Governance, Risk and Compliance

Governance, Risk and Compliance (GRC) is the framework that aligns cybersecurity with business objectives, regulatory requirements, and risk tolerance. Without GRC, security efforts lack direction and accountability.

---

Information Security Governance

Governance establishes the policies, structure, and accountability for cybersecurity:

Key Components

Component	Description
Security policies	High-level statements of intent and direction
Standards	Mandatory requirements for implementing policies
Procedures	Step-by-step instructions for carrying out standards
Guidelines	Recommended practices (not mandatory)
Baselines	Minimum security configurations for systems

Policy Hierarchy

┌─────────────────────────┐
│    Security Policy       │  ← "What" (high-level intent)
├─────────────────────────┤
│    Standards             │  ← "What specifically" (mandatory requirements)
├─────────────────────────┤
│    Procedures            │  ← "How" (step-by-step instructions)
├─────────────────────────┤
│    Guidelines            │  ← "Recommendations" (best practices)
└─────────────────────────┘

Example Policies

Policy	Purpose
Acceptable Use Policy	Defines acceptable behaviour for using company systems
Access Control Policy	Defines who can access what resources
Data Classification Policy	Defines sensitivity levels (public, internal, confidential, restricted)
Incident Response Policy	Defines how to handle security incidents
Password Policy	Defines password requirements and rotation
Bring Your Own Device (BYOD)	Defines rules for personal devices on the network
Data Retention Policy	Defines how long data is kept and when it is destroyed

---

Risk Management

Risk management identifies, assesses, and mitigates threats to the organisation:

Risk Management Process

1. Identify — discover assets, threats, and vulnerabilities
2. Assess — determine likelihood and impact of each risk
3. Treat — decide how to handle each risk
4. Monitor — continuously review and update the risk register

Risk Assessment

Factor	Definition
Threat	A potential cause of harm (e.g., ransomware, insider)
Vulnerability	A weakness that a threat can exploit (e.g., unpatched software)
Likelihood	Probability that the threat will exploit the vulnerability
Impact	The damage if the risk materialises (financial, reputational, legal)
Risk	Risk = Likelihood x Impact

Risk Treatment Options

Option	Description	Example
Mitigate	Reduce the likelihood or impact	Install patches, add MFA
Transfer	Shift the risk to a third party	Buy cyber insurance
Accept	Acknowledge and accept the risk	Low-impact, low-likelihood risks
Avoid	Eliminate the activity that creates the risk	Discontinue a vulnerable service

Risk Register

Risk ID	Description	Likelihood	Impact	Rating	Treatment	Owner
R-001	Ransomware attack	High	Critical	Critical	Mitigate	CISO
R-002	Employee data leakage	Medium	High	High	Mitigate	DPO
R-003	Third-party breach	Medium	Medium	Medium	Transfer	Vendor Mgmt
R-004	Physical server theft	Low	Low	Low	Accept	Facilities

---

Key Frameworks and Standards

ISO/IEC 27001

The international standard for Information Security Management Systems (ISMS):

Aspect	Description
Scope	Establish, implement, maintain, and improve an ISMS
Annex A controls	93 security controls across 4 themes (organisational, people, physical, technological)
Certification	Audited by accredited certification bodies
Plan-Do-Check-Act	Continuous improvement cycle

NIST Cybersecurity Framework (CSF) 2.0

Function	Purpose
Govern	Establish cybersecurity strategy and risk management (new in 2.0)
Identify	Understand assets, risks, and vulnerabilities
Protect	Implement safeguards
Detect	Monitor for security events
Respond	Contain and mitigate incidents
Recover	Restore operations and learn

NIST 800-53

A detailed catalogue of security and privacy controls for US federal systems: