Free Cyber Security Compliance Officer Roadmap
The GRC career at its entry, for compliance officers and security auditors: keep the organisation on the right side of the standards and the regulators, and check that the controls work. Security+ for the grounding, ITIL where the organisation runs on it, GRC, PCI DSS and privacy for the substance, the controls hands on, then ISO 27001 and CISA.
7 steps · 70 free videos · 9 free reads
Create your free account to open all 2,396 free items
The 79 free items on this page — and every other free lesson, video and guide — open once you have a free StationX account. No card, no trial.
Before you start
Read these first
The free roadmap
7 steps, in order
The 🔒 rows show what the full roadmap adds at each step. StationX Membership opens every course and its labs: $299 / year ($24.92/mo billed annually). Infrastructure Labs labs are a separate add-on.
Start here →
Step 1 — Security foundation
The technical vocabulary compliance and audit work is written in.
Follow the free CompTIA Security+ (SY0-701) roadmap.
🔒 The full roadmap adds here: 6 full courses · hands-on labs 1–148 of 159 (courses in Membership · 71 labs in Membership · 77 labs in Infrastructure Labs)
- Course · CompTIA Security+ Certification (SY0-701): The Total Course · 🔒 Membership
- Course · Security+ (SY0-701) - Self-paced Course! · 🔒 Membership
- Course · CompTIA Security+ SY0-701: General Security Concepts · 🔒 Membership
- Course · CompTIA Security+: Viruses, Threats and Compromise Indicators · 🔒 Membership
- Course · CompTIA Security+ Labs · 🔒 Membership
- Course · Security+ Just Labs: The Ultimate Hands-On Bootcamp · 🔒 Membership
- Lab 1 of 159 · Additional Scanning Options · 🔒 Membership
- Lab 2 of 159 · Basics of Metasploit · 🔒 Membership
- Lab 3 of 159 · BCP DRP and Test Planning · 🔒 Membership
- Lab 4 of 159 · BitLocker Setup · 🔒 Membership
- Lab 5 of 159 · Block Incoming Traffic on Known Port · 🔒 Membership
- Lab 6 of 159 · Comparing Controls · 🔒 Membership
- Lab 7 of 159 · Creating a List of Installed Programs, Services and User Accounts from a WIN2K12 Server · 🔒 Membership
- Lab 8 of 159 · Creation of BCP and DRP · 🔒 Membership
- Lab 9 of 159 · Data Backup to Prep for Recovery · 🔒 Membership
- Lab 10 of 159 · Event Log · 🔒 Membership
- Lab 11 of 159 · Host Data Integrity Baselining · 🔒 Membership
- Lab 12 of 159 · Installing Patches and Testing Software · 🔒 Membership
- Lab 13 of 159 · MITRE - Attack · 🔒 Membership
- Lab 14 of 159 · MITRE - Defend · 🔒 Membership
- Lab 15 of 159 · Network Discovery · 🔒 Membership
- Lab 16 of 159 · Network Segmentation (FW/DMZ/WAN/LAN) · 🔒 Membership
- Lab 17 of 159 · Network Topology Generation · 🔒 Membership
- Lab 18 of 159 · Open Source Collection · 🔒 Membership
- Lab 19 of 159 · Open Source Password Cracking · 🔒 Membership
- Lab 20 of 159 · Scanning From Windows · 🔒 Membership
- Lab 21 of 159 · Windows Event Log Manipulation via Windows Event Viewer · 🔒 Membership
- Lab 22 of 159 · Wireshark · 🔒 Membership
- Lab 23 of 159 · Manage Users and Groups in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 24 of 159 · Manage Users and Groups in Windows [Guided] · 🔒 Infrastructure Labs
- Lab 25 of 159 · Can You Manage Users and Groups in Windows and Linux? [Advanced] · 🔒 Infrastructure Labs
- Lab 26 of 159 · Configure Password Management in Windows [Guided] · 🔒 Infrastructure Labs
- Lab 27 of 159 · Configure Password Management in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 28 of 159 · Can You Manage Password Requirements in Windows and Linux? [Advanced] · 🔒 Infrastructure Labs
- Lab 29 of 159 · Configure Standard Linux Permissions [Guided] · 🔒 Infrastructure Labs
