GRC-portfolio

Enterprise GRC & Cloud Security Portfolio

Author: Morolake Bolarinwa
Portfolio Website: morolakebolarinwa.com
Focus: Continuous Compliance Monitoring | IT Audit | Cloud Risk Management | IAM Governance

📌 Executive Summary

This repository contains a collection of professional Governance, Risk, and Compliance (GRC) case files. These artifacts demonstrate the ability to translate complex regulatory requirements (SOC 2, PCI DSS, NIST, ISO 27001) into actionable, technical safeguards across hybrid-cloud environments (Azure, Microsoft Entra ID, Microsoft Sentinel).

The objective of this portfolio is to showcase practical experience in control design, gap assessments, continuous monitoring, and the creation of defensible, audit-ready evidence.

---

📂 Project Case Files

Project 1: Cloud Risk Register

• Framework: NIST 800-30
• Description: A comprehensive cloud risk assessment detailing asset vulnerability categorizations, threat modeling, and IT mitigation plans.
• File: Bolarinwa_Cloud_Risk_Register_Portfolio.pdf

Project 2: Baseline Gap Analysis

• Framework: ISO 27001
• Description: An enterprise gap analysis designed to support formal governance policies, track corrective actions, and ensure continuous audit readiness.
• File: Bolarinwa_Baseline_Gap_Analysis.pdf

Project 3: Data Loss Prevention (DLP) Strategy

• Focus: Data Governance & Information Protection
• Description: A formal implementation policy dictating how sensitive enterprise data is classified, monitored, and protected from exfiltration.
• File: Bolarinwa_Data_Loss_Prevention_Policy_Implementation_Strategy.pdf

Project 4: IAM Governance Architecture

• Focus: Zero Trust & Access Control
• Description: Documentation of a hybrid cloud environment utilizing Microsoft Entra ID, Privileged Identity Management (PIM), and strict Role-Based Access Control (RBAC).
• File: Bolarinwa_IAM_Governance_Architecture.pdf

Project 5: Enterprise SIEM Logging Architecture

• Focus: Continuous Monitoring & Threat Detection
• Description: Log ingestion and alerting architecture utilizing Microsoft Sentinel to establish defensible audit trails for compliance validation.
• File: Bolarinwa_SIEM_Implementation_and_Log_Analysis.pdf

Project 6: SOC 2 Readiness Control Matrix

• Framework: AICPA SOC 2 (Security Criteria)
• Description: A continuous compliance readiness assessment mapping hybrid-cloud technical controls (MFA, SIEM alerts) to SOC 2 Common Criteria to establish audit-ready evidence artifacts.
• File: Bolarinwa_SOC2_Readiness_Control_Matrix.pdf

Project 7: PCI DSS v4.0 Compliance & Segmentation Policy

• Framework: PCI DSS v4.0
• Description: A formal governance policy securing the Cardholder Data Environment (CDE) through strict network segmentation, Identity and Access Management (IAM), and continuous audit logging.
• File: Bolarinwa_PCI_DSS_v4_Compliance_Policy.pdf

---

Note: All documents contained in this repository are for portfolio demonstration purposes.