SECURITYATLAS✳

✳ The reference desk / In practice

GRC

The organizational functions that set policy, track risk, and collect assurance evidence. Not a product that grants safety.

Governance, risk, and compliance

What it means

Governance establishes who can make security decisions and what the organization expects. Risk management examines uncertain events, their consequences, and possible responses. Compliance checks applicable obligations, including contractual commitments and chosen standards. These activities overlap, but their questions differ: a completed checklist does not establish that a business risk is acceptable. Useful GRC connects policy to actual controls, accountable owners, evidence, and decisions. A small organization can begin with clear records and regular reviews; buying a tracking platform does not create those responsibilities.

The idea at a glance / Governance

Accepting a risk does not fix the control.

Keep decision authority, exposure evidence, policy review and unfinished work together.

Fictional DocSpace’s internal POL193 says selected F193 must have no public readers. Mae’s scoped review finds public copy C193 and confirms an anonymous 200 read. Dana has authority to record a risk decision for this exposure until October 2 at 09:00 UTC. Dana accepts that bounded risk in D193; Nora’s Q193 removal is still unapplied. No policy exception is recorded.

GRC: Keep decision authority, exposure evidence, policy review and unfinished work together. The explanation below describes the relationships.DocSpace · one security decisionSelected rule, decision and actual stateGovernance · Dana’s authorityD193 accepts a bounded riskEnds Oct 2 · 09:00 UTC exclusiveRisk · public C193 evidenceAnonymous read still returns 200Disclosure possible; rate unknownMae · selected POL193 reviewNo public readers is the ruleGap remains; no policy exceptionNora · unfinished treatment Q193Removal unapplied / unverifiedOriginal F193 remainsDECISION RECORDED · RISK REMAINS

READ THE PICTURE

Decision beside evidence

Dana’s bounded acceptance is recorded, while C193 remains publicly readable and POL193’s selected gap remains. Nora has not applied the removal.

Keep in mindPOL193 is a fictional internal expectation, not a law or certification standard. Trusted identities, authority and evidence records are assumed. The exercise records a selected risk decision without changing sharing or creating a policy waiver. Likelihood, earlier downloads, other obligations and broader compliance are unassessed. Acceptance is a dated decision, not a claim that harm is certain or impossible.

Read the complete example
  1. Decision beside evidence. Dana’s bounded acceptance is recorded, while C193 remains publicly readable and POL193’s selected gap remains. Nora has not applied the removal. Governance names Dana as the authorized risk owner, Mae as the reviewer and Nora as the operator. A request by Mae to accept risk is refused; Dana’s exact-scope decision is stored as D193 with an exclusive October 2 09:00 UTC end. Risk evidence is a fresh anonymous 200 read of C193; possible disclosure is documented without an invented theft probability. Compliance checks only fictional internal POL193 against that public-sharing evidence and records a gap. D193 creates no policy exception. Another independent anonymous read after acceptance still returns the copy. Q193 says applied=false and verified=false, and original F193 remains. Decision expiry, changed evidence or applied treatment require reconsideration; no broader legal, contractual or certification conclusion follows.

POL193 is a fictional internal expectation, not a law or certification standard. Trusted identities, authority and evidence records are assumed. The exercise records a selected risk decision without changing sharing or creating a policy waiver. Likelihood, earlier downloads, other obligations and broader compliance are unassessed. Acceptance is a dated decision, not a claim that harm is certain or impossible.

Diagram references: NIST CSF 2.0: authority, requirements, risk responses and oversight

AN ILLUSTRATIVE SCENARIO

Accepting a risk does not fix the control

Fictional DocSpace’s internal POL193 says selected F193 must have no public readers. Mae’s scoped review finds public copy C193 and confirms an anonymous 200 read. Dana has authority to record a risk decision for this exposure until October 2 at 09:00 UTC. Dana accepts that bounded risk in D193; Nora’s Q193 removal is still unapplied. No policy exception is recorded.

Put it to work

  1. Identify one important service, the person accountable for its risk, and the obligations that apply. Distinguish mandatory requirements from internal preferences and record how applicability was determined.
  2. Map each relevant requirement to an implemented control, an owner, and evidence that can be checked. Describe gaps and their business consequences in plain language.
  3. Set a review rhythm for risks, exceptions, and control performance. Require decisions to state the accepted exposure, responsible authority, next action, and conditions that trigger reconsideration.

How to check your work

Pick a recorded requirement and trace it to a working control, recent evidence, a responsible owner, and an exception process. Ask the owner what would make the current risk decision change; the answer should be specific enough to act on.

Connect the ideas

  • Risk

    The potential for harm, assessed using what could happen, how likely it is, its impact, and what remains uncertain.

  • Control

    A process, configuration, or technology meant to reduce a named risk or detect a named failure.

  • Residual risk

    The risk that remains after implemented safeguards, including uncertainty in its assessment.

Explore a field lesson

Find your next idea.

Tip: press / to open search. Escape closes this window.