🚀 Excited to share my latest Governance, Risk, and Compliance (GRC) project completed on Cyberr, where I…
Darius R. — Aspiring Cyber Security GRC Consultant | Computer Science Graduate | CompTIA A+ | Risk & Compliance
🚀 Excited to share my latest Governance, Risk, and Compliance (GRC) project completed on Cyberr, where I engineered an audit-ready, mini-Information Security Management System (ISMS) from the ground up.
Simulating the role of a Cybersecurity Governance, Risk and Compliance Consultant for "MedVibe Health”, a remote-first B2B healthcare SaaS startup, I addressed complex compliance triggers involving Protected Health Information (PHI) and financial transaction data.
My hands-on deliverables include authoring corporate Information Security and Access Control Policies enforcing Least Privilege and mandatory multi-factor authentication (MFA) across AWS and corporate profiles. Additionally, I developed a comprehensive Risk Assessment Register to identify, score, and mitigate technical vulnerabilities such as unencrypted remote endpoints and weak root authentication. Crucially, I mapped these solutions directly to an ISO/IEC 27001:2022 Statement of Applicability (SoA), technically validating controls via Mobile Device Management (MDM) full-disk encryption and strict cloud access policies.
This single master system functions across five key GRC domains, proving my ability to:
1. Establish Business Boundaries: Defining a clear, remote-first company scope and context.
2. Evaluate Vulnerabilities Mathematically: Building a structured Risk Register with likelihood, impact, and inherent risk calculations.
3. Write Executive Mandates: Crafting formal, top-level corporate Information Security Policies.
4. Design Detailed Engineering Rules: Architecting access control sub-policies specifying exact technical control parameters.
5. Defend Framework Compliance: Constructing a complete Statement of Applicability to justify and prove framework implementation to an enterprise auditor.
This project gave me invaluable, hands-on experience translating AWS cloud architecture risks into business-aligned security strategies that satisfy enterprise auditors.
For anyone who is interested, I have linked my GitHub repository in the comments below!
👇
#Cybersecurity #GRC #ISO27001 #RiskManagement #CloudSecurity #InformationSecurity #Compliance #HealthcareIT #AWS
3 reactions · 1 comments
Topics: #informationsecurity, #iso27001, #cloudsecurity, #healthcareit, #aws, #compliance, #cybersecurity, #riskmanagement, #grc
Comments
Darius R.: Here is the link to explore the full repository and project breakdown: https://github.com/dariusrichardson55/medvibe-grc-portfolio