Module 10: Governance, risk & compliance (GRC)

Estimated time: 4-5 hours (including the lab) · Prerequisites: M0, M5 (Australian cyber context)

This module maps directly to the #2 entry job for career changers: the GRC Analyst. If you come from audit, risk, project management, legal, compliance or business analysis, this is very likely your fastest route into cyber. It rewards the writing, stakeholder-wrangling, and attention-to-detail skills you already have far more than deep technical ability. Say that out loud in your applications.

Security+ SY0-701 mapping: Domain 5: Security Program Management & Oversight (governance, risk, compliance, audits, third-party risk).

What you'll get from this module

• Explain governance, risk and compliance in plain English.
• Work through the risk equation and the four risk treatments.
• Build and read a risk register.
• Compare the major frameworks (Essential Eight/ISM, ISO 27001, NIST CSF 2.0, SOC 2, APRA CPS 234).
• Explain what auditors ask for and why evidence matters.
• Distinguish policies, standards, procedures and guidelines.
• Understand third-party/vendor risk, a huge entry-level GRC workload.
• Produce portfolio artefact #2: a mini risk register.

---

1. What GRC actually is

Strip away the jargon and GRC is three plain questions an organisation must answer:

• Governance: who decides, and what are the rules? Leadership sets direction, assigns responsibility, and writes policies. It's the "who's in charge and what do we stand for" layer.
• Risk: what could hurt us, how badly, and what do we do about it? Identifying, measuring, and deciding how to handle things that could go wrong.
• Compliance: what rules apply to us, and can we prove we follow them? Laws (like the Privacy Act), contracts, and standards, plus the evidence that you actually meet them.

A GRC analyst spends their days making these concrete: updating a policy, assessing a risk, chasing evidence for an audit, reviewing a vendor. Very little of it is technical hacking; a lot of it is careful thinking, clear writing, and following up with people.

---

2. Risk fundamentals

The core relationship every GRC analyst carries in their head:

Asset → Threat → Vulnerability → (Likelihood × Consequence) = Risk

• Asset: something of value (customer data, a payroll system, a reputation).
• Threat: something that could harm it (a ransomware crew, a careless insider, a flood).
• Vulnerability: a weakness the threat could use (an unpatched server, no MFA).
• Likelihood × Consequence: how probable is it, and how bad if it happens? Together they give the risk rating (often plotted on a colour-coded matrix: low/medium/high/extreme).

Risk appetite is how much risk the organisation is willing to accept in pursuit of its goals, set by leadership. It's the yardstick you measure each risk against: is this within appetite, or does it need action?

The four risk treatments

Once a risk is rated, the organisation chooses how to treat it:

Treatment	Meaning	Example
Avoid	Don't do the risky thing at all	Retire a legacy system rather than keep running it
Reduce / mitigate	Apply controls to lower likelihood or consequence	Add MFA; patch; back up
Transfer	Shift the impact to someone else	Cyber insurance; outsource to a provider with the obligation
Accept	Consciously live with it (within appetite)	A low-impact risk too costly to fix, accepted and documented

Note that "accept" is a legitimate, formal choice, but it must be decided and recorded by someone with the authority, not just ignored.

The risk register

A risk register is the living spreadsheet (or GRC-tool table) that tracks every identified risk. Typical columns:

Risk ID	Risk description	Asset	Likelihood	Consequence	Rating	Treatment	Owner	Status

Maintaining the register (adding risks, chasing owners for updates, re-rating after controls land) is core junior GRC work.

