How to get into GRC, and which certification fits a US role

GRC as a way into cybersecurity without coding

You don't need to write code to work in governance, risk and compliance, and Mindset Cyber's PECB route in begins with the ISO/IEC 27001 Foundation, then the Lead Implementer for building a security program or the Lead Auditor for testing one.

Six backgrounds that lead into GRC

• Audit. Internal and IT auditors already test controls and document exceptions. ISC2 lists cybersecurity auditor among the positions its CGRC suits, and the PECB Lead Auditor applies the same craft to an ISMS.
• Risk. Enterprise risk managers and third party risk managers are on the same ISC2 list. Vendor security reviews, risk ratings and treatment decisions carry straight over.
• Compliance. A compliance officer already maps requirements to evidence. On a security team the requirements come from NIST publications, SOC 2 criteria and customer contracts.
• Quality. ISO 9001 internal auditors know corrective action and document control, which an ISO/IEC 27001 management system runs on as well.
• Legal. In CyberSN's analysis of US postings, much of GRC's growing share comes from privacy and cybersecurity attorneys, while total cyber postings fell 26.4% (January to September 2026 against 2025). Legal work is part of GRC, and privacy is where it meets security.
• Project management. ISC2 lists the cybersecurity risk and compliance project manager, and PECB counts ISMS implementation projects toward the Lead Implementer's hours.

What the job involves at a US company

A typical week might cover evidence for a SOC 2 examination, a NIST CSF 2.0 profile comparing where the organization stands with where it wants to be, a vendor's security questionnaire, risk assessments and policy updates, and, at a defense contractor, the NIST SP 800-171 requirements the DFARS clause sets. It is reading, judging and documenting: you need to understand the systems involved, but you don't program them.

The route, step by step

1. ISO/IEC 27001 Foundation, US$279. It takes about 10 to 15 hours of study (our estimate, not a PECB figure), with 12 months of access, and leads to a PECB certificate that needs no work experience.
2. Lead Implementer or Lead Auditor, US$589 each. Each takes about 30 to 40 hours of study (our estimate, not a PECB figure). Pass without experience and you hold the Provisional level; the Implementer or Auditor level asks for 2 years of work, 1 in information security management, and 200 hours of project or audit activity, and the Lead level for 5 years, 2 in that field, and 300 hours.
3. A framework credential, if your program needs one. PECB's NIST Cybersecurity Lead Implementer and Lead SOC 2 Manager are US$589 each as PECB Self-Study, with about 30 to 40 hours of study (our estimate, not a PECB figure). A pass without experience earns the Provisional level, and their Lead levels need 5 years of work, 2 in cybersecurity for NIST or in information security for SOC 2, and 300 hours.

Any applicable taxes are calculated at checkout.

Every course includes the PECB exam voucher, two exam attempts and the certification fee, and comes with the Mindset Cyber learner hub: questions to a PECB Certified Trainer, answered within two days, and a members-only community of learners on the same exam.

Which US frameworks do GRC teams work with?

Beside ISO/IEC 27001, the US frameworks GRC teams work with include NIST CSF 2.0, SOC 2 and, at defense contractors, NIST SP 800-171 with CMMC, and Mindset Cyber's PECB NIST Cybersecurity Lead Implementer and Lead SOC 2 Manager are built for the first two.

NIST CSF 2.0

NIST published CSF 2.0 on February 26, 2024. It organizes cybersecurity outcomes under six Functions, Govern, Identify, Protect, Detect, Respond and Recover, and most organizations use it voluntarily. NIST says it "does not offer certifications or endorsements of CSF-related products, implementations, or services", so the GRC job is building the program and reporting on it, not earning a certificate.

SOC 2

A SOC 2 report comes from a CPA's examination of a service organization's controls, one of the AICPA's SOC services; it is a report, not a certification. The GRC job is readiness: putting the controls in place, gathering the evidence and keeping it current between reports.

NIST SP 800-171 and CMMC

The DFARS 252.204-7012 clause says "The Contractor shall implement NIST SP 800-171", and CMMC is the Department of Defense's program for assessing its contractors against those requirements. As Holland & Knight reported on July 31, 2026, CMMC Phase II, which had been due on November 10, 2026, was suspended on July 13, 2026, while Phase I and its self-assessments stayed in effect. Check the current status before planning assessment work: our NIST CSF, SOC 2 and CMMC guide carries a dated status and matches each framework to a PECB course.

Next steps

Every course is priced in US dollars and includes the PECB exam voucher, two exam attempts and the certification fee.