📋 Governance, Risk & Compliance (GRC)

• Interview stakeholders, review CMDBs, scan networks
• Catalog all data stores (databases, file shares, SaaS), compute (servers, containers, endpoints), network assets, and applications
• Classify by business criticality (Tier 1-3)

• Use MITRE ATT&CK as the threat library
• Map relevant threats based on industry (financial = nation-state, ransomware; healthcare = data theft, ransomware; retail = POS malware, card skimming)
• Include insider threats, natural disasters, supply chain risks

• Run authenticated vulnerability scans (Qualys/Tenable)
• Review configuration baselines
• Assess human vulnerabilities (phishing susceptibility)
• Review architectural weaknesses (flat networks, no segmentation)

• Use FAIR methodology for quantitative scoring
• Likelihood = Threat Event Frequency × Vulnerability (probability of successful exploitation)
• Impact = Primary Loss (direct costs) + Secondary Loss (fines, reputation, legal)
• Produce Annual Loss Expectancy (ALE) in dollar terms

• For each risk — Accept (within appetite), Mitigate (implement controls), Transfer (insurance, contract), Avoid (discontinue the process)
• Create a risk treatment plan with owners, deadlines, and success criteria

• Present risk register to leadership with heat map visualization
• Track residual risk after controls
• Establish quarterly reassessment cadence
• Document everything for audit evidence

1ASSESS — Requirements gathering: interview executives, business units, IT, legal. Define scope (which systems, data, users). Identify applicable regulations (PCI-DSS, HIPAA, SOX, GDPR). Establish security KPIs — MTTD, MTTR, vuln remediation SLA, phishing click rate.

2PLAN — Build the program plan: security architecture (zero trust, defense-in-depth), tool procurement (SIEM, EDR, CSPM, SOAR), staffing model (in-house SOC vs MSSP), communication plan (who gets notified for what). Develop the cybersecurity budget — typically 5-10% of IT budget for mature organizations.

3BUILD — Implement controls in priority order: identity & access management first (foundation), then endpoint protection, network security, cloud security. Deploy security awareness training for all employees. Build incident response plan with playbooks for top threats (ransomware, BEC, data breach).

4VALIDATE — Security governance & compliance review: verify controls against framework (NIST CSF, ISO 27001). Conduct gap analysis. Cyber risk management plan with FAIR-based quantification. Security quality assurance — pen tests, table-top exercises, red team assessments.

5OPERATE — After security approval, move to operations: continuous monitoring, threat detection, vulnerability management, compliance reporting. Establish continuous improvement cycle — lessons learned feed back into the plan.

• Establish GRC definitions, scope, and organizational buy-in
• Determine GRC type — Governance-focused, Risk-focused, Compliance-focused, or Integrated
• Most enterprises aim for Integrated GRC

• Select frameworks — COSO for internal controls, COBIT for IT governance, ISO 38500 for IT governance principles
• Implement the Three Lines model — 1st Line: operational management owns risk, 2nd Line: risk and compliance functions, 3rd Line: internal audit provides assurance

• Identify risks (workshops, threat modeling), assess (FAIR for quantitative, risk matrices for qualitative), respond (accept, mitigate, transfer, avoid), monitor continuously, report to leadership
• Cover strategic, operational, compliance, cyber, and third-party risk

• Map all regulatory requirements to controls
• Build policy hierarchy (policies → standards → procedures → guidelines)
• Monitor compliance status continuously via GRC platform

• Maintain risk registers, control libraries, policy repos, audit evidence
• This is audit readiness
• Automate evidence collection where possible (Drata, Vanta, ServiceNow GRC)

• Conduct control testing — design effectiveness (does the control exist?) and operating effectiveness (does it work consistently?)
• Internal audits, compliance reviews, evidence verification

• Risk governance across the enterprise — manage risk at strategic, operational, financial, cyber, and vendor levels
• Compliance management including regulatory tracking, policy enforcement

