GRC / Compliance
Overview
GRC ensures that internal practices are aligned with external standards and regulations.
It coordinates audits, maintains residual-risk documentation, manages exceptions and provides the documentary evidence required by NIS2, DORA and GDPR.
Key Responsibilities
- Ensure traceability to standards (SSDF, ISO) and regulations (NIS2, DORA, GDPR, AI Act)
- Monitor exceptions and ensure residual-risk documentation
- Coordinate internal and external audits
- Link technical requirements to legal obligations
Organisational Context
GRC is the guarantor of the documentary evidence required by NIS2 (audit, reporting) and DORA (operational resilience and third-party management). Without GRC, there is no demonstration of compliance.
Regulatory Framework
Provides the documentary evidence required by:
- NIS2: Audits, reporting, traceability
- DORA: Resilience, third-party governance, testing
- GDPR: Demonstration of compliance (accountability)
Activities by Chapter
Ch. 01 - Application Classification
Record residual risk after applying controls, record acceptances with an explicit TTL, and consolidate monthly/quarterly KPIs on classification and exceptions.
User Stories:
- US-04: Residual risk record - Substantiate acceptance decisions
- US-08: Risk Acceptance with TTL - Avoid permanent exceptions
- Classification governance KPIs - Demonstrate maturity
Ch. 02 - Security Requirements
Publish the policy for applying requirements and provide training (with Executive Management / CISO).
User Stories:
- US-07: Policy for applying requirements - Clear procedures (with Executive Management / CISO)
Ch. 07 - Secure CI/CD
Trace commit → pipeline → release to support audits. Ensure that exceptions are recorded, approved and temporary.
User Stories:
- US-09: End-to-end traceability - Support audits
- US-10: Exception management - Avoid technical debt
Ch. 08 - IaC and Infrastructure
Map IaC file → resource → environment to validate impact and traceability. Ensure change windows and approvals by role. Record exceptions with a deadline and countermeasures.
User Stories:
- US-07: File → resource → environment traceability - Validate impact (with Auditors)
- US-13: Change window and approvals - Reduce operational risk (with Auditors)
- US-14: Formal exceptions in IaC - Avoid structural debt (with AppSec Engineer)
Ch. 12 - Monitoring and Operations
Measure incident MTTD and MTTR. Document compliance between controls and regulatory requirements (SSDF, NIS2, ISO 27001).
User Stories:
- US-11: Incident MTTD and MTTR - Evaluate effectiveness
- US-12: Regulatory compliance documentation - Demonstrate alignment (with Auditors)
Ch. 13 - Training and Onboarding
Measure upskilling KPIs, run incident simulations, ensure minimum training for third parties, and define and collect KPIs.
User Stories:
- US-03: Upskilling KPIs - Evaluate impact in audit
- US-04: Incident simulations - Validate processes (with Executive Management)
- US-11: Detailed upskilling KPIs - Report compliance (with Executive Management)
- US-12: Minimum training for third parties - NIS2/DORA (with Executive Management)
Ch. 14 - Governance and Contracting
Validate suppliers continuously, run periodic compliance validations, and formally validate employee onboarding.
User Stories:
- US-01: Continuous supplier validation - Contractual compliance
- US-07: Periodic compliance validations - Detect deviations (with AppSec Engineer)
Cross-cutting - All Chapters
Link technical requirements to legal obligations (NIS2, DORA, GDPR, AI Act). Coordinate audits and maintain documentary traceability.
Chapter References
For full context and framing: