Boards are asking for AI governance, not just AI adoption
As organisations roll out AI, leadership is increasingly asking GRC teams to own AI risk, accountability and policy — not just traditional IT risk.
Industry coverage
Incrito Pro · Cybersecurity GRC & AI Governance
Cybersecurity GRC& AI Governance
Enterprise risk, controls and compliance — for the age of AI
Practical cybersecurity Governance, Risk and Compliance training led by experienced industry professionals, with a focus on real-world enterprise risk, controls, compliance, and AI governance.
01The role
What a Cybersecurity GRC & AI Governance professional actually does
Part risk analyst, part auditor, part policy owner — and increasingly, the person an organisation turns to for how it governs AI. GRC professionals translate security and compliance requirements into controls the business can actually run.
Assess risk
Identify, assess and prioritise enterprise risks — from traditional IT and information security risk to AI-specific risk.
Design controls
Build and maintain controls and frameworks (such as ISO 27001) that reduce risk without blocking the business.
Run audits
Plan and run internal and third-party audits, track findings, and report status to stakeholders and leadership.
Own policy
Write and maintain the policies, standards and accountability structures an organisation actually follows.
Govern AI
Apply AI governance principles — risk identification, accountability, transparency and controls — to how the organisation adopts AI.
Work with the business
Translate risk and compliance requirements for engineering, vendor and business teams, and get buy-in instead of just a mandate.
02The industry signal
Why GRC and AI governance are converging into one discipline
Regulation and standards are moving fast
Frameworks like the NIST AI Risk Management Framework and ISO/IEC 42001 are becoming reference points for how enterprises are expected to govern AI.
Compliance trends
AI governance is becoming its own GRC specialism
Organisations are increasingly looking for GRC professionals who can bridge traditional risk and compliance work with AI-specific governance and controls.
Jobs data
03Outcomes
Where this program takes you
Enterprise GRC skills, applied to today's biggest governance challenge — AI. That combination is increasingly what organisations are looking for as they formalise how they manage AI risk.
Roles you can target
GRC AnalystIT Risk & Compliance AnalystInformation Security Compliance SpecialistIT AuditorThird-Party Risk AnalystAI Governance Analyst
04Curriculum
Enterprise GRC, with AI governance built in
A practical, project-based curriculum covering core cybersecurity GRC skills end to end, then extending into AI governance and AI risk management — the fastest-growing part of the discipline.
Module 1 - Foundations of Cybersecurity Governance, Risk & Compliance
What governance, risk and compliance actually mean inside an enterprise, how the three connect, and where a GRC professional sits relative to security, audit and the business.
Project: Map a sample organisation's governance structure and risk ownership
Topics covered
Governance
- What governance, risk and compliance mean in practice
- How GRC fits with security, audit and the business
Fundamentals
- Risk terminology and the risk management lifecycle
- Roles and accountability in a GRC program
Module 2 - Risk Assessment & Enterprise Risk Management
Hands-on risk assessment: building and maintaining a risk register, scoring likelihood and impact, and prioritising what actually gets fixed first.
Project: Build a risk register for a sample enterprise environment
Topics covered
Assess
- Risk identification and risk registers
- Likelihood/impact scoring and risk prioritisation
Manage
- Risk treatment — accept, mitigate, transfer, avoid
- Reporting risk to leadership
Module 3 - Controls, Frameworks & Compliance
How to design, implement and evidence controls that satisfy recognised frameworks like ISO 27001 — without turning compliance into box-ticking.
Project: Run a control gap assessment against ISO 27001
Topics covered
Frameworks
- ISO 27001 and common control frameworks
- Mapping controls to risk
Implement
- Control design, ownership and evidence
- Compliance monitoring and reporting
Module 4 - IT Audit & Third-Party Risk
Planning and running an IT audit from scoping to findings, plus assessing the risk a vendor or third party brings into the organisation.
Project: Run a mock IT audit and a vendor risk assessment
Topics covered
Audit
- Audit planning, fieldwork and findings
- Tracking remediation and re-testing
Third parties
- Vendor and supply-chain risk assessment
- Ongoing third-party monitoring
Module 5 - Privacy & Regulatory Compliance
How privacy and data-protection obligations translate into day-to-day GRC work — policies, data handling controls and working with legal and security teams.
Project: Draft a data-handling policy and a privacy control checklist
Topics covered
Privacy
- Core data-protection and privacy principles
- Privacy by design in practice
Apply
- Policy writing for data handling
- Working with legal, security and the business
Module 6 - AI Governance Principles & Policy
How organisations are expected to govern AI adoption — accountability, policy, and the reference frameworks (NIST AI RMF, ISO/IEC 42001) GRC teams are increasingly asked to apply.
Project: Draft an AI governance policy for a sample organisation
Topics covered
Govern
- AI governance principles and accountability structures
- The NIST AI Risk Management Framework
Standardise
- ISO/IEC 42001 AI management systems
- Building an AI governance policy
Module 7 - AI Risk Management & Responsible AI
Identifying and managing AI-specific risk: bias, transparency, security and privacy considerations, and the controls and vendor-risk questions that come with adopting third-party AI tools.
Project: Run an AI risk assessment on a sample AI use case
Topics covered
Identify
- AI risk identification and assessment
- Responsible AI — bias, transparency, privacy, security
Control
- AI-related controls and monitoring
- AI vendor and third-party risk
Module 8 - Capstone: Applied GRC & AI Governance
A practical capstone that ties together a risk assessment, a control/compliance review and an AI governance deliverable — the kind of work a mentor panel reviews and you can show a hiring manager.
