A fast decision game where cyber incidents become live broadcast stories. Review the evidence, call the risk and recommend a treatment that security leaders and the business can defend.
LIVE GRC COVERAGETake the analyst desk for a season of cyber showdowns. Study the evidence replay, call the risk and defend your recommendation before the shot clock runs out.
READ THE EVIDENCE. RATE THE RISK. EXPLAIN THE TRADEOFF.Governance, risk and compliance work connects security evidence to business objectives, obligations and accountable decisions. The best answer is not always the loudest response. It is the one supported by context, evidence and a clear owner.
A GRC analyst helps identify technology and compliance risks, evaluates whether controls are designed and operating as expected, maintains evidence and issue records, supports audits and translates technical findings into decisions leaders can understand. The role can cover policy, third-party risk, regulatory monitoring, control assurance and risk reporting.
Start with the business service, asset, data, owner and obligations. Review the relevant threat, weakness, control evidence and change history. Estimate likelihood and impact using the organisation’s approved method. Then recommend treatment, record the owner and deadline, and define what evidence will show that the risk changed.
Define strategy, policy, roles, oversight, risk appetite and supply-chain expectations.
Know assets, services, dependencies, vulnerabilities and risk to the organisation.
Use identity, awareness, data security, platform security and resilience safeguards.
Monitor assets and analyse events so suspicious behaviour becomes visible.
Manage, analyse, contain, communicate and mitigate during an incident.
Execute recovery, verify restoration and communicate progress to stakeholders.
A policy, process map or control description can show how a control is meant to work. Operating effectiveness needs evidence that the control actually ran, at the expected frequency, for the relevant population and period, with exceptions handled appropriately.
Mitigation introduces controls. Avoidance stops the risky activity. Transfer or sharing moves part of the impact through contracts or insurance. Acceptance retains the remaining exposure through an informed, authorised and reviewable decision.
The game uses simplified scenarios, but its structure follows established ideas from the NIST Cybersecurity Framework and recognised GRC career practice. Use the official material when applying these ideas in a real organisation.
NIST CSF 2.0 ↗NIST CSF AND ENTERPRISE RISK ↗ISACA GRC ANALYST ROLE ↗A governance, risk and compliance analyst helps an organisation understand obligations, assess technology risk, review controls, gather evidence, monitor issues and explain treatment decisions to risk owners and leaders.
Governance sets direction, accountability and oversight. Risk management identifies and treats uncertainty that can affect objectives. Compliance evaluates whether obligations and requirements are being met. Strong GRC work connects all three.
Control design asks whether a control could address the stated risk if implemented as intended. Operating effectiveness asks whether the control actually ran consistently and produced the expected result during the period being reviewed.
In many risk methods, inherent risk estimates exposure before selected controls. Residual risk describes the exposure that remains after controls and other treatments. Exact definitions and calculations vary by organisation and method.
Common options are to mitigate the risk with controls, avoid the risky activity, transfer or share part of the exposure, or accept the remaining risk through an informed and authorised decision.
Yes. Cyber Risk Center is free to play in a web browser on desktop or mobile, with no account or download required.
No. It is an educational simulation. Real assessments depend on the organisation, its obligations, evidence, systems, risk criteria and authorised decision makers.