- Lab 30 of 159 · Configure Standard Windows Permissions [Guided] · 🔒 Infrastructure Labs
- Lab 31 of 159 · Can You Configure Standard Linux and Windows Permissions? [Advanced] · 🔒 Infrastructure Labs
- Lab 32 of 159 · Can You Manage Access in Linux and Windows? [Expert] · 🔒 Infrastructure Labs
- Lab 33 of 159 · Can You Harden the SSH Service on a Linux Server? [Advanced} · 🔒 Infrastructure Labs
- Lab 34 of 159 · Force Users to Change Password Upon First Sign In [Guided] · 🔒 Infrastructure Labs
- Lab 35 of 159 · Remove a User Account [Guided] · 🔒 Infrastructure Labs
- Lab 36 of 159 · Can You Add Server Access for a Group? [Advanced] · 🔒 Infrastructure Labs
- Lab 37 of 159 · Examine Log Files to Block Bad Actors [Guided] · 🔒 Infrastructure Labs
- Lab 38 of 159 · Harden a Server by Limiting Access to a Single Subnet [Guided] · 🔒 Infrastructure Labs
- Lab 39 of 159 · Can You Harden a Server by Restricting Access per Protocol? [Advanced] · 🔒 Infrastructure Labs
- Lab 40 of 159 · Can You Harden a Linux Web Server? [Expert] · 🔒 Infrastructure Labs
- Lab 41 of 159 · Deploy a Private Certificate Authority [Guided] · 🔒 Infrastructure Labs
- Lab 42 of 159 · Configure Custom Certificate Templates and Deployment Options [Guided] · 🔒 Infrastructure Labs
- Lab 43 of 159 · Manually Request a PKI Certificate [Guided] · 🔒 Infrastructure Labs
- Lab 44 of 159 · Can You Deploy a Certificate Authority and Issue Certificates? [Advanced] · 🔒 Infrastructure Labs
- Lab 45 of 159 · Enable DNSSEC [Guided] · 🔒 Infrastructure Labs
- Lab 46 of 159 · Use EFS To Encrypt Files on NTFS Volumes [Guided] · 🔒 Infrastructure Labs
- Lab 47 of 159 · Can You Secure DNS Resource Records and Windows NTFS Volume File Objects? [Advanced] · 🔒 Infrastructure Labs
- Lab 48 of 159 · Enable SSL/TLS on a Website [Guided] · 🔒 Infrastructure Labs
- Lab 49 of 159 · Enable Client SSL/TLS [Guided] · 🔒 Infrastructure Labs
- Lab 50 of 159 · Can You Secure a Website with an SSL/TLS Certificate? [Advanced] · 🔒 Infrastructure Labs
- Lab 51 of 159 · Can You Use PKI to Secure a Network Environment? [Expert] · 🔒 Infrastructure Labs
- Lab 52 of 159 · Cryptography: Attacking Classic Ciphers · 🔒 Membership
- Lab 53 of 159 · Cryptography: Breaking Repeated Key XOR Cipher · 🔒 Membership
- Lab 54 of 159 · Cryptography: Breaking Weak RSA Keys · 🔒 Membership
- Lab 55 of 159 · Cryptography: Decrypting Files With a Dictionary Attack · 🔒 Membership
- Lab 56 of 159 · Cryptography: Forging Digital Signatures · 🔒 Membership
- Lab 57 of 159 · Cryptography: Forging MACs With Side Channels · 🔒 Membership
- Lab 58 of 159 · Cryptography: Hidden Veracrypt Containers · 🔒 Membership
- Lab 59 of 159 · Cryptography: Man In the Middle Attack · 🔒 Membership
- Lab 60 of 159 · Cryptography: Password Cracking · 🔒 Membership
- Lab 61 of 159 · Cryptography: Setting Up HTTPS in Windows and Linux · 🔒 Membership
- Lab 62 of 159 · Cryptography: Setting Up Two Factor Authentication · 🔒 Membership
- Lab 63 of 159 · Cryptography: Steganography · 🔒 Membership
- Lab 64 of 159 · Cryptography: Using GPG for Encryption and Key Management · 🔒 Membership
- Lab 65 of 159 · Cryptography: Using the OpenSSL CLI Tool · 🔒 Membership
- Lab 66 of 159 · Getting Started with Security Concepts in Windows and Linux Environments [Getting Started] · 🔒 Infrastructure Labs
- Lab 67 of 159 · Configure Windows Firewall ACL Rules [Guided] · 🔒 Infrastructure Labs
- Lab 68 of 159 · Configure Linux Firewall ACL Rules [Guided] · 🔒 Infrastructure Labs
- Lab 69 of 159 · Configure Security Settings by Using Microsoft Group Policy [Guided] · 🔒 Infrastructure Labs
