
Standards & references
You'll build a portfolio of
- ISMS package (risk register, SoA, control evidence)
- SSP + POA&M + authorization summary
- Vendor risk assessment + decision package
- Integrated GRC capstone across all three domains
The curriculum
The 4 modules
4Phase 1: RMF / ISSO & Assessor (Weeks 1 to 2)
The ISSO role and RMF, categorize and select, implement and assess (SSP/SAR), authorize (ATO), continuous monitoring, toolkit and RMF capstone.
Phase 2: Third-Party Risk (Week 3)
TPRM foundations, intake and tiering, reviewing SOC 2 / ISO evidence, risk decisions, contracts and monitoring.
Phase 3: ISO 27001 (Weeks 4 to 5)
ISMS foundations, context and leadership, Annex A and the SoA, operating controls, internal audit, certification and ISMS capstone.
Phase 4: Integrated capstone and portfolio (Week 6)
Assess a vendor's ISMS, run an RMF-style assessment, produce a vendor decision package, and assemble a complete GRC portfolio.
The challenge
You can read the frameworks. Can you produce the evidence?
Every GRC job advert asks for the same three things, and almost no course teaches all three together. Candidates arrive able to define a control and unable to show one working.
Scattered study
RMF here, ISO 27001 there, third-party risk somewhere else. Each makes sense alone, and nothing shows how one feeds the next on a real engagement.
Nothing to show
A certificate says you attended. An interview asks what you produced. Most people finish training with notes and no artefacts anybody can read.
The evidence gap
Assessors, auditors and buyers all want documented work: an SSP, a Statement of Applicability, a vendor decision somebody signed. Explaining a framework is not that.
The transformation
From knowing the frameworks to producing the evidence
Three programmes in one, sequenced so each phase hands work to the next.
You can define a control
You can select, tailor and document one, and show where it is implemented
ISO 27001 and RMF feel like separate worlds
You move between them, and can say what an ISMS gives an RMF assessment
A vendor questionnaire is a form to fill in
You tier a vendor, read their SOC 2 properly, and write the decision
Your proof of learning is a certificate
A portfolio: an SSP, a POA&M, an SoA, a risk register and a vendor package
Interview answers are definitions
Interview answers are work you did, with the artefact open in front of you
Describes the capabilities this programme is designed to develop. Results vary with experience and effort. Completing a programme does not guarantee employment, promotion or acceptance by any employer.
The programme in numbers
What you actually receive
65
Hours of instruction
16
Modules
64
Lessons
16
Graded quizzes
14
Marked assignments
3
Courses included
Counted from the courses this enrolment grants, not written by hand, so they cannot drift from what you receive.
- ISO 27001:2022 Lead Implementer & Auditor Bootcamp — 6 modules, 29 hours
- ISSO & NIST RMF Bootcamp — 6 modules, 31 hours
- Third-Party Risk Management Specialist — 4 modules, 5 hours
Curriculum
What you will study, module by module
Phase 1: RMF and the ISSO role
- 1.The ISSO Role & the Risk Management Framework5 hours
- 2.RMF Categorize & Select: FIPS 199 and the 800-53 Baseline5 hours
- 3.RMF Implement & Assess: SSP, Assessment Methods, SAR & Findings5 hours
- 4.RMF Step 6, Authorize: The Package, the Risk Decision, and the ATO5 hours
- 5.Continuous Monitoring: the ISSO's Daily Work6 hours
- 6.The ISSO Toolkit & Capstone5 hours
Phase 2: Third-party risk
- 7.Why Third-Party Risk Matters and the Vendor Lifecycle1 hour
- 8.Intake, Tiering, and Due Diligence1h 30m
- 9.Reviewing SOC 2 and ISO 27001 Evidence1h 15m
- 10.Risk Decisions, Contracts, and Ongoing Monitoring1h 15m
Phase 3: ISO 27001, implementer and auditor
- 11.ISO 27001 & the ISMS: Clauses 4 to 104 hours
- 12.Context, Leadership & Planning (Clauses 4-6)5 hours
- 13.Annex A & the Statement of Applicability5 hours
- 14.Operation & Implementing the Controls5 hours
- 15.Performance Evaluation & the Internal Audit5 hours
- 16.Certification, Nonconformities, CAPA & Capstone5 hours
Calendar
A plan that fits around work
Week 1
10 hours
- 1.The ISSO Role & the Risk Management Framework
- 2.RMF Categorize & Select: FIPS 199 and the 800-53 Baseline
Week 2
10 hours
- 3.RMF Implement & Assess: SSP, Assessment Methods, SAR & Findings
- 4.RMF Step 6, Authorize: The Package, the Risk Decision, and the ATO
Week 3
12 hours
- 5.Continuous Monitoring: the ISSO's Daily Work
- 6.The ISSO Toolkit & Capstone
- 7.Why Third-Party Risk Matters and the Vendor Lifecycle
Week 4
13 hours
- 8.Intake, Tiering, and Due Diligence
- 9.Reviewing SOC 2 and ISO 27001 Evidence
- 10.Risk Decisions, Contracts, and Ongoing Monitoring
- 11.ISO 27001 & the ISMS: Clauses 4 to 10
- 12.Context, Leadership & Planning (Clauses 4-6)
Week 5
10 hours
- 13.Annex A & the Statement of Applicability
- 14.Operation & Implementing the Controls
Week 6
10 hours
- 15.Performance Evaluation & the Internal Audit
- 16.Certification, Nonconformities, CAPA & Capstone
Total 65 hours across 16 modules. Hours are the time the material is built to take, not a cap: nothing stops you going slower or faster.
Fit
Is this programme for you?
This is for you if
- You are moving into GRC from IT, audit, risk, compliance or an adjacent field.
- You have studied a framework and cannot yet show work an employer can read.
- You want the implementer and the assessor sides, because most roles touch both.
- You will do the assignments. The portfolio is the point, and it is marked.
This is not for you if
- You want a certificate for a CV line without doing the written work.
- You need an accredited or regulator-recognised qualification. This is a Fourth Tech certificate, not an accredited award, and we say so rather than implying otherwise.
- You are looking for a deeply technical security engineering course. This is governance, risk and compliance work.
- You want live instructor-led teaching. This programme is self-paced with marked assignments; live cohorts are a separate offering.
Outcomes
What you will be able to do
- Run the NIST Risk Management Framework end to end and produce the SSP, SAR and POA&M
- Build an ISO 27001 ISMS, write the Statement of Applicability and defend the risk decisions
- Audit an ISMS: plan it, classify nonconformities and follow the corrective action through
- Tier a vendor, read a SOC 2 report properly and write a defensible risk decision
- Assemble a portfolio of artefacts you can open in an interview
What you need
- No prior GRC experience. The programme starts from the vocabulary.
- A computer with a modern browser. The labs run in the browser, so no virtual machine and no particular operating system.
- Time for the written assignments. They are marked against a rubric, and skipping them removes the only thing that distinguishes you afterwards.
Your path to the certificate
- 01
Enrol
Pay once and the programme opens in your portal immediately.
- 02
Work the phases
RMF and the ISSO role, then third-party risk, then ISO 27001 as implementer and auditor.
- 03
Submit the assignments
Each module has a quiz marked on our server and an assignment marked against a rubric.
- 04
Build the capstone
An integrated assessment across all three domains, which becomes your portfolio centrepiece.
- 05
Earn the certificate
Issued with a unique ID and a public verification page anyone can check.
Hands-on labs
You don't watch. You do.
4Start anytime
Secure your seat for $3,000.
Enroll and this bootcamp opens in your portal right away, to work through at your own pace.