UK GRC guide
Which GRC certification fits a UK role, and how do people move into GRC?
CISA, CISM, CRISC, CGRC, AIGP, AAISM and PECB's ISO/IEC 27001 credentials each certify a different kind of governance, risk and compliance work. This Mindset Cyber guide sets them against the job titles in UK adverts, shows what UK adverts and surveys report, and explains how people move into GRC from audit, risk, compliance, quality, legal and project work. We sell the PECB courses only.
Last reviewed 12 November 2026
UK customers pay 20% VAT, added at checkout.
Mindset Cyber is a PECB Authorised Titanium Partner, PECB's highest partner level.
Which credential fits which UK GRC role?
Match the credential to the job: for UK roles that build, run or audit an ISO/IEC 27001 management system, the PECB Lead Implementer and Lead Auditor courses Mindset Cyber sells are the direct fit, and ISACA's and ISC2's credentials suit audit, security management and IT risk roles more broadly.
The job titles in UK adverts that cite GRC include governance analyst, governance manager, compliance manager, risk manager and information security manager, beside consultant, analyst and security manager roles. Adverts that cite ISO/IEC 27001 also name auditors, IT managers and IT support roles (ITJobsWatch, permanent UK adverts in the six months to 11 November 2026). This is how those titles line up with the credentials.
| Job title in UK adverts | The work | PECB course | Other credentials |
|---|---|---|---|
| Governance analyst or governance manager | Policies, the risk register, control evidence and reports to senior management | ISO/IEC 27001 Lead Implementer | CISM for the management route |
| Compliance manager | Turning legal, contractual and certification requirements into controls, and showing they are met | ISO/IEC 27001 Lead Implementer, Lead Auditor | CRISC where IT risk leads the role |
| Auditor | Planning audits, testing controls, writing findings and checking they are closed | ISO/IEC 27001 Lead Auditor | CISA for IT audit beyond one standard |
| Risk manager | Identifying, assessing and treating risk across the whole organisation, not only in IT | ISO 31000 Risk Manager | CRISC or CGRC where the risk sits in IT systems |
| Information security manager or security manager | Running the information security management system (ISMS): risk treatment, controls, measurement and management review | ISO/IEC 27001 Lead Implementer | CISM, once you have the five years |
| Security consultant | Assessing clients against a standard and advising on the gaps | ISO/IEC 27001 Lead Auditor, then Lead Implementer | CISA or CISM where a client names one |
| IT manager, IT support or analyst moving into GRC | Owning or supporting controls inside the scope of an ISMS | ISO/IEC 27001 Foundation | OCEG's GRCP, which asks for no experience |
Across these titles the split holds: if the job builds or runs the controls, the Lead Implementer fits; if it tests them, the Lead Auditor; if it owns risk across the whole organisation, ISO 31000 Risk Manager. If an advert names a credential, that comes before this table.
A credential is not a job offer, so check the conditions too. The two Lead courses cost £449 + VAT each and take about 30 to 40 hours of study (our estimate, not a PECB figure), with 12 months of access; PECB awards the Provisional level for a pass without experience, and its full Lead level needs five years' work, two in information security management, and 300 project or audit hours. The route below sets out every course's conditions.
What does each GRC credential ask of you?
The credentials differ most in the experience they want before they certify you: PECB's ISO/IEC 27001 credentials, the ones Mindset Cyber sells courses for, start at a Provisional level that needs none, while ISACA's take three to five years and ISC2's CGRC two.
