GOVERNANCE, RISK & COMPLIANCE
GRC playbook for cybersecurity practitioners
A practical workflow for turning cybersecurity risk into decisions, evidence, and accountable follow-up.
Set scope and ownership
Start with a business service, its accountable owner, the systems and suppliers it depends on, and the outcomes it needs to achieve. Use a NIST CSF 2.0 Current Profile to document the posture you can demonstrate and a Target Profile to describe the outcomes you want. Record why each material gap matters to that service.
Write a risk decision someone can act on
Use a cause, event, and consequence statement. Example: an externally reachable gateway runs an affected release, which could allow unauthorized access and interrupt remote work. Record the exposure, impact, existing safeguards, proposed treatment, accountable owner, and review date. Use a named decision-maker for acceptance and record the remaining risk.
Design the evidence before the test
For each control, write the expected behavior, what population the test covers, and the pass criteria. Example: the tester compares the inventory of internet-facing gateways with device version evidence and records exceptions. Save the source, timestamp, scope, result, and follow-up ticket. Keep sensitive evidence in an access-controlled repository.
Track exceptions as temporary decisions
Give each exception a rationale, compensating measures, an owner, an expiry date, and an agreed closure test. Review overdue exceptions with the risk owner. If treatment slips, record a fresh decision with the new evidence and timeline.
Review third-party dependencies and measure progress
Ask which services would fail if a supplier were unavailable and what evidence supports its recovery commitments. In your review meeting, bring a small set of decision-oriented measures: overdue high-risk actions, expired exceptions, and controls with missing or failed evidence. Record the decision requested and who owns the next step.