GRC and risk management

Why GRC exists

Firewalls and SIEMs are tools. Someone still has to decide what matters most, how much to spend, who is responsible, and how to prove to customers and regulators that the company is doing the right things. That is GRC work, and it is a large and growing career path, including for people who are less hands-on with technology.

Governance

Governance means the leadership sets direction and holds people accountable. In security that includes:

• A security strategy agreed with the board or owners.
• Clear roles: who owns each system, who approves access, who leads incident response (often a CISO, chief information security officer).
• Policies and the documents below them.

Risk management

You met risk = likelihood × impact in Module 1. In GRC, risks are managed as a cycle: identify, assess, treat, monitor. They are written in a risk register, a table that every risk owner can see.

• Inherent risk: the risk before controls.
• Residual risk: the risk left after controls. Management formally accepts it.
• Risk appetite: how much risk the organisation is willing to take to reach its goals, set by leadership.

Controls

A control is anything that reduces risk. Controls are grouped two ways:

• By purpose: preventive (stop it: MFA), detective (notice it: SIEM alert), corrective (fix it: restore backups). Some also add deterrent and compensating controls.
• By kind: administrative (policies, training), technical (firewalls, encryption), physical (locks, guards, CCTV).

Compliance and frameworks

Compliance means meeting requirements from laws (like the IT Act and DPDP Act), regulators (RBI, SEBI, IRDAI each issue cyber security rules for their sectors), standards and customer contracts. Auditors check for evidence: policies, logs, tickets and screenshots.

• NIST Cybersecurity Framework (CSF) 2.0, released in February 2024: six functions, Govern, Identify, Protect, Detect, Respond, Recover. Free and widely used.
• ISO/IEC 27001: the international standard for an information security management system (next lesson). Companies can be certified.
• CIS Critical Security Controls: a prioritised list of practical controls.
• PCI DSS: required by card brands for anyone handling payment card data.
• SOC 2: an audit report many SaaS companies give to US customers.

register = [("R-01", 4, 5), ("R-02", 3, 5), ("R-03", 2, 3)]
for rid, likelihood, impact in sorted(register, key=lambda r: r[1] * r[2], reverse=True):
    print(rid, likelihood * impact)

Common mistakes

• Compliance as a checkbox: passing an audit while real risks stay open.
• Policies nobody reads or follows, copied from the internet.
• Risks without an owner. Every risk needs a named person.
• Never updating the register after incidents or big changes.