• Use ISO 31000 for risk management, ISO 27001 for ISMS, NIST RMF for federal, NIST CSF for industry
• Build risk analytics — KRI dashboards, trending, automated alerting on threshold breaches

• Track phish-prone percentage — the percentage of employees who click simulated phishing emails
• Industry baseline is approximately 32% (KnowBe4 data)
• After 12 months of training + simulations, target is below 5%
• Run monthly simulations with escalating difficulty: generic phishing → spear-phishing → BEC-style → deepfake voice/video
• Track by department, role, and seniority to identify high-risk groups

• Measure suspicious email reporting rate — what percentage of users report a simulated phish vs. clicking or ignoring it
• Target is above 70% reporting rate
• Mean time from phish delivery to first user report should be under 5 minutes for mature programs
• Integrate reporting with SOC via Cofense Reporter or KnowBe4 PhishER — every reported email feeds the real-time threat pipeline

• Track completion rates by module, role, and deadline
• Target above 95%
• Use micro-learning (3-5 minute modules) with spaced repetition for better retention
• Role-based paths: developers get secure coding, finance gets BEC/wire fraud, executives get whaling scenarios

• Track repeat offender rate — users who fail multiple simulations
• Enroll repeat offenders in personalized coaching
• Monitor policy violations (tailgating, clean desk, unauthorized USB use)
• Track helpdesk tickets for security-related inquiries — an increase indicates heightened awareness

• Correlate training programs with actual incident trends — did BEC/phishing incidents decrease after training deployment? Calculate ROI: if average phishing breach costs $4.7M and training costs $50K/year, even a 10% reduction in breach probability yields 9x ROI
• BOARD REPORTING: Present quarterly with trend lines — phish-prone % trending down, reporting rate trending up, and correlation with actual incident reduction
• Use industry benchmarks for context

2Identify applicable regulations based on industry, geography, and data types (PCI-DSS for payments, HIPAA for healthcare, SOX for public companies, GDPR for EU data, GLBA for financial).

3Select a control framework as the foundation (NIST CSF for US, ISO 27001 for global).

4Conduct a gap analysis — current state vs. required controls. Map gaps to risk register.

5Build policy framework — Information Security Policy, 10-15 supporting policies, standards, and procedures.

6Implement technical controls and automate evidence collection (Drata/Vanta).

7Establish risk assessment cadence — annual enterprise, quarterly for critical systems, ad-hoc for new projects.

8Third-party risk management — vendor tiering, assessment questionnaires, continuous monitoring.

9Schedule internal audits (quarterly) and external audits (annual).

0Report metrics to Board: compliance percentages, open findings, risk posture trends, KRIs.

1Loss Event Frequency (LEF) = Threat Event Frequency × Vulnerability. How often will a loss event occur?

2Loss Magnitude (LM) = Primary Loss + Secondary Loss. How much will each event cost? Example: For a ransomware scenario — LEF: 3 attempts/year × 30% success rate = 0.9 events/year. LM: $2M recovery + $1M regulatory fines + $500K reputation damage = $3.5M. ALE = 0.9 × $3.5M = $3.15M/year. This enables speaking the CFO's language — 'We have a $3.15M annual exposure to ransomware. A $500K investment in EDR+backups reduces this to $400K, yielding 5.5x ROI.' Tools: RiskLens, Safe Security.

1Vendor Inventory — catalog all third parties with data access/criticality classification (Tier 1-4).

2Due Diligence — collect SOC 2 Type II reports, ISO 27001 certificates, pen test results, security questionnaires (SIG Lite for low risk, SIG Full for high risk, CAIQ for cloud).

3Risk Assessment — score vendors on data sensitivity, access level, regulatory impact. Tier 1 (critical): annual on-site assessment.

4Contractual Controls — security requirements in MSA, right-to-audit clauses, breach notification SLA (24-48 hours), cyber insurance minimums, data processing agreements.

