Certifiable standard
ISO/IEC 27001
The international, certifiable standard for building, running and continually improving an information security management system (ISMS).
Focus area · GRC
Governance, Risk & Compliance
How security programmes are governed, how risk is assessed and treated, and how frameworks turn into evidence.
Governance, risk and compliance is where cybersecurity meets the rest of the organisation. Governance decides who is accountable and how decisions are made. Risk management decides what matters most and what to do about it. Compliance shows, with evidence, that obligations from laws, contracts and standards are being met.
Good GRC is not paperwork for its own sake. A well-run programme lets an organisation answer a customer questionnaire, pass an audit and brief its board from the same source of truth, because policies, controls and evidence are designed once and reused.
Listen to this page
Read aloud in UK English by your own device. Nothing is sent anywhere, and the voice is whichever one your browser provides.
What does this area cover?
- Risk assessment and treatment
- Consistent methods for likelihood, impact and risk acceptance, and treatment decisions that owners actually sign off.
- Policy and control design
- Policies people can follow, and controls mapped to the risks and frameworks they serve.
- Audit readiness and evidence
- Producing evidence as a by-product of normal work rather than in a rush before fieldwork.
- Multi-framework mapping
- One control set, many frameworks: mapping ISO/IEC 27001, SOC 2, NIST CSF and sector rules.
Related frameworks
Where does GRC show up in the rules?
Voluntary framework
NIST CSF 2.0
NIST's voluntary, outcome-based framework for understanding, assessing, prioritising and communicating cybersecurity risk, organised into six functions including the new Govern function.
Industry standard
PCI DSS
The global industry standard of technical and operational requirements for any entity that stores, processes or transmits payment account data, or can affect its security.
Attestation framework
SOC 2
An independent CPA examination that reports on how a service organisation's controls meet the AICPA Trust Services Criteria.
Government programme
CMMC
The US defence programme that verifies whether contractors protect Federal Contract Information and Controlled Unclassified Information. Phase 2 was suspended in July 2026 pending a programme review.
Government programme
FedRAMP
The US government programme that standardises security assessment and authorisation of cloud services used by federal agencies, now moving from Rev5 baselines to the automation-focused FedRAMP 20x model.
Law / regulation
HIPAA
US federal law and HHS rules protecting the privacy and security of protected health information held by covered entities and their business associates.
Certifiable standard
ISO/IEC 27701
The international standard for a privacy information management system (PIMS). Since its 2025 edition it can be implemented and certified on its own, without ISO/IEC 27001.
Reading
Guides and explainers
Comparison
SOC 2 vs ISO/IEC 27001: What Each One Actually Proves
SOC 2 is an attestation report; ISO/IEC 27001 is a management-system certification. How they differ in scope, evidence, audience and effort, and when you need both.