About Tracy NAR

Cybersecurity risk specialist. GRC educator.

I’m a cybersecurity and risk specialist working across governance, risk, and compliance: audits, risk assessments, policy development, governance frameworks, and security controls. Over 15+ years I’ve done that work in aviation, telecommunications, and healthcare, three of the most tightly regulated sectors there are.

I came into it through an unusual door. Before cybersecurity, I was a government aviation security inspector, and I worked my way up to Lead Civil Aviation Security Inspector and Auditor. I’m ICAO certified as an inspector, instructor, and auditor, which means I’ve been formally trained not just to do this work but to teach it.

Those were high-stakes audits in an environment where the stakes were measured in lives, not line items. That work taught me what most GRC training misses: compliance isn’t paperwork. It’s a discipline of asking the right questions, documenting what you find, and getting people to act on it. The frameworks change from industry to industry. The thinking doesn’t.

I’m a Lead Auditor for both ISO 27001 and ISO 42001, the AI management systems standard, and I’ve passed the CISA exam with certification in progress.

Now I teach this work. I built Tracy NAR because I kept meeting capable people, often with more relevant experience than they realized, trying to break into GRC with no map and no one to tell them which parts actually matter to Canadian employers. That’s a solvable problem, and it’s what this site exists to solve.