| Credential | Issued by | Experience before certification | Built for |
|---|---|---|---|
| CISA (Certified Information Systems Auditor) | ISACA | Five years of information systems audit, control or security work, gained in the 10 years before you apply | IT audit: ISACA pitches it at "a modern IT auditor" |
| CISM (Certified Information Security Manager) | ISACA | Five years, across at least three of its four domains | Security management: governance, risk management, the security programme and incident management |
| CRISC (Certified in Risk and Information Systems Control) | ISACA | Three years, across at least two of its four domains | IT risk, for "a modern risk management expert", in ISACA's words |
| CGRC (Governance, Risk and Compliance Certification) | ISC2 | Two years | Risk management programmes for IT systems, for practitioners in GRC roles |
| AIGP (Artificial Intelligence Governance Professional) | IAPP | None stated on IAPP's AIGP page | AI governance: IAPP says it shows competency in AI development and "ethical AI deployment" |
| AAISM (Advanced in AI Security Management) | ISACA | An active CISM or CISSP | Managing AI security risk, policy and responsible use |
| PECB Certificate Holder in ISO/IEC 27001 Foundation | PECB | None | The terms and requirements of ISO/IEC 27001, tested by PECB's exam |
| PECB Certified ISO/IEC 27001 Lead Implementer | PECB | None at the Provisional level. Lead level: five years' work with two in information security management, plus 300 hours of ISMS project activity | Building and running an ISMS |
| PECB Certified ISO/IEC 27001 Lead Auditor | PECB | None at the Provisional level. Lead level: five years' work with two in information security management, plus 300 audit hours | Planning, leading and reporting ISMS audits |
| PECB Certified ISO 31000 Risk Manager | PECB | None at the Provisional level. Risk Manager: two years' work with one in risk management, plus 200 hours of risk management activity | Risk management across the whole organisation, under ISO 31000 |
The experience column is the real divider. ISACA's and ISC2's credentials certify people who already have the years, and AAISM needs CISM or CISSP first, while PECB lets a newcomer start at Foundation or a Provisional level and move up as experience builds. Exam fees for the other bodies are not shown: each body publishes its own.
Accreditation, and what UKAS covers
UKAS, the United Kingdom Accreditation Service, accredits PECB under ISO/IEC 17024 for certifying people, and its schedule 21923 (issue 008, 3 November 2026) lists PECB Certified ISO/IEC 27001 Lead Implementer and Lead Auditor. PECB's ISO/IEC 27001 Foundation and ISO 31000 Risk Manager are not on that schedule, although the ISO 31000 Risk Manager is in PECB's IAS scope of accreditation (PCB-111, valid to 1 January 2027). ISACA's candidate guide says ANSI has accredited CISA, CRISC and CISM under the same standard, and ISC2 lists CGRC as ANAB accredited. Each accreditation belongs to the certification body: Mindset Cyber is an authorised PECB training partner.
GRC as a way into cyber security without coding
Most GRC work needs no coding: it is reading obligations, weighing risk and proving that controls work, and Mindset Cyber's PECB route into it starts with the ISO/IEC 27001 Foundation and moves on to the Lead Implementer or the Lead Auditor.
Where people come from, and what carries over
| Coming from | What carries over | A natural next course |
|---|---|---|
| Internal or external audit | Planning, sampling, evidence and written findings | ISO/IEC 27001 Lead Auditor |
| Risk | Risk registers, assessment and treatment plans | ISO 31000 Risk Manager or the Lead Implementer for information security risk |
| Compliance | Turning obligations into controls, and keeping the records that prove them | ISO/IEC 27001 Lead Implementer |
| Quality (ISO 9001) | Internal audit, document control and corrective action in a management system, which an ISMS is too | ISO/IEC 27001 Lead Auditor or Lead Implementer |
| Legal and data protection | Close reading of regulation and contracts, and UK GDPR accountability | ISO/IEC 27001 Lead Implementer |
| Project and PMO roles | Plans, stakeholders and delivery: PECB counts ISMS implementation projects towards the Lead Implementer's hours | ISO/IEC 27001 Lead Implementer |
Each background already brings part of the job: audit brings evidence, risk brings treatment decisions, compliance and legal bring obligations, quality brings the management system, and project roles bring delivery.
What the work looks like in a UK organisation
Expect to keep Cyber Essentials controls in place between renewals, gather evidence for a Cyber Assessment Framework assessment, document the technical and organisational measures the UK GDPR expects of a controller, answer customers' and suppliers' security questionnaires, and run the risk assessments, policies and internal audits of an ISMS. It is analysis, writing and evidence. You need to understand the systems involved, but not to program them.
