26 practical guides
GRC
Assurance Center.
26 / 26 guides
Knowledge library
Built for decisions,
not decoration.
26 operational guides
GRC Operating Model
Define decision rights, forums, accountability, information flows, and assurance across governance, risk, and compliance.
Cyber Risk Methodology
Establish consistent identification, analysis, evaluation, treatment, acceptance, and monitoring of cyber risk.
Asset & Data Classification
Classify information and supporting assets so protection, handling, retention, and recovery match consequence.
Cyber Risk Register
Maintain decision-ready risk scenarios with ownership, treatment, dependencies, evidence, and review cadence.
Control Design & Effectiveness
Define control objectives, owners, frequency, evidence, dependencies, and tests that demonstrate intended outcomes.
Policy Lifecycle & Exceptions
Govern policies from approval through communication, implementation, exception, review, and retirement.
Third-Party Risk Management
Assess and monitor security, privacy, resilience, and concentration risk across the supplier lifecycle.
Audit Readiness
Prepare accurate scope, narratives, populations, evidence, owners, and issue responses for efficient assurance.
ISO/IEC 27001 ISMS
Understand outcome-based ISMS readiness across context, leadership, planning, support, operation, evaluation, and improvement.
ISO Statement of Applicability & Risk Treatment
Build a traceable bridge from assessed risks to selected controls, inclusion decisions, implementation status, and evidence.
NIST Cybersecurity Framework 2.0
Use Govern, Identify, Protect, Detect, Respond, and Recover to describe and improve cybersecurity outcomes.
NIST Risk Management Framework
Apply Prepare, Categorize, Select, Implement, Assess, Authorize, and Monitor as a risk-based system lifecycle.
NIST SP 800-53 Controls
Navigate security and privacy control families, tailoring, baselines, parameters, assessment, and continuous monitoring.
NIST SP 800-30 Risk Assessment
Structure threat, vulnerability, likelihood, impact, uncertainty, and risk determination for decision-makers.
NIST SP 800-171 CUI
Understand protection outcomes for Controlled Unclassified Information in nonfederal systems and organizations.
CIS Controls v8.1
Prioritize practical cyber safeguards through Implementation Groups and measurable security outcomes.
CIS Benchmarks
Apply vendor-specific secure-configuration recommendations through tested, governed baselines and exceptions.
GDPR Applicability & Roles
Identify territorial scope, controller and processor roles, establishments, representatives, and accountable functions.
GDPR Principles & Lawful Bases
Operationalize fairness, transparency, purpose limitation, minimization, accuracy, storage limitation, security, and accountability.
GDPR RoPA & DPIA
Maintain processing records and assess high-risk processing before deployment or material change.
GDPR Data Subject Rights
Operate secure, timely workflows for access, correction, erasure, restriction, objection, and portability requests.
Privacy by Design & Retention
Embed minimization, purpose controls, lifecycle deletion, safe defaults, and privacy review into products and systems.
GDPR Personal Data Breach Response
Assess personal-data incidents, risk to individuals, notification duties, communication, and documentation.
HIPAA Applicability, Roles & ePHI
Map covered entities, business associates, subcontractors, ePHI, systems, and information flows.
HIPAA Security Rule Safeguards & Risk Analysis
Assess administrative, physical, and technical safeguards protecting ePHI confidentiality, integrity, and availability.
HIPAA Privacy, Breach & Business Associates
Coordinate minimum-necessary practices, business-associate oversight, breach assessment, notification, and documentation.