Compliance guide

What Is GRC? Governance, Risk and Compliance Explained

GRC means governance, risk and compliance. Governance decides who is accountable and what the organization is trying to protect. Risk management finds what could go wrong and chooses what to do about it. Compliance shows the organization meets the laws, contracts and standards that apply. OCEG, the group that coined the term, defines GRC as the integrated capabilities that let an organization reliably achieve objectives, address uncertainty and act with integrity.

Below: how the three parts fit, where the NIST Cybersecurity Framework 2.0 puts governance, how a first GRC cycle runs, and where to practise. Last reviewed 3 November 2026. General information, not legal or audit advice.

Updated 3 November 2026

The three parts of GRC

Part	The question it answers	Typical outputs
Governance	Who decides, who is accountable, and what are we protecting?	Security policy, roles and responsibilities, board reporting, risk appetite statement
Risk	What could harm the business, how likely is it, and what do we do about it?	Risk register, assessments, treatment plans, vendor risk reviews
Compliance	Do we meet the requirements that apply to us, and can we prove it?	Control mappings, evidence, internal audits, audit reports

The three are one loop, not three departments. Governance sets the objectives, risk management decides what matters against them, and compliance produces evidence that the chosen controls operate. The evidence then feeds back into the next risk review.

Where governance sits in NIST CSF 2.0

NIST published Cybersecurity Framework 2.0 on 26 February 2024. It organizes cybersecurity outcomes into six Functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern is new in 2.0 and sits at the centre of the framework diagram, because NIST says it informs how the other five are carried out.

NIST lists the Govern Categories as Organizational Context (GV.OC), Risk Management Strategy (GV.RM), Roles, Responsibilities, and Authorities (GV.RR), Policy (GV.PO), Oversight (GV.OV) and Cybersecurity Supply Chain Risk Management (GV.SC). If you are asked what governance means in practice for a security program, those Categories are a vendor-neutral answer. To score yourself, use the NIST CSF 2.0 tool or follow the how to run a NIST CSF assessment guide.

The frameworks GRC teams map to

NIST CSF 2.0: a framework of outcomes organized by the six Functions above. Good for structuring a program and reporting to executives.
ISO/IEC 27001: the international standard for an information security management system, which an accredited certification body can certify you against. Start with the ISO 27001 readiness checklist.
SOC 2: an examination by a licensed CPA firm against the AICPA Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy). Buyers often request the report during vendor review. See the SOC 2 readiness checklist.
Sarbanes-Oxley (SOX) Section 404: for companies that report to the SEC, management must assess internal control over financial reporting each year, and IT general controls are part of that. See the SOX ITGC checklist.
PCI DSS: the Payment Card Industry standard that applies to entities that store, process or transmit cardholder data or can affect its security. See the PCI DSS compliance guide.

Many controls satisfy several frameworks at once, so teams keep one control library and map it to each framework rather than running separate programs. The security framework comparison and the control library help with that mapping.

Run a first GRC cycle

Name the owner. One accountable executive and a short list of who approves policy and accepts risk.
List what applies. The laws, customer contracts and frameworks that actually bind you. Your lawyers and sales team know the contract list.
Assess risk. Identify the assets and threats that matter, rate them with a consistent scale and record them in a risk register.
Choose treatments. For each risk: reduce, transfer, avoid or accept, with an owner and a date. Accepting a risk is a decision someone signs, not a default.
Write the policies and map the controls. Start from the GRC Starter Kit documents and adapt them to your environment.
Collect evidence and test. Keep proof that each control ran, such as access reviews, tickets and test results, then run an internal check before an auditor does.
Report and repeat. Give leadership a short status on top risks and open findings, then run the cycle again on a set rhythm.

GRC tools and when you need one

GRC platforms store risks, controls, policies and evidence, assign owners and automate reminders. A small organization with one framework can run on a risk register and a shared folder. A platform pays off when many frameworks, many control owners and recurring audit evidence make manual tracking the bottleneck. Whatever you pick, the decisions that make it GRC, the risk appetite, the accountable owners and the exceptions, stay with people.

Frequently asked questions

What does GRC stand for?

GRC stands for governance, risk and compliance. OCEG, the Open Compliance and Ethics Group, says it originated the term, using it as early as 2002, and defines GRC as the integrated collection of capabilities that enable an organization to reliably achieve objectives, address uncertainty and act with integrity.

What is GRC in cybersecurity?

In cybersecurity, GRC is the work of deciding who is accountable for security (governance), finding and treating the risks to the business (risk management) and proving the organization meets the laws, contracts and standards that apply to it (compliance). It sits between the security engineers who build controls and the executives, auditors and customers who need evidence the controls work.

Is GRC the same as compliance?

No. Compliance is one third of GRC and asks whether you meet a stated requirement, such as a law, a contract clause or a standard. Governance and risk management decide which requirements matter and how much control is enough. An organization can pass an audit and still carry risks it never assessed, which is why GRC treats the three together.

Where does governance fit in the NIST Cybersecurity Framework?

NIST Cybersecurity Framework 2.0, published 26 February 2024, added a sixth Function, Govern, alongside Identify, Protect, Detect, Respond and Recover. NIST describes Govern as the Function where the organization’s cybersecurity risk management strategy, expectations and policy are established, communicated and monitored.

What frameworks do GRC teams work with?

Common ones are NIST CSF 2.0, ISO/IEC 27001, the AICPA Trust Services Criteria behind SOC 2 reports, and PCI DSS for payment card data. Which apply depends on your customers, regulators and contracts, not on company size. The security framework comparison tool on PlayCISO lines them up side by side.

What is a GRC tool or platform?

A GRC tool is software that holds a register of risks, controls, policies and evidence in one place, assigns owners and due dates, and produces reports for auditors and boards. Small teams often start with a spreadsheet or risk register before buying a platform. The tool does not do the governance; people still decide the risk appetite and own the controls.

What does a GRC analyst do?

Typical work includes maintaining the risk register, mapping controls to frameworks, collecting audit evidence, running vendor risk reviews, tracking policy exceptions and reporting status to security leadership. Exact duties vary by employer. The careers guides on PlayCISO cover how to get into security roles.

How do I start a GRC program?

Name an accountable executive, write down the laws, contracts and frameworks that apply, run a first risk assessment, record the results in a register with owners, pick one framework to map your controls to, and set a review rhythm. Start small and repeat the cycle; a complete program is built over several passes.