Technical controls don't exist in a vacuum — someone decides which risks matter, sets the rules, and proves to regulators and customers that the rules are followed. That's GRC. Governance sets the direction, risk management decides the priorities, and compliance proves it's being done. This page covers the risk maths, the governance structures, the frameworks you'll align to, and the UK law that turns getting it wrong into a real cost.
Board oversight, strategy and accountability. Defines roles (CISO, SIRO, DPO), policies and the organisation's risk appetite. The "who decides".
Identify, assess and treat risk to assets. Scores likelihood × impact against appetite and decides what to do about each. The "what matters".
Meeting laws, regulations, standards and contracts — with the evidence, audit trails and attestation to prove it. The "how we prove it".
Governance sets the direction and the appetite. Risk management works within that appetite to prioritise. Compliance evidences that the controls chosen are actually operating. No evidence = no control, as far as an auditor is concerned.
Risk is the intersection of how likely something is and how bad it would be. Plotting both on a 5×5 matrix turns a vague worry into a comparable score, so limited budget goes to the risks that matter most.
Every risk has two values worth tracking: inherent risk is the exposure before any controls; residual risk is what remains after controls are applied. The job of a control is to move a risk from the first to the second — ideally to within appetite.
| Option | Meaning | Example |
|---|---|---|
| Avoid | Stop the risky activity entirely | Decommission a legacy system rather than secure it |
| Reduce (mitigate) | Apply controls to lower likelihood or impact | Patch, MFA, segmentation, backups |
| Transfer (share) | Shift the financial impact to a third party | Cyber insurance; outsource to a managed provider |
| Accept | Tolerate it — within appetite, formally signed off | A low-impact risk too costly to treat |
Qualitative scoring (high/medium/low) is quick; quantitative scoring puts a number on it, which is what justifies spend to a board:
If a control costs less per year than the ALE it removes, it pays for itself. That single comparison is how security spend gets approved.
The central record where every identified risk is logged, scored, assigned an owner, given a treatment decision, and tracked over time. It's the working artifact that connects all of the above — and the first thing an auditor asks to see.
| Role | Responsibility |
|---|---|
| CISO — Chief Information Security Officer | Owns the security strategy and programme |
| SIRO — Senior Information Risk Owner | Board-level accountability for information risk (common in UK public sector) |
| DPO — Data Protection Officer | Oversees data-protection compliance; required under UK GDPR in defined cases |
| Risk / asset owners | Accountable for specific risks and the assets behind them |
Operational teams own and manage risk day to day — they run the controls.
Risk & compliance functions set policy and oversee the first line.
Internal audit gives independent assurance to the board.
Frameworks give a structured, recognised set of controls so you're not inventing security from scratch — and so customers and regulators can trust a common baseline.
| Framework | Structure | Typically used by |
|---|---|---|
| ISO/IEC 27001:2022 | Certifiable ISMS · 93 Annex A controls in 4 themes (Organizational 37, People 8, Physical 14, Technological 34) | Any org wanting a certifiable, auditable baseline |
| NIST CSF 2.0 | 6 functions: Govern, Identify, Protect, Detect, Respond, Recover | Flexible, risk-based; widely used in the US & beyond |
| NIST SP 800-53 | Detailed control catalogue (hundreds of controls) | US federal systems & high-assurance environments |
| CIS Controls v8.1 | 18 controls in 3 Implementation Groups (IG1–IG3) | Prioritised, practical starting point for any size |
| Cyber Essentials / Plus | UK NCSC scheme · 5 technical controls | UK orgs; required for many government contracts |
| SOC 2 | Audit against the 5 Trust Services Criteria | SaaS & service providers proving security to customers |
| PCI DSS | 12 requirements for cardholder data | Anyone storing/processing payment-card data |
Frameworks are voluntary structures (though often contractually required). Laws are mandatory. ISO 27001 tells you how to build an ISMS; UK GDPR tells you what you must do with personal data. Good GRC uses the first to satisfy the second.
For a UK organisation these are the statutes that carry real teeth. Compliance isn't optional good practice — it's a legal duty with defined penalties.
| Law / regulation | Covers | Maximum penalty |
|---|---|---|
| UK GDPR / Data Protection Act 2018 | Processing of personal data | Up to £17.5m or 4% of global annual turnover, whichever is higher |
| 72-hour breach reporting | Notifiable personal-data breaches | Must be reported to the ICO within 72 hours |
| NIS Regulations 2018 | Operators of essential services & digital providers | Fines up to £17m |
| Computer Misuse Act 1990 | Unauthorised access & modification | Up to life imprisonment (most serious cases); the core UK hacking law |
| PECR 2003 | Electronic marketing, cookies, comms | Up to £500k (ICO), alongside UK GDPR |
Regulatory fines are the visible number. The larger costs are usually lost contracts, failed certifications, incident response and recovery, litigation, and reputational damage — which outlast any penalty. This is the business case for GRC in one sentence.
An ISMS (Information Security Management System) is the managed, documented system that ties governance, risk and compliance together. ISO 27001 runs it as a continuous PDCA loop — security is never "done", it's maintained.
MANAGE RISK · PROVE COMPLIANCE · EARN TRUST