- Lab 70 of 159 · Identify Non-secure Network Traffic [Guided] · 🔒 Infrastructure Labs
- Lab 71 of 159 · Can You Secure Host Settings Through Firewall Settings and Group Policy? [Advanced] · 🔒 Infrastructure Labs
- Lab 72 of 159 · Configure IPSec [Guided] · 🔒 Infrastructure Labs
- Lab 73 of 159 · Configure a Windows PPTP VPN [Guided] · 🔒 Infrastructure Labs
- Lab 74 of 159 · Can You Secure Network Access? [Advanced] · 🔒 Infrastructure Labs
- Lab 75 of 159 · Can You Harden Windows Hosts? [Expert] · 🔒 Infrastructure Labs
- Lab 76 of 159 · Back Up and Restore Data in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 77 of 159 · Back Up and Restore Data in Windows [Guided] · 🔒 Infrastructure Labs
- Lab 78 of 159 · Can You Back Up and Restore Data in Windows and Linux? [Advanced] · 🔒 Infrastructure Labs
- Lab 79 of 159 · Configure and Test the Firewall in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 80 of 159 · Configure and Test the Firewall in Windows [Guided] · 🔒 Infrastructure Labs
- Lab 81 of 159 · Can You Configure the Firewall in Linux and Windows? [Advanced] · 🔒 Infrastructure Labs
- Lab 82 of 159 · Configure Patch Management in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 83 of 159 · Configure Update Management in Windows [Guided] · 🔒 Infrastructure Labs
- Lab 84 of 159 · Can You Configure Update Management in Linux and Windows? [Advanced] · 🔒 Infrastructure Labs
- Lab 85 of 159 · Can You Manage Windows and Linux Systems? [Expert] · 🔒 Infrastructure Labs
- Lab 86 of 159 · Applying Filters to TCPDump and Wireshark · 🔒 Membership
- Lab 87 of 159 · DNS as a Remote Shell · 🔒 Membership
- Lab 88 of 159 · Firewall Setup and Configuration · 🔒 Membership
- Lab 89 of 159 · Gap Analysis of Firewall Rules · 🔒 Membership
- Lab 90 of 159 · Implementing Least-Privilege on Windows · 🔒 Membership
- Lab 91 of 159 · Setting Up Zones in a Firewall · 🔒 Membership
- Lab 92 of 159 · Snorby Setup and Operation · 🔒 Membership
- Lab 93 of 159 · TCPDump · 🔒 Membership
- Lab 94 of 159 · Tweaking Firewall Rules for Detection · 🔒 Membership
- Lab 95 of 159 · Using Snort and Wireshark to Analyze Traffic · 🔒 Membership
- Lab 96 of 159 · Getting Started with Cybersecurity Defensive Tools [Getting Started] · 🔒 Infrastructure Labs
- Lab 97 of 159 · Managing Log Files on a Windows Server [Guided] · 🔒 Infrastructure Labs
- Lab 98 of 159 · Configure Windows Defender on a Windows System [Guided] · 🔒 Infrastructure Labs
- Lab 99 of 159 · Configure a Local Security Policy on Server 2016 [Guided] · 🔒 Infrastructure Labs
- Lab 100 of 159 · Can You Use the Sysinternals Suite to Review Permissions on a Windows System? [Advanced] · 🔒 Infrastructure Labs
- Lab 101 of 159 · Using Encryption to Secure Information [Guided] · 🔒 Infrastructure Labs
- Lab 102 of 159 · Can You Configure Drive Encryption by Using LUKS and BitLocker? [Advanced] · 🔒 Infrastructure Labs
- Lab 103 of 159 · Can You Configure Remote Administration by Using PuTTY and SSH? [Expert] · 🔒 Infrastructure Labs
- Lab 104 of 159 · Use a Password Cracking Utility in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 105 of 159 · Can You Use PowerShell to Gather Computer Information in Windows? [Advanced] · 🔒 Infrastructure Labs
- Lab 106 of 159 · Escalate Privileges in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 107 of 159 · Can You Enumerate Network Services by Using Port Scanning in Linux? [Advanced] · 🔒 Infrastructure Labs
- Lab 108 of 159 · Auditing Service Accounts and Setting Up Automated Log Collection · 🔒 Membership
- Lab 109 of 159 · Centralized Monitoring · 🔒 Membership
- Lab 110 of 159 · CIRP Creation and Disaster · 🔒 Membership
