The GRC approach to Cyber Security

GRC is an acronym for governance, risk management, and compliance. But, as a concept, it means much more than those three separate terms put together. Wikipedia provides a good definition for the concept; Governance, risk management, and compliance is aiming to assure that an organization reliably achieve its objectives, addresses uncertainty and acts with integrity. It refers to a collection of critical and synergistic capabilities that should work together to achieve aligned business objectives.

GRC is not something new. Every company does GRC, but at a different level of maturity. Spreadsheets, Word documents and emails are also a form of doing GRC in organizations.

A well-planned GRC strategy supported with a GRC platform enables several benefits: Improved decision making, higher quality Information, increased accountability, increased collaboration, enhanced organizational culture, increased efficiency, increased agility, increased visibility, protected reputation, better resource allocation, reduced costs with optimal investment decisions, reduced fragmentation within the organization and preserved institutional memory.

Cyber security is one of the main domains of GRC, and CISOs are often the champions of GRC Implementations worldwide.

GRC utilizes approaching security activities in a mature way and enhances the likelihood of achieving security objectives by aligning processes that support each other in the greater context of the security organization. GRC also enables a company to foster a security organization that is well-coordinated and integrated.

RSA GRC Reference Architecture

With a well-planned and executed GRC Strategy, security domains listed below can be managed in a single platform with increased automation, integration, unification and simplification.

• Organizational & Asset Management
• Information Security Risk Management
• Compliance Management
• Cyber Incident & Security Operations
• Business Continuity Management
• Privacy Management
• Audit Management
• Third Party Management
• Policy Management
• Metrics Management
• Issues Management
• ISMS Governance

GRC Platforms utilize best practice security processes to improve your security process maturity in a short time. They may have several features, functions and pre-built data to utilize such as;

• Built-in, best practice security related processes
• Native Integrations to SIEM, CMDB, Vulnerability Scanners
• Libraries for risks, controls and metrics,
• Pre-loaded authority sources (ISO 27001, COBIT, ITIL etc)
• Pre-loaded policies and mapping to ISO 27001 controls
• Workflows,
• Advanced access control,
• Email notifications,
• Discussion forums,
• Pre-defined template exports,
• Scheduled report distributions,
• Automated campaigns and questionnaires,
• Criteria driven form layouts
• Dashboards and Reporting

Governify is a Finnish company located in Espoo and an authorized partner of RSA, dedicated to GRC processes and RSA Archer GRC Platform development, including implementations in the cyber security domain. We are serving several Archer customers from wide-range of industries with our certified consultants. We will guide you on every step of your GRC Journey to mature, automate and integrate your cyber security processes as we do in several customers from different industries in EMEA region.

Governify upgrades organizations through our services that are designed to covers all GRC and Archer needs;

• GRC Program Services: Building and maintaining an effective and agile GRC Capability
• GRC Process Services: Maturing and integrating your cyber security processes
• GRC Platform Services: Developing and maintaining your GRC Platform environment
• GRC Practice Services: Increasing the knowledge and awareness of your GRC / security roles

Exploit the proven benefits of security management with GRC (Governance, Risk & Compliance) approach together with Governify.

– Unal Perendi, Managing Director, Governify Ltd.