Governance, Risk, and Compliance are the three interdependent disciplines that together constitute the GRC framework, and compliance is the pillar whose operational function is most directly visible to the external audiences whose confidence the organisation must maintain. Where governance establishes the structures, policies, and accountabilities through which the organisation is directed and controlled, and risk management identifies and addresses the uncertainties that threaten its objectives, compliance provides the verification layer that confirms the organisation is meeting the obligations those structures impose and that the controls those risk assessments require are functioning as designed. In practice, the three pillars are so closely integrated that the boundaries between them are often artificial, but understanding compliance’s specific function within the GRC system is essential for the ISO who must govern all three and explain their interrelationship to the board, executive management, and the regulatory and audit audiences whose scrutiny the compliance function must satisfy.
Compliance in the information security context encompasses three distinct but related obligation categories whose combined requirements define the compliance landscape that the organisation must navigate. Legal and regulatory compliance addresses the obligations imposed by statute, regulation, and regulatory guidance that carry enforcement consequences including financial penalties, operational restrictions, and reputational damage when they are not met. Standards and framework compliance addresses the obligations arising from the organisation’s voluntary adoption of recognised security standards such as ISO 27001, NIST CSF, or CIS Controls, and from the certification commitments those adoptions create. Contractual compliance addresses the security obligations that the organisation has accepted through its commercial relationships with customers, partners, and suppliers, whose breach creates both legal liability and reputational consequences.
Keep reading with a free Eristotle account.
Every document across our Bodies of Knowledge is free to read once you are signed in. No payment, no tier.
