GRC Triad: Governance, Risk, and Compliance.
Governance: Strategic leadership, structures, and processes that ensure an organizations IT infrastructure aligns with its business objectives.
Monitoring: Regularly reviewing and assessing the effectiveness of the governance framework.
Revision: Updating the governance framework to address these gaps or weaknesses.
You must use monitoring and governance to stay up-to-date with regulatory, cultural, and technological changes.
Board of Directories: Group of individuals elected by shareholders to oversee the management of an organization.
Committee: Subgroups of a board of directories each with a specific focus (e.g., cybersecurity committee).
Government Entities: Establish laws and regulations that organizations must comply with (e.g., FTC).
Centralized Structures: Decision-making authority concentrated at the top levels of management.
Decentralized Structures: Distributes decision-making authority throughout the organization.
Whether an organization is centralized or decentralized depends largely on the organization, goals, and size.
Outlines dos and don’ts for users interacting with an organizations IT systems and resources.
Outline how an organization protects its information assets from internal and external threats.
Focuses on how an organization continues critical operations during and after a disruption.
Focused specifically on how an organization will recovers its IT systems and data after a disaster.
Plan for handling security incidents.
Guides how software is developed within an organization.
Aims to ensure that changes are implemented in a controlled and coordinated manner, minimizing risk of disruptions.
Provide a framework for implementing security measures, ensuring all aspects of an organizations security posture are addressed.
Password Standards: Dictate complexity and management of passwords.
Access Control Standards: Determine who has access to what in an organization.
These standards may also cover principles of least privilege and separation of duties.
Physical Security Standards: Physical measures taken to protect and organizations assets and information.
Encryption Standards: Ensure that intercepted data remains unreadable and secure.
Systematic sequences of actions or steps taken to achieve a specific outcome.
Emergency Evacuation Procedure: Outlines steps employees should take in case of an emergency, such as fire or natural disaster.
Data Backup Procedure: Details how and when data should be backed up to prevent data loss.
Change Management: Systematic approach to dealing with changes within an organization.
Onboarding: Process of integrating new employees.
Offboarding: Process of managing transition when employee leaves.
Playbooks: Checklist of actions to perform to detect and respond to a specific type of incident.
Cover wide range of areas from data protection and privacy to environmental standards and labor laws (e.g., GDPR). Non-compliance can result in severe penalties.
Closely tied to regulatory, but also encompass contract law, intellectual property, and corporate law.
Specific standards and practices prevalent in a particular industry.
Local, regional, national, and global regulations.
Systematic process of collecting and presenting data to demonstrate adherence to compliance requirements.
Process of regularly reviewing and analyzing and organizations operations to ensure compliance with laws, regulations, and internal policies.
Can streamline data collection, improve accuracy, and provide real time compliance monitoring.