Cybersecurity Specialization: Governance, Risk, and Compliance

Why Does GRC Matter?

• Terms and definitions
• Assets, value
• Increasing importance of Governance, Risk, and Compliance

Industry Compliance

• Essence of compliance
• Industry Standards: Payment Card Industry (PCI)
• Industry Standards: Sarbanes-Oxley (SOX) Act
• Industry Standards: Financial Industry Regulatory Authority (FINRA)
• Industry Standards: General Data Protection Regulation (GDPR)
• Compliance and company policy

Privacy Compliance

• Impact of privacy
• Personally identifiable information (PII), protected health information (PHI)
• Data architecture
• Data handling
• Encryption
• Health Insurance Portability and Accountability Act (HIPAA)
• Health Information Technology for Economic and Clinical Health (HITECH) Act
• Gramm-Leach-Bliley Act (GLBA)
• Privacy best practices

Risk Assessment

• CIA triad
• Threat modeling
• Risk assessment
• Quantitative vs. qualitative risk assessment
• Risk assessment models
• Risk likelihood and impact
• Risk tolerance
• Risk appetite
• Business impact analysis (BIA)
• Risk mitigation strategies

Risk Management

• Risk management strategies: Mitigation, avoidance, transference, acceptance
• Risk Management Framework (RMF)
• RMF vs. CAP
• Risk maturity level
• Residual risk
• Continuous monitoring and incident response
• Patch management and the Common Vulnerability Scoring System (CVSS)

Corporate Culture

• Enterprise-wide attitudes to security and risk
• FUD: Fear, uncertainty, and doubt
• Governance failures in the real world
• Buy-in
• NICE, best practices, role-based training
• Aligning risk management with business goals
• Authorized use policies
• Tools: Training, rewards and consequences, hiring practices
• Ongoing monitoring and tracking

Governance and Policy

• Business continuity plan (BCP)
• Disaster recovery plan (DRP)
• Business impact analysis (BIA)
• Single point of failure
• Redundancy
• BCP dependency chain
• Rapid information sharing
• RACI chart
• Discussion: Fast vs. good vs. cheap

Course Look Around

• eGRC: Archer and OpenPages
• Real-time access to information
• Reporting
• Relevance
• Interoperability
• Savings through reduced complexity