- Lab 111 of 159 · Creation of Standard Operating Procedures for Recovery · 🔒 Membership
- Lab 112 of 159 · Data Downloads and Validation · 🔒 Membership
- Lab 113 of 159 · Force Point: DLP Email Overview · 🔒 Membership
- Lab 114 of 159 · Force Point: DLP Network Overview · 🔒 Membership
- Lab 115 of 159 · Identifying Key Assets · 🔒 Membership
- Lab 116 of 159 · Leveraging Internal Intelligence Resources · 🔒 Membership
- Lab 117 of 159 · Log Correlation & Analysis to Identify Potential IOC · 🔒 Membership
- Lab 118 of 159 · Monitoring and Verifying Management Systems · 🔒 Membership
- Lab 119 of 159 · Open and Close Ports on Windows 7 · 🔒 Membership
- Lab 120 of 159 · Phishing · 🔒 Membership
- Lab 121 of 159 · Post Incident Service Restoration · 🔒 Membership
- Lab 122 of 159 · Ransomware · 🔒 Membership
- Lab 123 of 159 · Recover from SQL Injection Attack · 🔒 Membership
- Lab 124 of 159 · Sensitive Information Identification · 🔒 Membership
- Lab 125 of 159 · Vulnerability Identification and Remediation · 🔒 Membership
- Lab 126 of 159 · Use Git to Manage Code [Guided] · 🔒 Infrastructure Labs
- Lab 127 of 159 · Analyze Log Files for Malicious Activity [Guided] · 🔒 Infrastructure Labs
- Lab 128 of 159 · Identify and Manage Old Software [Guided] · 🔒 Infrastructure Labs
- Lab 129 of 159 · Deploy a Docker Container [Guided] · 🔒 Infrastructure Labs
- Lab 130 of 159 · Deploy a Virtual Machine [Guided] · 🔒 Infrastructure Labs
- Lab 131 of 159 · Configure a Jump Box [Guided] · 🔒 Infrastructure Labs
- Lab 132 of 159 · Manage File Redundancy for Resilience and Recovery [Guided] · 🔒 Infrastructure Labs
- Lab 133 of 159 · Manage System Restore Using Windows 11 [Guided] · 🔒 Infrastructure Labs
- Lab 134 of 159 · Use Alerting and Monitoring Tools [Guided] · 🔒 Infrastructure Labs
- Lab 135 of 159 · Digitally Sign Code To Verify Authenticity [Guided] · 🔒 Infrastructure Labs
- Lab 136 of 159 · Configure a Wireless Access Point [Guided] · 🔒 Infrastructure Labs
- Lab 137 of 159 · Sanitize Storage Disks [Guided] · 🔒 Infrastructure Labs
- Lab 138 of 159 · Enhance Security by Using SELinux [Guided] · 🔒 Infrastructure Labs
- Lab 139 of 159 · Manage Configurations by Using Ansible [Guided] · 🔒 Infrastructure Labs
- Lab 140 of 159 · Configure Devices by Using Ansible [Guided] · 🔒 Infrastructure Labs
- Lab 141 of 159 · Perform Security Audits on Linux Services [Guided] · 🔒 Infrastructure Labs
- Lab 142 of 159 · Baseline Systems in Accordance with Policy Documentation · 🔒 Membership
- Lab 143 of 159 · Conduct Baseline Comparison for Indicators of Compromise · 🔒 Membership
- Lab 144 of 159 · Creating a Baseline Using Autopsy · 🔒 Membership
- Lab 145 of 159 · Creating a Secondary Baseline and Conducting Comparison · 🔒 Membership
- Lab 146 of 159 · Manually Creating a Baseline with MD5Deep · 🔒 Membership
- Lab 147 of 159 · Recovering Data and Data Integrity Checks · 🔒 Membership
- Lab 148 of 159 · Windows Deployment Services · 🔒 Membership
Step 2 — Service management (recommended if your organisation runs on ITIL)
The process framework the controls you check are built on, and your audit evidence comes from. Take it if your organisation runs on ITIL.
Follow the free ITIL 4 Foundation roadmap.
🔒 The full roadmap adds here: 3 full courses (Membership)
- Course · ITIL 4 Foundation: Complete Course Part 1 · 🔒 Membership
- Course · ITIL 4 Foundation: Complete Course Part 2 · 🔒 Membership
- Course · ITIL 4 Foundation: Complete Course Part 3 · 🔒 Membership
Step 3 — Governance, risk and compliance
Policies, controls, evidence and risk assessment — the compliance officer's daily work — and PCI DSS for anyone handling card data.
