Governance, Risk & Compliance
GRC frameworks, risk assessment, compliance management, and audit.
Overview
GRC aligns security with business objectives.
GRC Framework
ποΈ
Governance
Policies, Standards, Procedures
β οΈ
Risk Management
Assessment, Treatment, Monitor
β
Compliance
Regulations, Audits, Reporting
Risk Assessment
Risk Formula
Architecture Diagram
Risk = Likelihood Γ Impact
Risk Levels:
1-4: Low
5-9: Medium
10-16: High
25: Critical
Risk Register
| Asset | Threat | Vulnerability | Impact | Likelihood | Risk |
|---|---|---|---|---|---|
| Database | Breach | SQL injection | High | Medium | High |
| Server | DDoS | No protection | High | Low | Medium |
Compliance Frameworks
| Framework | Focus |
|---|---|
| NIST CSF | Cybersecurity |
| ISO 27001 | Information security |
| SOC 2 | Service organizations |
| PCI DSS | Payment card data |
| HIPAA | Healthcare data |
| GDPR | EU data privacy |
Policy Template
# Information Security Policy
## 1. Purpose
Establish security requirements for protecting company assets.
## 2. Scope
Applies to all employees, contractors, and systems.
## 3. Access Control
- Principle of least privilege
- Regular access reviews
- MFA for remote access
## 4. Data Protection
- Encryption at rest and transit
- Data classification
- Retention policies
## 5. Incident Response
- Report incidents immediately
- Follow IR procedures
- Document all incidents
Risk Treatment
| Option | Description |
|---|---|
| Mitigate | Implement controls |
| Transfer | Insurance, outsourcing |
| Accept | Acknowledge risk |
| Avoid | Eliminate activity |
Audit Process
Architecture Diagram
1. Planning -> Scope, objectives
2. Fieldwork -> Evidence collection
3. Analysis -> Findings
4. Reporting -> Recommendations
5. Follow-up -> Remediation tracking
Practice
Conduct a risk assessment for a small business.