Practice Pioneers
One standard per stream. One closed batch at a time. What each first batch writes becomes the starting point for everyone who comes after.
Audits happen once a year.
Practice happens every day.
We're building for the people who do the second.
Policies say what should happen. Practitioners know what actually happens: who does it, how often, and where the evidence lives. Practice Pioneers is where that knowledge gets recorded, structured and shared, without naming your company.
Practice Pioneers covers the standards and frameworks Indian organisations work with most, across banking, finance and NBFC, IT and ITES, manufacturing and healthcare. Each one runs as its own stream. Choose the one you know best.
Streams open one at a time, once the stream's lead consultant and its practice library are ready. The order and dates go to applicants first. Applied for a queued stream? We hold your application and invite you when its first batch forms.
If you own, operate or check a control, whether you're an owner, a manager or an auditor, you're who we want to hear from.
One standard per stream, led by an experienced consultant for that standard.
Each batch brings together practitioners from different companies.
GRAC runs every batch and keeps the shared practice library in order.
Every stream runs the same three stages, one batch at a time. You start as an individual. If your organisation wants to go further, your team joins you.
Describe the practices you run in the Practice Explorer, one at a time, without naming your company, systems or vendors. Weekly missions, peer review and guidance from your stream lead.
Your organisation's team of 3–5 brings its practices into GRAC, in its own isolated workspace, and maps each one's instances, sub-practices and dependencies on owners, vendors and assets.
Run your priority practices in GRAC, with named owners, schedules and a record of where each piece of evidence lives.
Durations are the planned programme design and may be adjusted per stream. Recognition marks participation in the programme; it is not a certification, accreditation or audit opinion.
No sales calls in Stage 1. You get structure, feedback and peers who do the same job you do.
Writing a practice down, with who does it, how often and where the evidence lives, shows you quickly what's solid and what depends on one person's memory.
Practitioners from different companies working on the same standard. You review each other's practices and compare how things actually run.
How to write a practice that's clear, complete and reusable.
An expert in your standard trains each stage and answers what you ask in weekly reviews.
A Practice Explorer certificate when you complete Stage 1.
Anonymised findings aggregated across at least five organisations. It is never verbatim and never attributable to anyone.
You're a design partner. Your feedback goes straight to the GRAC product team.
Pick your stream and tell us your role, sector and experience. Nothing more.
A person reviews your application and replies with a clear decision.
Accepted members book a live introductory class, or watch the recording and take a short quiz.
You write your first practice in Mission 01, with guidance from your stream lead. Your batch starts from there.
Every application gets one of three answers:
AcceptedWaitlist for the next batchNot yet, with feedbackYou're describing how work gets done, never handing over the records themselves.
In Stage 1, you never name your organisation, clients, vendors, systems, sites or colleagues.
No passwords, IP addresses, configurations, vulnerability details, customer data or copied standard text. Describe where evidence lives, not what's in it.
We help you get your organisation's consent to take part. What you write still never names it.
Every consent is separate and can be withdrawn. Handling follows India's Digital Personal Data Protection Act 2023.
If you lead security, risk, compliance or quality, you can nominate practitioners to the stream that fits, and sponsor your organisation's move into Stage 2.
A named sponsor and programme owner
A team of 3–5 contributors in your chosen stream
Your own isolated GRAC workspace. Your records stay yours.
Consent for each participant, which we help you set up
Every batch after the first starts from what the first one leaves behind.
The first ISO 27001 batch starts on 22 October. Once it starts, it's a later batch.
Two minutes. Pick your stream, tell us who you are, and a person on the other side decides.