Governance, Risk & Compliance

GRC frameworks, risk assessment, compliance management, and audit.

Overview

GRC aligns security with business objectives.

GRC Framework

┌─────────────────────────────────────┐
│          Governance                 │
│  (Policies, Standards, Procedures) │
├─────────────────────────────────────┤
│          Risk Management            │
│  (Assessment, Treatment, Monitor)  │
├─────────────────────────────────────┤
│          Compliance                 │
│  (Regulations, Audits, Reporting)  │
└─────────────────────────────────────┘

Risk Assessment

Risk Formula

Risk = Likelihood × Impact

Risk Levels:
1-4:   Low
5-9:   Medium
10-16: High
25:    Critical

Risk Register

Compliance Frameworks

Policy Template

# Information Security Policy

## 1. Purpose
Establish security requirements for protecting company assets.

## 2. Scope
Applies to all employees, contractors, and systems.

## 3. Access Control
- Principle of least privilege
- Regular access reviews
- MFA for remote access

## 4. Data Protection
- Encryption at rest and transit
- Data classification
- Retention policies

## 5. Incident Response
- Report incidents immediately
- Follow IR procedures
- Document all incidents

Risk Treatment

Audit Process

1. Planning → Scope, objectives
2. Fieldwork → Evidence collection
3. Analysis → Findings
4. Reporting → Recommendations
5. Follow-up → Remediation tracking

Practice

Conduct a risk assessment for a small business.