{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/grc","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/grc/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/grc/"},"term":{"en":"Governance, risk and compliance (GRC)","da":"Governance, risk og compliance (GRC)"},"aka":{"en":["GRC"],"da":["GRC"]},"domain":["security"],"cluster":"compliance","layer":"governance","status":"current","summary":{"en":"The joined-up work of steering security from the top, deciding which dangers to handle, and proving that rules are met.","da":"Det samlede arbejde med at styre sikkerheden fra toppen, beslutte hvilke farer der skal håndteres, og vise at reglerne overholdes."},"body":{"formal":{"en":"A way of organising security work in which governance sets direction and ownership, risk management decides where to spend effort, and compliance checks the result against laws, standards and the organisation's own policy - run as one connected process.","da":"En måde at organisere sikkerhedsarbejdet på, hvor governance sætter retning og ejerskab, risikostyring afgør hvor indsatsen skal lægges, og compliance tjekker resultatet mod love, standarder og organisationens egen politik - drevet som én sammenhængende proces."},"plain":{"en":"Like a school - the head sets the goals, the teachers spot which pupils are falling behind, and the outside examiner checks the results against the rules.","da":"Som en skole - skolelederen sætter målene, lærerne opdager, hvilke elever der halter bagefter, og censor tjekker resultaterne mod reglerne."},"inPractice":{"en":"At a Danish water utility, the newly hired security officer keeps one shared list where every risk has an owner, a planned control and a note of which NIS2 or ISO 27001 requirement it answers.","da":"I et dansk vandselskab fører den nye sikkerhedsansvarlige én fælles liste, hvor hver risiko har en ejer, en planlagt kontrol og en note om, hvilket krav i NIS2 eller ISO 27001 den svarer på."},"whyItMatters":{"en":"When the three parts are done by separate teams, the same work is done twice and gaps fall between them; joining them gives leaders one clear picture.","da":"Når de tre dele udføres af hver sit team, laves det samme arbejde to gange, og huller falder mellem stolene; samlet giver de ledelsen ét klart billede."}},"deepDive":{"en":"The term GRC was popularised in the early 2000s by OCEG (founded in 2002), whose GRC Capability Model, known as the Red Book, defines GRC as the integrated collection of capabilities that enable an organisation to reliably achieve objectives, address uncertainty and act with integrity, summarised as \"principled performance\". The rise of the concept followed the Sarbanes-Oxley Act of 2002, which forced listed companies to evidence internal controls over financial reporting and exposed how much duplicated control testing existed between finance, IT, legal and risk functions. In information security, GRC denotes the non-technical control plane around security operations.\n\nEach component has its own reference standards. Governance of IT and security draws on ISO/IEC 38500 and ISO/IEC 27014 (governance of information security) and, since NIST CSF 2.0 was published in February 2024, on the new Govern function, which covers organisational context, risk-management strategy, roles, policy, oversight and cybersecurity supply-chain risk management. Risk management uses ISO 31000:2018 as the generic framework and ISO/IEC 27005:2022 for information security risk, or COSO ERM (2017) at enterprise level. Compliance management is described in ISO 37301:2021, which is certifiable. ISO/IEC 27001 combines all three in one management system: leadership and policy (clause 5), risk assessment and treatment (6.1), and performance evaluation and audit (9).\n\nThe integration idea is operationalised through a common control framework: a single set of internal controls, each mapped to the requirements it satisfies across frameworks (for example NIS2 Art. 21, ISO 27001 Annex A, GDPR Art. 32, DORA and customer contracts), tested once and reported many times. Each risk in the risk register links to controls, owners and key risk indicators; each control links to evidence and test results; each requirement links to controls. GRC platforms implement this as a relational data model with workflows for policy attestation, risk assessment, control testing, issue management and vendor assessment, but the model can equally be kept in spreadsheets in a small organisation.