GRC · 4 min
What Is GRC?
Governance, risk and compliance are not the same thing
This lesson explains the concept, then checks your understanding in a short interactive exercise.
Three related disciplines
GRC bundles three functions that support each other but answer different questions.
- Governance — who decides, what direction, who is accountable
- Risk — what could go wrong, how likely, how bad, what we'll do about it
- Compliance — what we are obliged to do by law, regulation or contract
Where security and compliance diverge
A requirement can be satisfied on paper while the real risk stays open. Equally, plenty of valuable security work has no compliance requirement behind it at all.
- Compliance is a floor, not a ceiling
- Frameworks lag behind attacker behavior
- Evidence of a control existing is not proof it works
Loading the interactive lesson…