What is GRC in cybersecurity?

The details

In practice, GRC work includes writing policies, running risk assessments, maintaining a risk register, preparing for audits such as SOC 2 or ISO 27001, answering customer security questionnaires and managing vendor risk.

Useful next reads and tools

• GRC guides · guide
• How to Build a Security Policy Framework: Policies, Standards and Procedures That People Follow · guide

Terms explained

GRC (governance, risk and compliance)

GRC is the discipline that aligns security with business goals through governance (direction and accountability), risk management (prioritizing threats) and compliance (meeting laws, contracts and standards).

ISO/IEC 27001

ISO/IEC 27001 is the international standard for an information security management system (ISMS), against which organizations can be independently certified.

Risk register

A risk register is a maintained list of risks with their likelihood, impact, owner, controls, treatment plan and review date.

SOC 2

SOC 2 is an attestation report from an independent CPA firm on a service organization’s controls relevant to security, availability, processing integrity, confidentiality and privacy.

Sources

• NIST Cybersecurity Framework
• ISO/IEC 27001 Information Security Management