The route, with what it costs and asks of you
| Course | Price | Study time and access | Experience for each level |
|---|---|---|---|
| ISO/IEC 27001 Foundation | £209 + VAT | About 10 to 15 hours (our estimate, not a PECB figure), with 12 months of access | None: PECB's Foundation certificate needs no work experience |
| ISO/IEC 27001 Lead Implementer | £449 + VAT | About 30 to 40 hours (our estimate, not a PECB figure), with 12 months of access | Provisional: none. Implementer: two years' work, one in information security management, plus 200 project hours. Lead: five years, two in that field, plus 300 project hours |
| ISO/IEC 27001 Lead Auditor | £449 + VAT | About 30 to 40 hours (our estimate, not a PECB figure), with 12 months of access | Provisional: none. Auditor: two years' work, one in information security management, plus 200 audit hours. Lead: five years, two in that field, plus 300 audit hours |
| ISO 31000 Risk Manager | £319 + VAT | About 20 to 30 hours (our estimate, not a PECB figure), with 12 months of access | Provisional: none. Risk Manager: two years' work, one in risk management, plus 200 hours of risk management activity |
The table shows what each step costs, how long it takes and what each level asks: the Foundation and every Provisional level need no experience, and the full levels need years of relevant work plus logged project, audit or risk management hours.
UK customers pay 20% VAT, added at checkout.
Each price includes the PECB exam voucher, two exam attempts and the certification fee, and the Lead and Risk Manager prices also include the first year of PECB certification maintenance. Every course comes with the Mindset Cyber learner hub: questions to a PECB Certified Trainer, answered within two days, and a members-only community of learners on the same exam.
What UK job adverts and surveys show
In the six months to 11 November 2026, ITJobsWatch counted 654 UK permanent job adverts citing GRC, against 247 a year earlier, and GRC's share of all the permanent adverts it tracks rose from 0.48% to 0.53%.
- ISO/IEC 27001: 1,586 UK permanent job adverts citing ISO/IEC 27001 in the same six months, 1.29% of all the permanent adverts ITJobsWatch tracks.
- AI skills: in ISC2's UK study of over 950 cyber security professionals (May 2026), AI skills were the most urgent capability gap, cited by 42% of respondents with at least one skills need, and 58% described their shortages as critical or significant. For AI credentials, see our AI governance certification guide.
The advert counts come from ITJobsWatch. They measure how often employers mention a skill, not how many roles are open to someone new: each advert sets its own experience requirements, and a credential shows what you know rather than that an offer will follow.
So weigh the conditions before you buy. The ISO/IEC 27001 Lead Implementer and Lead Auditor are £449 + VAT each, with about 30 to 40 hours of study (our estimate, not a PECB figure) and 12 months of access; a pass without experience earns the Provisional level, and the full Lead credential needs five years' work, two of them in information security management, plus 300 project or audit hours.
The frameworks UK employers ask GRC teams about
Beside ISO/IEC 27001, the standard Mindset Cyber's PECB Lead Implementer and Lead Auditor courses teach, three UK references shape GRC work: Cyber Essentials, the NCSC's Cyber Assessment Framework and the UK GDPR.
Cyber Essentials
The NCSC calls it "the minimum standard of cyber security recommended by the Government", built on five controls: firewalls, secure configuration, security update management, user access control and malware protection. Cyber Essentials Plus keeps the same five and adds independent testing that they work in practice. The GRC job here is keeping the controls in place between renewals and holding the evidence.
The Cyber Assessment Framework
The NCSC describes the CAF as "the UK's approach to assessing and improving cyber resilience": an outcomes-based framework used across sectors regulated under NIS and wider critical national infrastructure, and not a certification scheme. The GRC job here is owning the outcomes and the evidence behind them, or assessing whether another organisation meets them.
The UK GDPR
Article 24 has a controller implement appropriate technical and organisational measures, be able to demonstrate that its processing complies, and review and update those measures where necessary. The GRC job here is documenting the measures and keeping the evidence current; whether they are enough for your processing is a legal question.
