Governance
Who is responsible for security decisions? Governance sets direction, roles, policies, and how leaders review whether security goals are being met.
GOVERNANCE · RISK · COMPLIANCE
GRC, explained through real security work.
GRC connects the decisions an organization makes, the risks it manages, and the evidence it uses to show that safeguards are working. You don’t need a compliance job title to understand the basics.
Learning note: examples here are fictional. Frameworks and obligations differ by organization and scope; this guide is educational, not legal advice or a compliance certification.
THE THREE PARTS
What GRC means
Risk management
Which events could harm people, services, or information? Risk management identifies scenarios, estimates impact and likelihood, chooses a treatment, and revisits the result.
Compliance
Which laws, contracts, or internal requirements apply? Compliance work maps applicable requirements to controls and keeps evidence that can be reviewed.
A REPEATABLE WORKFLOW
Move a risk from question to action
Name the asset, the threat or failure scenario, and the business impact in plain language.
Use the organization’s approved likelihood and impact method. Record assumptions and uncertainty.
Choose to reduce, avoid, transfer, or formally accept the risk. Assign an accountable owner and target date.
Ask whether safeguards are designed well and operating as intended. Review evidence and gaps.
Estimate residual risk after treatment and revisit it when the system, threat, or business context changes.
CONTROLS AND EVIDENCE
Connect a policy goal to what teams can observe
A control is a safeguard or process that helps manage a risk. It may prevent an event, detect it, support response, or help recovery. Technical tools can produce useful evidence about parts of a control.
SIEM-style evidence
Centralized events, alert history, retention, and investigation records can help reviewers inspect monitoring and response activities.
NDR-style evidence
Network-flow context and detections can help investigate visibility, segmentation, and unusual communication patterns.
EDR-style evidence
Endpoint coverage, process relationships, and response records can help examine endpoint monitoring and containment practices.
Evidence is not proof by itself. A screenshot or alert can support a review, but a reviewer still needs to confirm scope, ownership, timing, completeness, and whether the control actually meets the requirement.
FICTIONAL EXAMPLE
A laptop with sensitive customer data
Scenario: A company laptop stores customer-support exports. The device travels between home and office, and a phishing message may lead to credential theft or data exposure.
- Possible controls: disk encryption, multi-factor authentication, managed endpoint protection, least-privilege access, and tested backups.
- Possible evidence: device-management coverage, EDR health and response records, identity sign-in alerts, and backup restore-test records.
- GRC questions: Who owns this risk? Which data and devices are in scope? Are exceptions approved? How is evidence reviewed? What remains after safeguards are applied?
The analyst can use EDR and identity evidence to investigate. The risk owner and compliance team still decide whether the safeguards meet the organization’s requirements.
KEEP LEARNING