5Continuous Monitoring — SecurityScorecard/BitSight for external ratings, monitor for breaches/vulnerabilities.

6Offboarding — access revocation, data return/destruction certification. Report vendor risk posture to Board quarterly.

1NIST 800-53 AND NIST CSF: NIST SP 800-53 provides a catalog of 1,000+ security and privacy controls organized into 20 families (Access Control, Audit, System Integrity, Risk Assessment, etc.). NIST Cybersecurity Framework (CSF) organizes security into 5 functions — Identify, Protect, Detect, Respond, Recover. For AppSec compliance — map SAST/DAST/SCA scanning to SI-2 (Flaw Remediation), SA-11 (Developer Testing), RA-5 (Vulnerability Monitoring).

• Payment Card Industry Data Security Standard — 12 requirements for organizations handling cardholder data
• Key AppSec requirements — Requirement 6: Develop and maintain secure systems. 6.2 — risk ranking for new vulnerabilities. 6.3 — secure software development following OWASP guidelines. 6.5 — address common coding vulnerabilities (injection, XSS, CSRF). 6.6 — WAF or annual pen test for public-facing web apps
• Requirement 11 — regular vulnerability scans (ASV quarterly for external)

• Federal Financial Institutions Examination Council — guidelines for financial institution IT security
• Requires risk assessments of all applications, secure coding practices, independent security testing, vendor management, and incident response plans

• Section 404 requires internal controls over financial reporting
• For IT/security — access controls (segregation of duties, least privilege), change management with approval workflows, audit trails, and regular control effectiveness testing

• Hardening benchmarks for OS, databases, cloud, and applications
• CIS Controls — 18 prioritized controls (IG1/IG2/IG3)
• CIS Control 16 covers SAST/DAST scanning, secure coding training, remediation SLAs
• Automate with CIS-CAT, Qualys Policy Compliance, or AWS Config Rules

• Map controls across frameworks to avoid duplicate work — NIST AC-6 maps to PCI-DSS Requirement 7, SOX segregation of duties, and CIS Control 6
• Use GRC platforms (Archer, ServiceNow GRC) for evidence tracking and automated audit reporting
• Maintain a compliance calendar — quarterly ASV scans, annual pen tests, SOX testing cycles

1Tool-first strategy — buying tools before building detection capability. Fix: build visibility first.

2Compliance-driven security — passing audits but not surviving attacks. Fix: measure by risk reduction, not audit scores.

3Testing without detection — running red team exercises with no monitoring. Fix: detection maturity before advanced testing.

4No incident readiness — plans exist but are never practiced. Fix: run tabletop exercises and live drills regularly.

5Reporting without risk visibility — dashboards show metrics, not business impact. Fix: translate security data into business risk language (use FAIR model).

6One-size-fits-all controls — same protections everywhere regardless of asset criticality. Fix: risk-based prioritization using BIA.

7No integration with operations — security runs in a silo. Fix: embed security into daily business workflows (shift-left, DevSecOps).

8Budget on visibility, not capability — spending grows but incidents continue. Fix: invest in response, detection, and recovery capabilities.

9Unclear ownership — CISO, CIO, and CSO roles overlap. Fix: define RACI matrix for technology risk, security operations, and business risk. To address these systematically, I would conduct a maturity assessment against these 9 areas, create a remediation roadmap, and report progress to leadership quarterly.

1Threat Detection — monitoring for anomalies and IOCs.

2Incident Analysis — investigating and classifying events.

3Incident Response — containing, eradicating, and recovering. Supporting this cycle: Security Monitoring (continuous threat monitoring and event reporting), Security Assurance (control effectiveness testing and validation), Compliance Oversight (security audits and compliance checks), and Regulatory Reporting (incident disclosures and regulatory submissions). The cycle feeds into Continuous Security Improvement — updating detection rules, refining playbooks, patching gaps, and documenting lessons learned. This entire lifecycle ensures that governance decisions are informed by operational reality, and operations are guided by governance strategy.