# GRC Lab

> GRC Lab helps governance, risk, and compliance professionals build deep, defensible ISO 27001 expertise — the kind of judgment that AI cannot replace. Founded by Aron Lange, a practising ISO 27001 and ISO 27701 Lead Auditor and trainer, GRC Lab has trained more than 25,000 professionals across over 100 countries. The core promise: "Be the GRC Practitioner AI Can't Replace."

GRC Lab is operated by Lange Advisory GmbH (Memmingen, Germany). Aron Lange holds CISM, CISA, CRISC, and CGEIT certifications, is an APMG-accredited trainer, a TRECCERT Approved Trainer, and a TÜV Süd partner. His background spans both sides of the audit table: former corporate Security Officer and implementer, now external Lead Auditor. This dual perspective — implementer and auditor — shapes the teaching across every product.

The central thesis running through the site: certifications are necessary but not sufficient. AI has commoditised surface-level compliance work. What survives and commands a premium is the professional who can review AI output, know whether it is correct, defend decisions to an auditor, and make the judgment calls a model cannot. That defensible judgment is the irreplaceable layer.

## Products

- [ISO 27001 Guide](https://www.grclab.com): A free, in-depth guide to implementing ISO/IEC 27001, covering getting started, the implementation project, careers, certification, Annex A controls, and the 12 implementation steps.
- [ISO 42001 Guide](https://www.grclab.com): A free guide to the AI management system standard, ISO/IEC 42001.
- [ISO/IEC 27001 Lead Implementer Toolkit](https://www.grclab.com): A one-time implementation artefact bundle including the 12-step roadmap, a 400+ task project plan, roughly 20 ISO-aligned templates, mind maps, and NIST CSF and SP 800-53 mappings. Priced at €299.
- [ISO 27001 Lead Implementer Bootcamp](https://www.grclab.com): A live, cohort-based programme led by a practising Lead Auditor, covering everything needed to pass the TRECCERT ISO 27001 Lead Implementer exam. Includes live instruction, weekly Q&A, the full toolkit, practice exam, official TRECCERT material, and an exam voucher with free retake. Carries a "Certified-or-Continue" guarantee: free retake and free re-attendance until certified. Priced at €2,999.
- [TRECCERT Exam Vouchers](https://www.grclab.com): Exam vouchers with a guarantee-led promise — sit the exam again free if you do not pass.
- [Classroom Trainings](https://www.grclab.com): Instructor-led trainings for CISM, CISA, CRISC, and ISO 27001 Lead Implementer and Lead Auditor, delivered via TASC Schönbrunn.
- Alumni Membership: A recurring post-graduation membership; the Bootcamp is the only entry point.

## Content

- [Newsletter: GRC Lab](https://www.grclab.com): A weekly newsletter with the mission "Be the GRC Practitioner AI Can't Replace." Roughly 8,000 subscribers.
- [Blog](https://www.grclab.com): Organised into three categories — News (standards and regulatory updates), Findings (audit finding teardowns from the auditor's chair), and Practice (implementation guidance from the implementer's desk).

## About

- [About](https://www.grclab.com/about): The founder story of Aron Lange, tracing the path from professional basketball coaching to corporate security and privacy roles, to Security Officer, to Lead Auditor, to founding GRC Lab. The central thread is a focus on the "why" and deep understanding over checkbox compliance.

## Contact and legal

- Company: Lange Advisory GmbH, Memmingen, Germany
- Website: https://www.grclab.com
- Community and course delivery: https://app.grclab.com