Project: A combined risk, compliance and AI governance deliverable, reviewed by mentors
Topics covered
Build
- Combine a risk assessment, control review and AI governance artefact
- Present findings and recommendations
Review
- Mentor panel review and feedback
- Assessment and program wrap-up
05Projects
What you'll have worked on by the end
Practical, reviewable GRC and AI-governance work you can walk a hiring manager through.
Enterprise risk register
Identify, score and prioritise risk across a sample enterprise environment, and recommend treatment for the top findings.
Risk assessmentRisk register
ISO 27001 control gap assessment
Assess a sample environment against ISO 27001 controls, document gaps and propose a remediation plan.
ControlsISO 27001Compliance
Mock IT audit & vendor risk review
Plan and run a mock IT audit end to end, and assess the risk a third-party vendor introduces.
IT auditThird-party risk
AI governance policy
Draft an AI governance policy for a sample organisation, grounded in the NIST AI RMF and ISO/IEC 42001.
AI governancePolicy
AI risk assessment
Run a structured risk assessment on a sample AI use case — bias, transparency, security and vendor risk included.
AI riskResponsible AI
Capstone: combined GRC & AI governance deliverable
Bring risk, controls/compliance and AI governance together into one reviewable deliverable, presented to a mentor panel.
CapstoneEnd-to-end
06Mentors
Learn from practising GRC and cybersecurity leaders
Mentors with real enterprise GRC, audit and security leadership experience — including hands-on exposure to AI-aware governance and controls.
S. Venkatasubramanian
23+ years · CISM, CISA, ISO 27001 Lead Auditor,
Ramesh Bhat
20+ years · CISSP, CISA, CISM,
Rajesh
15+ years · CISA, CRISC, CIPM, ISO 27001 Lead Auditor,
S. Venkatasubramanian
23+ years · CISM, CISA, ISO 27001 Lead Auditor,
Ramesh Bhat
20+ years · CISSP, CISA, CISM,
Rajesh
15+ years · CISA, CRISC, CIPM, ISO 27001 Lead Auditor,
07The Incrito Pro method
The foundation behind the program
Structured Curriculum
A structured path through core GRC skills — risk, controls, compliance and audit — before extending into AI governance and AI risk management, the fastest-growing part of the field.
Module 1: Foundations of Cybersecurity Governance, Risk & Compliance
Module 2: Risk Assessment & Enterprise Risk Management
Module 3: Controls, Frameworks & Compliance
1:1 Expert Mentorship
Learn from, and get project feedback from, practising GRC and cybersecurity leaders — not instructors reading from a script.
Placement Support
Career support once you've completed the program.
- Resume and LinkedIn review for GRC/AI-governance roles
- Mock interviews with mentors
- Referral guidance into Incrito's hiring network
- Access to the Incrito alumni community
Live Classes (Assignments + Projects)
Work through guided assignments and practical GRC/AI-governance scenarios with mentor feedback throughout.
Risk register & assessment
Control gap assessment (ISO 27001)
AI governance policy & risk review — capstone
08Who it's for
Built for professionals moving into — or further into — GRC
This program is for you if
- Security, IT and compliance professionals who want to move into GRC
- GRC analysts who want to add structured AI governance skills
- IT auditors and risk analysts broadening into AI risk
- Engineers or team leads taking on governance and compliance responsibility
What you’ll need coming in
- A working understanding of information security fundamentals
- Some professional exposure to IT, security, audit or compliance is helpful
- No prior AI/ML experience required — the AI governance modules start from first principles
09Cohort and pricing
The next cohort
Live, mentor-led cohorts with limited seats so every project gets mentor feedback.
Next start
Cohorts open regularly — ask our admissions team for the next start date
Format
Live online · mentor-led sessions + LMS access to recorded sessions
Length
Program fee
Request details & apply Shared on a 20-minute call
You'll get the exact fee, batch schedule and any available scholarship or EMI options on your enquiry call.
What’s included
- Live, mentor-led sessions with practising GRC and cybersecurity leaders
- Real-world GRC and AI governance projects and assessments
- LMS access to recorded sessions
- Resume, LinkedIn and interview preparation support
- Access to the Incrito alumni community
Interview guarantee. Finish the program and clear the mock-interview bar, and we guarantee 5+ hiring-partner first-round interviews within 6 months of completing the program — or a full refund. Job assistance then continues until you’re placed.
10Apply now
Start your application
A short form — our admissions team will follow up to answer questions and share batch and fee details.
11FAQ
Questions, answered
Do I need prior AI or machine-learning experience?
No. The AI governance modules are built for GRC and security professionals, not AI practitioners — they start from first principles and focus on governance, risk and policy, not building AI systems.
Do I need prior GRC experience to join?
Some exposure to IT, security, audit or compliance helps, but the program starts from GRC fundamentals before moving into more advanced and AI-specific topics.
Is the program live or recorded?
Sessions are live and mentor-led. You also get LMS access to recorded sessions, so you can revisit material or catch up if you miss a live session.
What frameworks and standards does the AI governance content cover?
The AI governance modules are built around the NIST AI Risk Management Framework and ISO/IEC 42001, alongside core responsible-AI considerations — bias, transparency, privacy and security.
Will I get a certificate?
Yes — you'll receive a certificate of completion from Incrito. Exact certification details are confirmed during the program.
What support do I get with placements?
Resume and LinkedIn review, mock interviews with mentors, and referral guidance into Incrito's hiring network once you've completed the program.
How much is the fee, and can I pay in instalments?
We share the exact fee on a short call, together with any scholarship or no-cost EMI option you qualify for, so the number you hear already reflects what applies to you.
Next cohort filling now
Apply to the Cybersecurity GRC & AI Governance program
A short application and a call with our admissions team — ask questions, and get your batch and fee details.