GRC & Compliance

GRC stands for governance, risk and compliance. Governance defines who decides and by which policies, risk management identifies and treats what could harm the organisation, and compliance demonstrates with evidence that external laws, standards and contracts are met.

GRC creates much of the demand for testing, defines scope and rules of engagement, and decides whether findings get fixed. Findings expressed as business risk with an owner and a recommended treatment reach the people who assign budgets and deadlines.

Mitigate the risk with a control, transfer part of the impact for example through insurance or contracts, avoid it by stopping the risky activity, or accept it consciously. Acceptance must be decided and documented by the accountable risk owner.

No. CVSS rates the technical severity of a vulnerability in general. Risk adds context such as the affected asset, the data involved and realistic threats, so two findings with the same CVSS score can deserve very different priorities.

No. Audits check whether defined controls exist and work as described, not whether every attack path is closed. Compliance is a minimum floor; risk management decides what protection goes beyond it.

Inherent risk is the risk before new controls are applied; residual risk is what remains once they are in place. If a fix cannot be applied yet, compensating controls can lower the residual risk for a while, and that interim state is recorded as a scoped, approved and time-limited exception with clear exit criteria.