Our guide to Cyber Essentials, the CAF and UK GDPR training matches each of the three to a PECB course.
Frequently asked questions
Which GRC certification suits a beginner in the UK?
For a UK beginner, the PECB ISO/IEC 27001 Foundation that Mindset Cyber sells needs no experience, and neither does PECB's Provisional level, earned by passing a Lead exam without it. OCEG's GRCP also asks for no experience or degree, while CISA, CISM, CRISC and CGRC need two to five years of work before they certify you. The Foundation is £209 + VAT, with about 10 to 15 hours of study (our estimate, not a PECB figure) and 12 months of access.
Can I move into cyber security in the UK without coding?
Most GRC work needs no coding: it is risk, policy, controls and audit, and Mindset Cyber's PECB route into it starts with the ISO/IEC 27001 Foundation, then the Lead Implementer or Lead Auditor. Employers still weigh experience. A Lead exam passed without experience earns the Provisional level, and the full Lead credential needs five years' work, two in information security management, plus 300 project or audit hours. The Lead courses are £449 + VAT each, with about 30 to 40 hours of study (our estimate, not a PECB figure) and 12 months of access.
CISA or ISO 27001 Lead Auditor for a UK audit role?
Mindset Cyber sells the PECB ISO/IEC 27001 Lead Auditor, not CISA, and the two suit different audits: the Lead Auditor is for auditing an ISMS against ISO/IEC 27001, and CISA is ISACA's credential for IT audit in general. CISA needs five years of information systems audit, control or security work before ISACA certifies you, while the Lead Auditor starts at a Provisional level that needs none. If a UK advert names one of them, get that one.
Are PECB's ISO 27001 certifications accredited in the UK?
PECB's ISO/IEC 27001 Lead Implementer and Lead Auditor certifications, the credentials Mindset Cyber's two Lead courses lead to, are on PECB's UKAS schedule of accreditation (21923, issue 008, 3 November 2026), under ISO/IEC 17024. The Foundation certificate is not. The accreditation is PECB's, as the certification body, not Mindset Cyber's.
What do these GRC courses cost in the UK?
At Mindset Cyber, the PECB ISO/IEC 27001 Lead Implementer and Lead Auditor are £449 + VAT each, the Foundation is £209 + VAT and the ISO 31000 Risk Manager is £319 + VAT. Each includes the PECB exam voucher, two exam attempts, the certification fee and 12 months of access. UK customers pay 20% VAT, added at checkout.
Does Mindset Cyber sell CISA, CISM, CRISC or CGRC?
No: Mindset Cyber sells official PECB courses, such as the ISO/IEC 27001 Lead Implementer and Lead Auditor, and not ISACA's or ISC2's credentials. CISA, CISM, CRISC and AAISM come from ISACA, CGRC from ISC2 and AIGP from IAPP, so go to those bodies directly. A PECB credential does not meet an advert that names one of theirs.
Next steps
Every course is priced in pounds and includes the PECB exam voucher, two exam attempts and the certification fee.
PECB Certified ISO/IEC 27001 Lead Implementer
£449 + VAT
UK customers pay 20% VAT, added at checkout.
Includes the PECB exam voucher, two exam attempts, the certification fee, the first year of PECB certification maintenance, 12 months of access, a Mindset Cyber study guide (PDF) and the Mindset Cyber learner hub, with questions to a PECB Certified Trainer and a members-only learner community. 31 CPD credits.
View course → Official PECB eLearningPECB Certified ISO/IEC 27001 Lead Auditor
£449 + VAT
UK customers pay 20% VAT, added at checkout.
Includes the PECB exam voucher, two exam attempts, the certification fee, the first year of PECB certification maintenance, 12 months of access, a Mindset Cyber study guide (PDF) and the Mindset Cyber learner hub, with questions to a PECB Certified Trainer and a members-only learner community. 31 CPD credits.
View course → Official PECB eLearningPECB Certificate Holder in ISO/IEC 27001 Foundation
£209 + VAT
UK customers pay 20% VAT, added at checkout.
