Cybersecurity glossary
What is GRC?
Also known as: GRC, governance risk and compliance
Definition
GRC is the discipline that aligns security with business goals through governance (direction and accountability), risk management (prioritizing threats) and compliance (meeting laws, contracts and standards).
Why it matters
GRC work produces policies, risk registers, audit evidence, vendor reviews and answers to customer questionnaires. Increasingly it also covers AI governance.
Common questions about GRC
See also
Sources
Related Guides
GuideGRC
How to Create an Acceptable Use Policy for Employees
Learn how to create an acceptable use policy for employees. This step-by-step tutorial covers scope, permitted use, prohibited actions, and enforcement.
Read more GuideGRC
How to Set Up a Security Policy Exception Process
Learn how to build a security policy exception process for GRC teams, manage residual risk, log approvals, and maintain audit readiness step by step.
Read more GuideSmall Business Security
How to Write an Incident Response Plan Small Business Owners Use
Learn how to write an incident response plan small business teams can execute quickly. Protect operations, contain threats, and recover critical systems.
Read more GuideGRC
10 Steps to Implement ISO 27001 and Get Certified
A step-by-step ISO/IEC 27001:2022 implementation plan: scope, leadership, risk assessment, Statement of Applicability, Annex A controls, internal audit, management review and the certification audit.
Read more