What is GRC?
Governance, Risk and Compliance is a set of processes and procedure that help organizations achieve their business objective, address uncertainty, and act with integrity.
What is Governance?
Involves setting rules, strategies and policies to ensure IT system align with business goals.
It defines structure, policies and practices that make sure controls are clearly communicated, properly implemented, and supported at organizational level.
Why should we check for Risk?
Ensuring proper controls are in place and functioning.
It involves identifying threats assessing potential losses and applying strategies to reduce risks to levels acceptable to the business.
What is Compliance?
Compliance means following legal, regulatory standards applicable to organization’s IT systems.
By conforming these stated requirements, it helps reduce risks and ensures alignment with organization goals.
What are the Steps to Compliance?
Adapt - Compliance framework
Audit - Internal/ external security audit
Monitor - Monitoring process/ system changes
8 Functions of GRC
- Organize and oversee - Set outcomes, roles, responsibilities, approach, and accountability
- Assess & Align - Identify, analyze, and optimize risk mitigation
- Prevent & Promote - Establish code of conduct, policies, controls, training, and stakeholder engagements
- Detect & Discern - Set up hotlines, reporting systems, surveys, and detective controls.
- Respond and Resolve - Conduct investigations, manage crisis, ensure recovery
- Monitor and measure - Track context and performance for continuous improvement
- Inform and Integrate - Manage info, communication, tech, infrastructure
- Context and Culture - Align with business goals.
What is the relationship between laws, regulations, standards, and security frameworks?
Laws and regulations state what must happen to protect information. Standards and security frameworks provide structured steps to plan, implement, test, and monitor those requirements
What are some examples of sectors with different regulatory requirements?
Finance, credit card, healthcare, etc.
Government vs Private Sector
(Government must comply with IM8)
Regulated industries (Banks, medicine, power plant) have stricter regulations
Laws & Regulations - Finance
Sarbanes-Oxley Act (SOX) of 2002 - US law that was created to protect investors from fraudulent accounting activities by corporations.
Section 302
Purpose: To make company leaders accountable for truthful financial reporting and strong internal control systems.
Laws & Regulations - Healthcare
HIPAA (Health Insurance Portability and Accountability Act)
It is a US law that ensures data privacy and security for medical information
What are the 2 stops of HIPAA
HIPAA Privacy rule
HIPAA Security rule
what does HIPAA Privacy rule do?
- Limits the use and disclosure of sensitive PHI
- Gives patients the right to access their medical records
- Requires doctors to track and disclose how patient data is shared
What does HIPAA Security rule do?
Sets national standard to protect ePHI that is created, received, used or maintained.
Requires appropriate administrative, physical, and technical safeguards to ensure confidentiality, integrity, and security of ePHI
Law & Regulations - Credit Card
Payment Card Industry Data Security Standard (PCI DSS)
Created to prevent credit card fraud and protect cardholders from identity theft
- Requires all organizations that store, process, or transmit cardholder data to comply with PCI DSS
- Provides policies and procedures to secure credit, debit and cash card transactions
What are the Local Laws/ Regulations
- Computer misuse and cybersecurity act (Ch 50A)
- Banking Act (Ch 19)
- Cybersecurity Act 2018
- Personal Data Protection Act 2012
What does Computer misuse and cybersecurity Act do?
- Secures computer systems against unauthorized access or modification
- Requires measures to ensure cybersecurity
What does Banking Act (ch 19) do?
- Goven’s licensing and regulation of banks and related financial institutions
- Covers credit card and charge card business of banks and other institutions
Examples for CII
banking, finance, energy, water
What does Cybersecurity Act 2018 do?
Provides legal framework for protecting critical information infrastructure (CII).
Cybersecurity Code of Practice (CCOP) is issued under this Act and serves as a guideline for CII owners to follow.
CII owners has to ensure cybersecurity resilience and proactively protect CII from cyberthreats.
What are the key requirements CCoP 2.0 addresses for CII?
- Governance
- Identification
- Protection
- Detection
- Response and Recovery
- Cyber Resiliency
- Cybersecurity Training and Awareness
- Operational Technology (OT) security
What does Personal Data Protection Act 2012 do?
- Is a legal framework for personal data protection
- Compliance under IM8 is part of enforcement and audit requirements
what is (IM) 8?
Instruction Manual (IM) 8
- It is a government policy that specifies IT security policies for IT security
- Implemented by government agencies, private vendors serving these agencies must comply
Summary
By using these frameworks and tools, it helps businesses manage risk, follow laws, and stay compliant using structured tools and controls