Includes the PECB exam voucher, two exam attempts, the certification fee, 12 months of access, a Mindset Cyber study guide (PDF) and the Mindset Cyber learner hub, with questions to a PECB Certified Trainer and a members-only learner community. 14 CPD credits.
View course → Official PECB eLearningPECB Certified ISO 31000 Risk Manager
£319 + VAT
UK customers pay 20% VAT, added at checkout.
Includes the PECB exam voucher, two exam attempts, the certification fee, the first year of PECB certification maintenance, 12 months of access, a Mindset Cyber study guide (PDF) and the Mindset Cyber learner hub, with questions to a PECB Certified Trainer and a members-only learner community. 21 CPD credits.
View course →Sources
Every source was read on 12 November 2026. Quotations keep their original spelling.
- ITJobsWatch, "GRC" (UK permanent), data to 11 November 2026, read 12 November 2026: https://www.itjobswatch.co.uk/jobs/uk/grc.do
- ITJobsWatch, "ISO/IEC 27001" (UK permanent), data to 11 November 2026, read 12 November 2026: https://www.itjobswatch.co.uk/jobs/uk/iso27001.do
- ISC2, ISC2 Research: AI Skills Critical to Success of the U.K. Cybersecurity Workforce (26 May 2026): https://www.isc2.org/Insights/2026/05/ai-skills-critical-to-success-of-uk-cybersecurity-workforce
- ISACA, CISA certification: https://www.isaca.org/credentialing/cisa
- ISACA, Get CISA certified: https://www.isaca.org/credentialing/cisa/get-cisa-certified
- ISACA, CISM certification: https://www.isaca.org/credentialing/cism
- ISACA, Get CISM certified: https://www.isaca.org/credentialing/cism/get-cism-certified
- ISACA, CRISC certification: https://www.isaca.org/credentialing/crisc
- ISACA, Get CRISC certified: https://www.isaca.org/credentialing/crisc/get-crisc-certified
- ISACA, Advanced in AI Security Management (AAISM): https://www.isaca.org/credentialing/aaism
- ISACA, Certification Exam Candidate Guide (2026): https://www.isaca.org/credentialing/-/media/fa494652c5f149289af38cef18328650.ashx
- ISC2, CGRC: Governance, Risk and Compliance Certification: https://www.isc2.org/certifications/cgrc
- IAPP, Artificial Intelligence Governance Professional (AIGP): https://iapp.org/certify/aigp/
- OCEG, GRC Professional (GRCP) certification: https://www.oceg.org/certifications/grc-professional-certification/
- PECB, Candidate Handbook, ISO/IEC 27001 Lead Implementer, version 1.5: https://pecb.com/pdf/candidate-handbooks/pecb-candidate-handbook-iso-27001-lead-implementer-mc.pdf
- PECB, Candidate Handbook, ISO/IEC 27001 Lead Auditor, version 1.5: https://pecb.com/pdf/candidate-handbooks/pecb-candidate-handbook-iso-27001-lead-auditor-mc.pdf
- PECB, Candidate Handbook, ISO 31000 Risk Manager, version 1.5: https://pecb.com/pdf/candidate-handbooks/pecb-candidate-handbook-iso-31000-risk-manager.pdf
- PECB, Certification Rules and Policies: https://pecb.com/en/certification-rules-and-policies
- UKAS, Schedule of Accreditation 21923, PECB, issue 008 (3 November 2026): https://www.ukas.com/wp-content/uploads/schedule_uploads/963637/21923Personnel-Certification.pdf
- IAS, Certificate of Accreditation and scope, PECB, PCB-111 (effective 30 October 2025, valid to 1 January 2027): https://www.iasonline.org/wp-content/uploads/2017/05/PCB-111-Cert.pdf
- NCSC, Cyber Essentials overview: https://www.ncsc.gov.uk/cyberessentials/overview
- NCSC, Cyber Assessment Framework collection: https://www.ncsc.gov.uk/collection/cyber-assessment-framework
- UK GDPR, Article 24, Responsibility of the controller (legislation.gov.uk, latest available revised text): https://www.legislation.gov.uk/eur/2016/679/article/24