…. or let’s call it GRC because it is a bit of a mouthful.  Two questions arise, firstly what does it mean, and secondly, does it really apply to SMEs?

To answer the first question GRC is a program that comprises those elements which, governed by the cyber-security strategy, provide cyber-security risk assessment, generate appropriate cyber-risk management policies and controls, and enable measurement of compliance with those policies and controls.  Let’s not forget those controls required by regulatory compliance which are required by legal and regulatory bodies. 

• Governance is the process which dictates policy in line with the cyber-security strategy. Governance ensures that the organisation’s cyber-security policies are generated, adopted and amended within an organisation.  Governance may be derived from both internal requirements (e.g. audit, board direction, information security) and external sources (e.g. statutory and regulatory requirements).
• Risk management is the process by which risks are evaluated in light of business requirements – and the organisation’s risk tolerance or appetite.  Risk management and mitigation policies and controls are then designed to achieve an acceptable level of risk to the organisation’s finances, data, reputation etc. The policies and intensity and number of the controls must be balanced against their cost and budgetary considerations, as well as the acceptable level of residual risk remaining once all controls have been implemented.  Risk management is also the means by which new risks from emerging threats and new business opportunities are assessed and reduced to an acceptable level.
• Compliance is the process by which adherence to risk management policies and controls are measured and gaps are identified.   This function is performed by various individuals and teams, including internal audit, risk assessment teams, external regulatory agencies and third-party organizations.

OK, so far so good, but isn’t this all a little over the top for SMEs.  Well yes and no.  Firstly, every business must comply with the statutory regulations laid down by government and the requirements for governance laid down by various industry standards.  PCI is a good example of the latter.  If you don’t comply to PCI DSS standards, you simply won’t be allowed to take credit card payments.   Maybe not important to all businesses, but it is to many.

Secondly, it is a matter of scale.  Everyone in business does some form of risk assessment during the working day – is it safe to take this person on?  Is this a good bit of business to acquire or is it too risky?  Do we need to diversify?  Etc.  Even if your risk assessments aren’t formal and you are doing them on the fly, they are still relevant to your business.  Cyber Security is no different.  Your cyber assets, and in this case, we often mean your data, need to be risk assessed, ie assessing the risk to the business if it all goes pear shaped, and then the right controls applied.  This falls under GRC.

So, what kills GRC in business?  It’s often a lack of communication and understanding.  The lack of understanding comes from not having the relevant expertise to talk to, and I’m not referring to IT techies.  They are great at keeping your systems working, be they an in-house resource or a managed service IT company under contract. But they are not cyber security professionals.  The latter is a skill set recognised in the industry with its own qualifications and career path.

The lack of communication comes in when you have the relevant expertise to hand, usually outsourced, but the board is simply not listening to what they are being told.  So why is that?  Well, a big mistake made by some cyber security people is being too technical and speaking in jargon.  It doesn’t work and turns people off.  When putting across an argument it must be in plain English and be business focused.  Management has to see some form of ROI, even it that ROI difficult to measure, based as it probably will be on proving a negative, ie the controls are working because we haven’t been hacked, as opposed to, we haven’t been hacked so we don’t need to budget for this.  Another example is talking about phishing, ransomware, hacking etc, when the business wants to hear about insider fraud and intellectual property theft.

My regular readers will be aware of my adherence to the KISS principle – Keep It Simple Stupid.  So overly complex GRC tools and solutions won’t work with SMEs regardless of where they sit on the totem pole, either at the lower end of Small up to the higher end of Medium.  All GRC principles must be scaled accordingly, and any practitioner used to evaluate your GRC issues must have a firm grasp of the business and apply GRC principles to support that business in a way that the management can immediately see its value.  Not easy but very much doable.

When working for HP I had 2 teams, one was techie and the other, focused on GRC, was not so techie and I kept that separation as it was very important.

I am always happy to have a conversation around this subject.