Security Governance · Topic 1 of 3
Governance, Risk and Compliance
What governance, risk and compliance (GRC) is, why it matters, the frameworks and tools that support it, and how GRC applies to outsourcing and AI.
- 3 min
- GRC joins governance, risk management and compliance.
- Map requirements to controls with owners, then monitor and report.
- Outsourcing never transfers accountability.
What it is
Governance, risk and compliance (GRC) brings three activities together so they support each other instead of working in silos:
- Governance: leadership sets direction, responsibilities and policies.
- Risk management: the organization finds and treats risks.
- Compliance: the organization meets laws, regulations, contracts and its own policies.
How it works
Purpose and importance
GRC gives leadership one view of how well the organization is protected and whether it meets its obligations. It avoids duplicated effort (one control can satisfy several requirements), makes responsibilities clear and supports good decisions.
The GRC process in practice
- Identify requirements: laws, regulations, contracts and internal policies.
- Map each requirement to controls.
- Assign each control an owner.
- Monitor and test controls, and record evidence.
- Report results and fix gaps with owners and due dates.
When a new requirement appears, for example a law requiring human review of automated hiring decisions, GRC planning maps it to a control (human review) and assigns an owner.
Frameworks and tools
| Type | Examples |
|---|---|
| Frameworks | ISO/IEC 27001, NIST Cybersecurity Framework, CIS Controls, COBIT |
| AI-specific guidance | NIST AI Risk Management Framework, ISO/IEC 42001 for AI management systems |
| Tools | GRC platforms, risk registers, control libraries, compliance dashboards |
Outsourcing and accountability
An organization can outsource a function, such as card processing or AI hosting, but it remains accountable for protecting its data. Contracts, provider assessments and monitoring are part of GRC.
Responsibility for doing a task can be handed to someone else; accountability for the outcome stays with the organization.
Handling audit findings
When an audit finds that a required control was skipped, the right response is corrective action with named owners and due dates. Closing the finding, waiting for the next audit or rewriting the policy to match bad practice leaves the gap open.
GRC for AI
Typical AI governance documents:
| Document | Purpose |
|---|---|
| Acceptable use policy | What staff may and may not do with AI tools |
| AI system inventory | Which AI systems are in use and who owns each |
| AI risk assessment | The harm an AI system could cause and how likely it is |
| Model card | A model's intended use and known limitations |
How the exam asks about this
- "A retailer outsources card processing. What does it keep?" Accountability for protecting customer data.
- "Required access reviews were skipped." Corrective actions with owners and dates.
- "What brings governance, risk and compliance together?" A GRC program.
What to remember for the exam
- GRC joins governance, risk management and compliance.
- Map requirements to controls with owners, then monitor and report.
- Outsourcing never transfers accountability.
- Fix audit findings with owned, dated actions.
- AI governance uses policies, inventories, risk assessments and model cards.
Buying a GRC tool does not create a GRC program. People, processes and ownership come first.
Common mistakes
Thinking outsourcing moves accountability to the provider.
Treating compliance as a one-time project.
Ignoring AI tools in the inventory.
Check yourself
What are the three parts of GRC?
Governance, risk management and compliance.
Who stays accountable for data handled by an outsourced provider?
The organization that owns the data.
What does an AI system inventory record?
Which AI systems are in use and who owns each one.
Topic 1 of 3 in Security Governance
Test yourself on Security Governance
The full ISC2 CC question bank has 671 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.