GRC Fundamentals — Governance, Risk & Compliance Explained

33

SCF Domains

1,400+

Controls

200+

Laws, Regs & Frameworks

FREE

Creative Commons

Step 1

Compliance

Compliance is the logical starting point — it is a fact-finding exercise to identify what statutory, regulatory, and contractual obligations apply to your organization. This defines the non-negotiable baseline: Minimum Compliance Requirements (MCR).

Step 2

Governance

Once MCR and Discretionary Security Requirements (DSR) are defined, Governance operationalizes them through policies, standards, and SOPs. Governance assigns ownership via RASCI and ensures controls are built into administrative, technical, and physical requirements.

Step 3

Risk Management

Risk Management is ongoing throughout the GRC lifecycle — weighing controls, maintaining the risk register, performing assessments, and translating compliance and governance activities into an organization’s current risk posture. It defines acceptable and unacceptable risk thresholds.

Function #1

Compliance

The fact-finding function. Identifies every applicable statutory, regulatory, and contractual obligation the organization must satisfy. • Annual review of applicable laws & regulations • Maintain a register of compliance requirements • Educate executive leadership on cost of non-compliance • Establish Internal Audit (IA) function • Perform pre-production control testing • Contribute findings to centralized risk register • Review policies & standards for compliance alignment

Function #2

Governance

The operationalization function. Develops policies and standards, assigns control ownership, and drives due diligence documentation. • Develop policies and standards for MCR + DSR • Assign ownership via RASCI charts • Develop Standardized Operating Procedures (SOPs) • Ensure policies reflect actual organizational practices • Coordinate with control owners and operators • Maintain evidence of due diligence • Drive control weighting with Risk Management

Function #3

Risk Management

The continuous assessment function. Maintains the risk register, weights controls, performs assessments, and enforces risk tolerance. • Assign risk weight to each cybersecurity control • Maintain centralized risk register • Perform quantitative & qualitative risk assessments • Define risk tolerance thresholds • Distinguish compliant vs. secure (MCR vs. MCR+DSR) • Translate assessment results to risk posture • Inform investment prioritization decisions

MCR

Minimum Compliance Requirements

The absolute minimum requirements that must be addressed to comply with applicable laws, regulations, and contracts. MCRs are primarily externally-influenced. • Driven by industry, government, and regulatory bodies • Non-negotiable — must be implemented • Establishes the foundational compliance floor • Does NOT imply adequacy for security • Subject to external audit and enforcement • Defines minimum acceptable practices

DSR

Discretionary Security Requirements

Above and beyond MCR — controls that the organization self-identifies based on risk appetite. DSRs are primarily internally-influenced. • Driven by internal risk assessments and audits • Reflects the organization’s risk tolerance • Where efficiency, automation, and security are enhanced • Addresses voluntary industry best practices • Distinguishes truly secure from merely compliant • Competitive differentiator in risk management

Phase 1

PLAN

Define policies, standards and controls. Establish context by identifying applicable compliance requirements, internal directives and risk profile. Directly influences tools and services the organization purchases.

Phase 2

DO

Implement controls — the “security glue” that makes processes, applications, systems and services secure. Develop procedures (control activities) that operationalize each control. Assign stakeholder accountability.

Phase 3

CHECK

Maintain situational awareness through metrics, analytics, audits and assessments. Monitor control effectiveness and tie results to a longer-term trend analysis that informs leadership decisions.

Phase 4

ACT

Manage risk by addressing real deficiencies and possible threats. Evolve processes to adapt to the changing compliance landscape, technology changes and resource constraints. Feed findings back into planning.

Common Controls Framework™ (CCF™)

The SCF holds exclusive trademark rights to the Common Controls Framework™ designation. Domains common-controls-framework.com and commoncontrolsframework.com both resolve to the SCF.

Living Control Set (LCS)

As a Living Control Set, the SCF is continuously updated by volunteer industry-leading cybersecurity and GRC experts — never stale, never static. Always current with the latest regulatory and threat landscape.

NIST IR 8477 STRM Transparency

The SCF uses Set Theory Relationship Mapping (STRM) per NIST IR 8477 to validate all framework mappings. This provides unprecedented transparency and trust in how the SCF relates to other standards.

GRC Platform Integration

Used by leading GRC platforms worldwide. Importable as .csv or NIST OSCAL-compliant JSON — enabling seamless integration into any GRC tooling ecosystem.

200+ Framework Mappings

A single SCF control implementation satisfies requirements across 200+ laws, regulations, and frameworks simultaneously — the ultimate control economy for compliance-driven organizations.

Free. Always. Creative Commons.

Volunteer-driven by industry-leading experts and released under Creative Commons licensing. No cost. No registration. No vendor lock-in. Pure community value.