---

3. The frameworks landscape

Frameworks give organisations a ready-made structure of controls so they're not inventing security from scratch. The ones you must be able to name:

Framework	What it is	Where you'll meet it
ASD Essential Eight + ISM	Australia's government baseline: eight mitigation strategies (Essential Eight) plus the broader Information Security Manual. Maturity levels 0-3.	Any Australian government or gov-adjacent org. Cross-linked in M5.
ISO/IEC 27001	The international, certifiable standard for an Information Security Management System (ISMS). Organisations get formally audited and certified against it.	Enterprises, especially those selling internationally or to security-conscious customers.
NIST Cybersecurity Framework 2.0	US framework organised into six functions: Govern, Identify, Protect, Detect, Respond, Recover. Widely used globally as a common language.	Very common reference worldwide; US-influenced companies.
SOC 2	A US audit/report (Type I and II) on how a service provider handles security, availability, confidentiality, etc. Often requested from SaaS vendors.	SaaS and cloud providers proving trust to customers.
APRA CPS 234	Australian regulation requiring APRA-regulated financial entities (banks, insurers, super funds) to maintain information security capability and report incidents.	Financial services sector in Australia.

NIST CSF 2.0 is a US government publication in the public domain. You may describe and use it freely; we attribute NIST as a courtesy. Its six functions (Govern, Identify, Protect, Detect, Respond, Recover) are a genuinely useful mental checklist for any security programme. See nist.gov/cyberframework.

APRA CPS 234 in one paragraph: if you want GRC work in Australian banking, insurance or superannuation, know CPS 234. It's a prudential standard from the Australian Prudential Regulation Authority that obliges regulated entities to clearly define information-security roles, maintain controls sized to the threats they face, test those controls, and notify APRA of material security incidents (typically within 72 hours). It's a major driver of GRC hiring in the financial sector.

---

4. Audits and evidence

Compliance is only real if you can prove it, and that proof is what an audit checks.

• Internal audit: the organisation's own team checks its controls, ahead of external scrutiny.
• External audit: an independent party (e.g. an ISO 27001 certification body or a SOC 2 auditor) checks and formally attests.

The auditor's refrain is: "show me the evidence." Not "do you have MFA?" but "show me a report proving MFA is enforced on all admin accounts, dated within the audit period." Control evidence (screenshots, config exports, logs, signed policies, tickets) is the currency of GRC. A big part of the junior role is collecting and organising evidence so audits go smoothly. Learning to gather clean, dated, unambiguous evidence is a genuinely marketable skill.

---

5. The document hierarchy

GRC lives on documents, and their names are not interchangeable:

Document	Answers	Force	Example
Policy	What we require and why	Mandatory, high-level	"All access must use MFA."
Standard	Specifically what meets the policy	Mandatory, specific	"MFA must use an authenticator app or hardware key, not SMS."
Procedure	How, step by step	Mandatory, operational	"To enrol MFA: 1… 2… 3…"
Guideline	Recommended good practice	Advisory	"We suggest reviewing your sign-in history monthly."

Knowing the difference (and keeping them consistent with each other) is exactly the kind of tidy-minded work GRC teams value.

---

6. Third-party / vendor risk

Modern organisations rely on dozens or hundreds of suppliers (SaaS tools, cloud, contractors), and each vendor is a potential way in. Many big breaches came through a third party. Managing this is third-party (vendor) risk management, and it's one of the largest entry-level GRC workloads.

The bread-and-butter task: sending vendors security questionnaires, reading their answers and evidence (their ISO 27001 certificate, their SOC 2 report), spotting gaps, and recording the residual risk. It's repetitive, detail-heavy, and communication-heavy, which is exactly why it's often handed to juniors, and exactly why career changers who are organised and good with people do well at it.

---

7. A day in the life of a junior GRC analyst

A realistic slice:

• Update three risk register entries after last week's control changes; chase two risk owners who haven't responded.
• Send a vendor questionnaire to a new SaaS supplier; review the answers from another and flag a missing MFA control.
• Collect evidence for an upcoming ISO 27001 surveillance audit: export access-review reports, tidy the folder.
• Help redraft an acceptable-use policy so it's readable and current.
• Sit in a project meeting to flag a security requirement early (shift-left governance).

Transferable skills that matter most:

• Writing: clear policies, risk descriptions, audit responses.
• Stakeholder wrangling: politely getting busy people to give you evidence and decisions.
• Spreadsheets: registers, trackers, questionnaire matrices.
• Attention to detail: dates, versions, "does this evidence actually prove the control?"

