Skip to content

GRC

What is GRC?

Governance, Risk, and Compliance, an integrated approach to aligning IT with business objectives, managing risk, and meeting compliance requirements.

Governance

Related terms

GovernanceCompliance

Frameworks that govern grc

COBIT 2019View framework →ISO 27001:2022View framework →

What the standards actually require on grc

Requirements naming grc across 5 standards, quoted from the control text.

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.11 control

A procedure manages exceptions, emergencies included, within the change and configuration process, and it is aligned with the policy exception process required by GRC-04.

cloud-security-alliance-cloud-controls-matrix-ccm-v4-1::CCC-08 · Exception Management →
FedRAMP Rev 51 control

GSA must establish a means of automating security assessments, reviews and reuse of authorizations, so FedRAMP should receive all authorization and continuous monitoring artifacts as machine-readable data through APIs to the extent feasible, with PDF and Word...

fedramp-rev-5::G.6 · G.6 Automation, machine-readable artifacts and OSCAL →
HKMA TM-G-11 control

HKMA TM-G-1 implementation roadmap + status. ORGANIZATIONAL ROLES at AI: (a) BOARD + RISK COMMITTEE - TM-G-1 governance oversight + Technology Risk Management Framework approval + Risk Appetite + Pillar 2;

HKMA-TMG1-Implementation-Roles-Tooling-Status · TM-G-1 Implementation Roadmap, Roles, Tooling, Status and Future →
MITRE D3FEND1 control

Integrate D3FEND with broader cybersecurity ecosystem and frameworks. ATT&CK-D3FEND bidirectional mappings - each D3FEND defensive technique is mapped to ATT&CK offensive techniques it counters + each ATT&CK offensive technique maps to D3FEND defensive techniq...

MITRE-D3FEND-Integration-Mapping-ATTACK-CWE-CVE-CAPEC-NIST-CSF-CIS-ISO-27001-STIX-OpenC2 · MITRE D3FEND Integration + Mapping + ATT&CK + CWE + CVE + CAPEC + NIST CSF + CIS + ISO 27001 + STIX + OpenC2 →
NIST SP 800-1371 control

Architect ISCM technology stack per Section 3.3 + 3.4 including: SIEM + EDR/XDR + vulnerability scanners + configuration management + identity governance + GRC platforms + integration via APIs + SCAP + OSCAL + STIX/TAXII.

NISTSP137-3 · ISCM Technical Architecture and Automation →

Questions people ask about grc

What is GRC?
Governance, Risk, and Compliance, an integrated approach to aligning IT with business objectives, managing risk, and meeting compliance requirements.
Why is GRC important for compliance?
GRC is a key concept in Governance. Understanding grc helps organizations meet regulatory requirements, reduce risk, and demonstrate due diligence during audits. Our compliance platform maps 1,016 frameworks with 316K cross-framework control mappings.
What concepts are related to GRC?
Key concepts related to GRC include Governance, Compliance. Understanding these interconnected concepts provides a more comprehensive view of Governance requirements and helps organizations build holistic compliance programs.
Which compliance frameworks address GRC?
GRC appears in the requirement text of Cloud Security Alliance Cloud Controls Matrix (CCM) v4.1, FedRAMP Rev 5, HKMA TM-G-1, MITRE D3FEND, NIST SP 800-137. Across these standards we have identified 5 controls that name it directly, each linked to the control text on the compliance platform.
Where can I learn more about GRC?
Explore our compliance framework pages to see how grc applies across different standards and regulations. Our implementation guides provide step-by-step guidance, and the compliance platform offers AI-powered analysis of how this concept maps across 1,016 frameworks.

See how GRC applies across compliance frameworks

Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.

Explore on Platform
Written and maintained by Gerard Blokdyk, The Art of Service.