🔒 The full roadmap adds here: 2 full courses (Membership)
- Course · Governance, Risk and Compliance (GRC) · 🔒 Membership
- Course · An Introduction to PCI-DSS · 🔒 Membership
Step 4 — Privacy and data protection
GDPR and privacy by design — the regulation most compliance roles carry.
🔒 The full roadmap adds here: 2 full courses (Membership)
- Course · EU GDPR Foundations Course · 🔒 Membership
- Course · Ultimate Privacy by Design MasterCourse (GDPR, CCPA etc) · 🔒 Membership
Step 5 — The controls, hands on
See controls built and evidenced — baselines, logging, privileged access, compliance evidence — and rate the risk they treat. SOX ITGC and COBIT, which audit adverts name, are learned on the job; no course for them is sold here.
Hands-on step: the labs for it are on the full roadmap.
🔒 The full roadmap adds here: hands-on labs 149–159 of 159 (Infrastructure Labs)
- Lab 149 of 159 · Enforce Segmentation and Approved Access Paths [Guided] · 🔒 Infrastructure Labs
- Lab 150 of 159 · Harden a JumpBox for Secure Administration [Guided] · 🔒 Infrastructure Labs
- Lab 151 of 159 · Secure Privileged Access and Auditing in Active Directory [Guided] · 🔒 Infrastructure Labs
- Lab 152 of 159 · Establish a Windows Hardening and Security Logging Baseline [Guided] · 🔒 Infrastructure Labs
- Lab 153 of 159 · Reduce DVWA Exposure by Using Compensating Controls [Guided] · 🔒 Infrastructure Labs
- Lab 154 of 159 · Implement TLS and Certificate Controls for a Service [Guided] · 🔒 Infrastructure Labs
- Lab 155 of 159 · Integrated Hardening Sprint A: Segment, Harden, and Secure Services [Advanced] · 🔒 Infrastructure Labs
- Lab 156 of 159 · Governance and Compliance Evidence Collection [Guided] · 🔒 Infrastructure Labs
- Lab 157 of 159 · Prioritize Risks and Implement One Remediation [Guided] · 🔒 Infrastructure Labs
- Lab 158 of 159 · Threat Modeling to Controls: Identify Risks and Implement Mitigations [Guided] · 🔒 Infrastructure Labs
- Lab 159 of 159 · Establish centralized logging by onboarding hosts and validating monitoring readiness [Guided] · 🔒 Infrastructure Labs
Try a free cloud security lab: Left open (~4 min) → A scripted simulation in your browser. No account needed.
Step 6 — The standard
Implement the standard you will be measured on, then plan, run and report an ISMS audit against it.
Follow the free ISO/IEC 27001:2022 — Lead Implementer and Internal Auditor roadmap.
🔒 The full roadmap adds here: 5 full courses (Membership)
- Course · Getting Started with ISO 27001:2022 · 🔒 Membership
- Course · ISO/IEC 27001:2022 Lead Implementer · 🔒 Membership
- Course · ISMS Implementation - ISO 27001 WorkShop · 🔒 Membership
- Course · Information Security Risk Management (ISO 27005) · 🔒 Membership
- Course · ISO 27001: 2022 Internal Auditor Course · 🔒 Membership
Step 7 — The audit certification
The credential that opens the senior compliance and audit roles.
Follow the free CISA — Certified Information Systems Auditor roadmap.
🔒 The full roadmap adds here: 4 full courses (Membership)
- Course · ISACA - Certified Information Systems Auditor - CISA · 🔒 Membership
- Course · Mastering Governance, Risk, and Compliance (GRC): A Handbook · 🔒 Membership
- Course · Business Continuity and Disaster Recovery Planning · 🔒 Membership
- Course · IT Auditor Interview · 🔒 Membership
Do it hands-on
The full Cyber Security Compliance Officer roadmap
The same steps with every course and the hands-on labs, and your progress tracked.
The full roadmap with labs →What Membership includes · Full refund within 30 days if you haven't started a lab · cancel anytimeAdvanced
AI-Driven Security Engineering
Become the Cyber Security Expert the AI Era Needs.
StationX’s AI Master’s teaches you to create and deploy security solutions by directing AI. “No coding background required. You direct the AI; the AI does the building.”
Explore the AI Master’s →Create your free account to open all 2,396 free items
The 79 free items on this page — and every other free lesson, video and guide — open once you have a free StationX account. No card, no trial.