Governance, Risk Management & ISO 27001

Why GRC Exists

Security teams don't get unlimited budget or unlimited attention from leadership. Governance, Risk, and Compliance (GRC) is the discipline that decides which risks get money spent on them, who is accountable when something goes wrong, and how an organization proves to regulators, customers, and auditors that it is actually doing what it claims.

The Three Pillars

Risk Fundamentals

Every risk statement has four ingredients:

• Asset — something with value (a database, a server, a reputation)
• Threat — something that could harm the asset (an attacker, a flood, an insider)
• Vulnerability — a weakness the threat can exploit (unpatched CVE, no MFA)
• Impact — the cost if the threat exploits the vulnerability

Risk exists only where a threat and a vulnerability meet on a valuable asset. No vulnerability, no risk — even against a highly motivated threat.

Quantitative Risk: SLE, ARO, ALE

• SLE (Single Loss Expectancy) = Asset Value × Exposure Factor (the % of the asset's value lost in one incident)
• ARO (Annualized Rate of Occurrence) = how many times per year the event is expected
• ALE (Annualized Loss Expectancy) = SLE × ARO

Worked example: a payment server is worth $200,000. A ransomware incident is expected to destroy 50% of its value (EF = 0.5) and is expected to happen once every 4 years (ARO = 0.25).

SLE = 200,000 × 0.5   = 100,000
ALE = 100,000 × 0.25  = 25,000

Budget roughly $25,000/year on controls that reduce this specific risk — spending far more than that on one risk while others go unfunded is a governance failure, not a security win.

Risk Treatment Strategies

There is no "eliminate" option: residual risk always remains after treatment.

Building a Risk Register

Likelihood × Impact gives a fast triage score; it is not a substitute for the ALE calculation above when real budget decisions are on the table.

ISO/IEC 27001: The ISMS

ISO 27001 doesn't certify that you have zero vulnerabilities — it certifies that you run an Information Security Management System (ISMS): a repeatable, audited process for managing risk, driven by the PDCA cycle:

• Plan — define scope, risk assessment methodology, and objectives
• Do — implement controls and treat risks
• Check — internal audits, management review, monitor metrics
• Act — corrective action, continual improvement

Annex A Controls (2022 revision)

The 2022 revision reorganized 93 controls into 4 themes:

Certification Path

1. Stage 1 audit — auditor reviews documentation and readiness
2. Stage 2 audit — auditor tests whether controls are actually operating
3. Certification — valid 3 years
4. Surveillance audits — yearly spot-checks to keep the certificate live

Who Owns What

• Business/asset owners own the risk — they accept it or fund its treatment
• CISO/security team advises on risk and implements controls
• Internal audit independently checks controls operate as designed
• External auditor certifies against ISO 27001 or attests for SOC 2 (next lesson)

Common Pitfalls

• Treating the risk register as a compliance checkbox instead of a living document reviewed quarterly
• Confusing "audited" with "secure" — ISO 27001 certifies a process, not the absence of vulnerabilities
• Leaving a risk unowned — an unowned risk never gets treated
• Funding the risks that are easiest to fix rather than the ones with the highest ALE