If those sound like your current job, you're closer to cyber than you think.

---

🧪 Lab 10: Build a mini risk register (portfolio artefact #2)

In M5 you produced an Essential Eight gap list for an organisation (real or fictional). Now turn its top 5 gaps into a proper risk register, the artefact a GRC hiring manager most wants to see.

Steps:

1. Open a spreadsheet with these columns: Risk ID · Risk description · Asset · Likelihood · Consequence · Rating · Treatment · Owner · Status.
2. Take your top 5 Essential Eight gaps and write each as a risk: describe what could happen because of the gap, not just the gap itself.
3. Rate each: Likelihood (Rare → Almost Certain) and Consequence (Insignificant → Severe), then combine into a Rating.
4. Choose a treatment (avoid / reduce / transfer / accept) and name a realistic owner.
5. Write one clear sentence of justification per risk in a notes column.

Original example row to model yours on:

Risk ID	Risk description	Asset	Likelihood	Consequence	Rating	Treatment	Owner	Status
R-01	No multi-factor authentication on staff email means a phished password alone lets an attacker read and send mail, enabling business email compromise.	Microsoft 365 email	Likely	Major	High	Reduce: enforce app-based MFA for all users	IT Manager	Open

Portfolio tip: save this as risk-register.xlsx (and a screenshot) in your portfolio repo. Paired with the M8 incident note, you now have two concrete artefacts (one for SOC applications, one for GRC) that put you ahead of applicants who only have a certificate.

---

Self-check

Answer before you reveal. The attempt is what makes it stick. Your score and card ratings are saved on this device only.

Scored self-check

Check your understanding

Commit to an answer before you check: the attempt is what makes it stick. Your first answer to each question is the one scored; practising again afterwards doesn't change it. Saved on this device only.

Question 1 of 7Your team lead says: “Find out which rules apply to us under the Privacy Act, and make sure we can prove we follow them.” Which part of GRC is this?

GovernanceRiskCompliance

Question 2 of 7After rating a ransomware risk as high, your organisation buys cyber insurance so much of the financial impact would land on the insurer. Which risk treatment is that?

TransferAcceptReduce / mitigateAvoid

Question 3 of 7You’re interviewing for a GRC role at an Australian superannuation fund. Which framework or regulation should you swot up on first?

SOC 2APRA CPS 234NIST Cybersecurity Framework 2.0ASD Essential Eight + ISM

Question 4 of 7An ISO 27001 auditor asks: “How do you know MFA is enforced?” What would actually satisfy them?

A confident “yes, MFA is mandatory here” from the IT managerA copy of the MFA policy signed by leadershipA configuration export, dated within the audit period, showing MFA enforced on all admin accountsA screenshot of the MFA settings from two years ago

Question 5 of 7“MFA must use an authenticator app or hardware key, not SMS.” In the document hierarchy, what have you just read?

A policyA procedureA guidelineA standard

Question 6 of 7A new SaaS vendor returns its security questionnaire, and nowhere in the answers is MFA mentioned. What’s the bread-and-butter GRC move?

Assume their attached ISO 27001 certificate covers itFlag the gap and record the residual riskNothing: a vendor’s security is their own problem

Question 7 of 7A junior GRC analyst sits in a project kick-off meeting to raise a security requirement before anything gets built. What’s this practice called?

Risk acceptanceAn internal auditRisk transferShift-left governance

Treatment names, framework names, document types: a GRC interviewer expects you to use these words precisely and without hesitation, so rate yourself honestly and let the spaced repeats make them automatic.

Flashcards · spaced repetition

Drill the key terms

Say your answer out loud (or in your head) before revealing. Recall is the workout. "Knew it" pushes a card's next review further out; "Review again" brings it back today.

Card 1 of 18

Prompt

GRC: the three plain questions?

---

Next module

➡️ M11: Cloud security fundamentals. How security changes in AWS, Azure and GCP: the shared responsibility model, identity in the cloud, and common misconfigurations.