GRC & Compliance: Questions and Answers
Governance, risk and compliance explained: NIST CSF, ISO 27001, SOC 2, GDPR, PCI DSS, risk assessments and security questionnaires.
What is GRC in cybersecurity?
GRC stands for governance, risk and compliance. Governance sets direction, roles and policies; risk management identifies and prioritizes what could go wrong; compliance shows that the organization meets laws, contracts and standards. Together they connect security work to business decisions.
Full answer and next stepsWhat is the NIST Cybersecurity Framework (CSF) 2.0?
NIST CSF 2.0 is voluntary guidance for managing cybersecurity risk, organized into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Version 2.0 added the Govern function and broadened the framework to organizations of every size and sector.
Full answer and next stepsWhat is ISO 27001 certification?
ISO/IEC 27001 is an international standard for an information security management system (ISMS). Certification means an accredited certification body has audited the organization’s ISMS, including risk assessment, policies and selected controls, and found it meets the standard.
Full answer and next stepsWhat is SOC 2 and who needs it?
SOC 2 is an attestation report, issued by an independent CPA firm under AICPA standards, on how a service organization protects customer data against the Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. SaaS and service companies usually pursue it because customers ask for it.
Full answer and next stepsWhat is the difference between ISO 27001 and SOC 2?
ISO 27001 is an international certification of your information security management system, recognized worldwide. SOC 2 is an attestation report from a CPA firm on specific controls, most common in North America. Both show customers you take security seriously, and their controls overlap heavily.
Full answer and next stepsShould I use ISO 27001 or the NIST Cybersecurity Framework?
They serve different purposes and work well together. NIST CSF is free, voluntary guidance for organizing and improving a security program. ISO 27001 is a certifiable standard that proves to outsiders that you run a managed program. Many organizations use CSF to plan and ISO 27001 to certify.
Full answer and next stepsWhat is a cybersecurity risk assessment?
A risk assessment identifies what you need to protect, the threats and weaknesses that could affect it, how likely and how damaging each scenario is, and which risks to treat first. The result is a prioritized list of risks with owners and planned actions.
Full answer and next stepsWhat is a risk register?
A risk register is a living list of identified risks, each with a description, likelihood, impact, owner, current controls, planned treatment and review date. It turns a one-time risk assessment into an ongoing management tool.
Full answer and next stepsWhat are the CIS Controls?
The CIS Critical Security Controls are a prioritized set of security safeguards published by the Center for Internet Security. They are grouped into Implementation Groups, and IG1 is described by CIS as essential cyber hygiene, a practical baseline for small organizations.
Full answer and next stepsDoes GDPR apply to businesses outside the EU?
It can. The GDPR applies to organizations established in the EU, and also to organizations elsewhere that offer goods or services to people in the EU or monitor their behavior there. If you sell to or track visitors in the EU, read the regulation’s territorial scope carefully or get legal advice.
Full answer and next stepsWhat is PCI DSS and does my small business need to comply?
PCI DSS is the Payment Card Industry Data Security Standard, which applies to organizations that store, process or transmit payment card data. Most small merchants comply through their payment provider’s requirements, often with a self-assessment questionnaire, and reduce scope by never storing card data themselves.
Full answer and next stepsHow do I answer a customer security questionnaire?
Answer honestly and consistently, backed by evidence you can share: policies, a SOC 2 report or ISO certificate if you have one, and descriptions of controls such as MFA, encryption, backups and incident response. Keep a library of approved answers so each new questionnaire is faster.
Full answer and next stepsWhat is the difference between an acceptable use policy and a fair use policy?
An acceptable use policy governs employee behavior on an organization's systems, while a fair use policy regulates consumption of shared resources like bandwidth and storage to prevent abuse. Acceptable use policies focus on security, legal compliance, and conduct. Fair use policies focus on resource allocation and system performance, primarily used by service providers to manage shared or unlimited service tiers.
Full answer and next stepsGo deeper
Step-by-step articles on this subject are in the GRC guides.