\n\nOrganisationally GRC is often framed through the IIA Three Lines Model (2020): management owns and manages risk (first line), specialist risk and compliance functions provide expertise, monitoring and challenge (second line), and internal audit gives independent assurance (third line). Common failure modes are tool-first implementations that digitise poor processes, compliance-driven programmes where controls exist on paper but do not reduce risk, and risk registers disconnected from decisions. NIS2 Art. 20, which requires management bodies to approve cybersecurity risk-management measures, oversee their implementation and undergo training, has pushed governance back to the board rather than leaving GRC as a back-office function.","da":"Begrebet GRC blev udbredt i begyndelsen af 2000'erne af OCEG (grundlagt i 2002), hvis GRC Capability Model, kendt som Red Book, definerer GRC som den integrerede samling af kapabiliteter, der gør en organisation i stand til pålideligt at nå sine mål, håndtere usikkerhed og handle med integritet, sammenfattet som \"principled performance\". Begrebet voksede frem efter den amerikanske Sarbanes-Oxley Act fra 2002, som tvang børsnoterede selskaber til at dokumentere interne kontroller over den finansielle rapportering og afslørede, hvor meget dobbeltarbejde der var i kontroltest mellem økonomi, IT, jura og risikofunktioner. Inden for informationssikkerhed betegner GRC det ikke-tekniske styringslag omkring sikkerhedsdriften.\n\nHver komponent har sine egne referencestandarder. Governance af IT og sikkerhed bygger på ISO/IEC 38500 og ISO/IEC 27014 (governance af informationssikkerhed) og, siden NIST CSF 2.0 udkom i februar 2024, på den nye Govern-funktion, der dækker organisatorisk kontekst, risikostrategi, roller, politik, tilsyn og styring af risici i forsyningskæden. Risikostyring bruger ISO 31000:2018 som generel ramme og ISO/IEC 27005:2022 til informationssikkerhedsrisici eller COSO ERM (2017) på virksomhedsniveau. Compliance-styring beskrives i ISO 37301:2021, som man kan certificeres efter. ISO/IEC 27001 samler alle tre i ét ledelsessystem: ledelse og politik (punkt 5), risikovurdering og -håndtering (6.1) samt evaluering og audit (9).\n\nIntegrationstanken udmøntes i et fælles kontrolrammeværk: ét sæt interne kontroller, hvor hver kontrol er mappet til de krav, den opfylder på tværs af rammeværker (fx NIS2 art. 21, ISO 27001 Annex A, GDPR art. 32, DORA og kundekontrakter), testet én gang og rapporteret mange gange. Hver risiko i risikoregistret er koblet til kontroller, ejere og nøglerisikoindikatorer; hver kontrol til dokumentation og testresultater; hvert krav til kontroller. GRC-platforme implementerer det som en relationel datamodel med workflows for politikbekræftelse, risikovurdering, kontroltest, afvigelsesstyring og leverandørvurdering, men modellen kan lige så vel ligge i regneark i en mindre organisation.\n\nOrganisatorisk beskrives GRC ofte med IIA's Three Lines Model (2020): ledelsen ejer og styrer risikoen (første linje), specialiserede risiko- og compliancefunktioner leverer ekspertise, overvågning og udfordring (anden linje), og intern revision giver uafhængig sikkerhed (tredje linje). Typiske fejl er værktøjsdrevne implementeringer, der digitaliserer dårlige processer, compliance-drevne programmer, hvor kontrollerne findes på papiret uden at reducere risiko, og risikoregistre, der er koblet fra beslutningerne. NIS2 art. 20, som kræver, at ledelsesorganer godkender foranstaltningerne til styring af cybersikkerhedsrisici, fører tilsyn med gennemførelsen og deltager i uddannelse, har skubbet governance tilbage til bestyrelsen i stedet for at lade GRC være en backoffice-funktion."},"edges":[{"type":"requires","to":"security/governance","confidence":"high","strength":"normal"},{"type":"requires","to":"security/risk-management","confidence":"high","strength":"normal"},{"type":"requires","to":"security/compliance","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/isms","confidence":"high","strength":"normal"}],"depth":5,"sources":[{"title":"Cyber Security Fast Track - Kursuskompendium, Formål med kurset","tier":"course-material"},{"title":"OCEG GRC Capability Model (Red Book)","tier":"reference"}],"draft":true}