GRC Cybersecurity Notes

What is GRC in Cybersecurity?

GRC (Governance, Risk Management, and Compliance) is an integrated framework for aligning IT with business objectives, managing risks, and ensuring adherence to laws and regulations in cybersecurity.

What are the three core components of GRC?

Governance, Risk Management, and Compliance.

What does 'Governance' entail in GRC?

Governance establishes policies, roles, and accountability within an organization to protect digital resources and align with company goals.

What is the purpose of 'Risk Management' in GRC?

Risk management identifies, assesses, and mitigates threats to the confidentiality, integrity, and availability of data and systems.

What does 'Compliance' ensure in GRC?

Compliance ensures adherence to applicable laws, regulations, and standards (e.g., GDPR, HIPAA, ISO 27001).

What is the CIA triad in cybersecurity?

Confidentiality, Integrity, and Availability.

How is risk typically calculated in cybersecurity?

Risk is calculated using the formula: Risk = Likelihood \times Impact.

Name three types of cybersecurity controls.

Preventive (e.g., firewalls), detective (e.g., Intrusion Detection Systems - IDS), and corrective (e.g., incident response).

What are some common cyber risks mentioned?

Malware (viruses, ransomware), phishing variants, and password attacks.

GRC in Cybersecurity

An integrated framework for aligning IT with business objectives, managing risks, and ensuring adherence to laws and regulations in cybersecurity. It also aims to make cybersecurity accessible to non-technical professionals.

Cybersecurity

The protection of systems, networks, and data from digital threats.

Governance

In GRC, it establishes policies, roles, and accountability for protecting digital resources, aligning with company goals, risk tolerance, and regulatory mandates.

Risk Management

In GRC, it identifies, assesses, and mitigates threats to confidentiality, integrity, and availability of data, as well as managing and monitoring cyber risks.

Compliance

In GRC, it ensures adherence to laws, regulations, and standards (e.g., GDPR, HIPAA, PCI DSS, SOX, NIST CSF, ISO 27001).

CIA Triad

Core concepts of cybersecurity: Confidentiality, Integrity, and Availability.

Risk Calculation

Risk = Likelihood \times Impact

Common Cybersecurity Risks

Malware (viruses, ransomware), phishing variants, and password attacks.

Quantitative Risk Math

Risk = Likelihood \times Impact

GRC Tools

Specialized software (e.g., RSA Archer, Hyperproof) for optimizing governance, risk, and compliance workflows and supporting automation.

Core GRC Skills for Non-Tech Professionals

Communication, Analytical/Problem-Solving, Continuous Learning, Regulatory Knowledge, Project Management, Collaboration, Attention to Detail, Decision-Making, Resilience, and Adaptability.

Useful GRC Certifications

CISA, CISM, CRISC, CIPP, CRCM.