There are more security frameworks than any one person needs. The useful question is not which is best, it is which one answers the question in front of you.
Weeks 4 and 5 answer two of them. The CIS Controls answer what should we do first. Governance, risk, and compliance answers how do we prove we did it.
Why Frameworks Exist at All
A framework is a list somebody else already argued about. Without one, security work gets set by whoever spoke last, or by whichever vendor sent the scariest slide deck.
The CIS Critical Security Controls get taught first because they are ordered. They are not a menu, they are a sequence, and the sequence reflects what actually reduces risk per dollar. The Center for Internet Security publishes them free at cisecurity.org.
Controls 1 to 6: Know What You Have
The first controls are about inventory and access, and they are first for a reason. You cannot protect what you do not know you own, and the majority of real incidents involve a system nobody was tracking or an account nobody was watching.
This group covers enterprise asset inventory, software inventory, data protection, secure configuration, account management, and access control management. None of it is exciting. All of it shows up in incident reports as the thing that was missing.
Controls 7 to 12: Keep It Healthy
Continuous vulnerability management, audit log management, email and browser protections, malware defenses, data recovery, and network infrastructure management. This is the maintenance tier, and it is where the vulnerability management program lives.
The recurring lesson is that these are programs, not projects. A scan you ran once is a report. A scan you run every week with a process behind it is a control.
Controls 13 to 18: Watch, Train, and Test
Network monitoring and defense, security awareness training, service provider management, application software security, incident response management, and penetration testing.
This group maps almost directly onto the second half of the mentorship. Control 13 is the SOC. Control 15 is third party risk. Control 17 is incident response. Control 18 is penetration testing.
What GRC Actually Is
Governance is deciding who gets to decide. Risk is being honest about what could go wrong and how much you care. Compliance is proving to somebody outside the company that you did what you said.
The framework landscape gets mapped in Week 5, including SOC 2, ISO 27001, and CMMC, which matters a great deal to any company in the defense supply chain. Our compliance frameworks guide covers how they differ.
Risk Registers and Honest Numbers
A risk register is a list of things that could hurt you, with an owner, a likelihood, an impact, and a decision. The decision is one of four: accept it, reduce it, transfer it, or avoid it.
The hard part is honesty. Numbers get bent to justify a decision that was already made, and a register full of comfortable numbers is worse than no register at all, because it looks like diligence. You practice writing entries that survive being questioned.
Audit Evidence: Making Messy Data Answer a Question
An auditor does not want your opinion. They want evidence that a control operated, over a period, for the whole population, with no gaps.
So you get handed messy exports and a specific question, and you have to produce a clean answer. The course shows both routes: the spreadsheet way, which most of the business world uses, and the shell way with grep, cut, sort, uniq, and awk, which is faster and reproducible once you know it.
The challenge is to provide the auditors with data. There is a quiz built around an auditor's report, plus supplemental videos walking through both the Excel and the Bash solution once you have tried it yourself.
Learn This at HackRange
If you have no technical background, this is often the fastest door into the field. GRC roles are real security jobs and they hire people who can write clearly and think in evidence.