What is Governance, Risk, & Compliance (GRC)?

Governance, Risk, & Compliance (GRC) is a set of capabilities, processes, and standards designed to help businesses manage risk and compliance within their organization.

Governance – policies, procedures, and rules that ensure business activities and goals are in alignment

Risk – broad assessment and management of organizational risk; For example, legal, financial, and security risks.

Compliance – the adherence to all government laws and industry regulations relevant to an organization.

The term governance, risk, and compliance was originally coined by the Open Compliance and Ethics Group (OCEG), a non-profit think tank dedicated to developing ethical approaches to business. They describe governance, risk, and compliance as “the integrated collection of capabilities that enable an organization to reliably achieve objectives, address uncertainty and act with integrity.” OCEG also developed the GRC Capability Model (also known as the OCEG Red Book), which guides the planning, assessment, and improvement of GRC capabilities within an organization. The open-source standard integrates the disciplines of governance, risk, audit, compliance, ethics/culture, and IT into one unified approach.

As a broad term, governance, risk, and compliance encompasses both digital and physical security, though in this article we’ll focus on the application aspects of GRC as they relate to compliance and internal audits.

For example, when someone changes jobs (a mover) within an organization, they may get their new access but their legacy access isn’t removed, which increases risk in the environment. By using access certifications on a standardized basis, that access is reviewed and reapproved or removed. So a GRC solution that offers automated provisioning and access reviews keeps your access clean and removes anything that’s stale.

Another scenario involves utilizing emergency access requests, also referred to as firefighter or elevated access requests. Such requests are granted on an emergency basis and are rescinded when the emergency situation is resolved, reducing risk. Regular access certification and use of emergency access management processes ensure that no standing elevated access is allowed and that critical access is limited, which keeps the environment secure. Again, as your application governance risk and compliance process matures and you begin managing all of your users, you can review essential access more closely.

Another critical capability to help you “stay clean” is usage tracking. Usage tracking ensures access requests and recertifications get reviewed to determine if the access is being utilized and is truly necessary or if removal can reduce the overall risk exposure. Once these capabilities are achieved, you have established a controlled and repeatable set of processes for providing access reviews and elevated access. Now you must keep your system optimized on an ongoing basis.

The focus of the optimization phase is on continuous compliance monitoring through further cleanup of unused or excessive access. This stage can be accomplished with a solution that offers built-in controls, integrated risk simulations, and role entitlement / engineering management tools. These allow you to focus on continually improving your environment after establishing a documented, repeatable, and automated risk management process. A solution that can provide role mining views and access analytics reporting is ideal here. Additionally, the environment can be further optimized by a solution that provides license cleanup and realignment reviews.

Out-of-the-box compliance controls provide visibility for SOX, HIPAA, GDPR, and other regulatory requirements. Integrated risk simulations allow for review of possible role or user changes and the SoD risk impact of those changes, prior to submitting requests. Additionally, role entitlement / engineering management tools allow for deep-dive analysis to review existing entitlement design and determine if adjustments should be considered based on usage of various user groups. Each of these features supports the ongoing optimization, management, and governance of your application environments.

At this point, you’ve addressed existing detected risks – and implemented preventative risk detection, automated access provisioning, certifications, and emergency access requests. So you can now optimize the environment by managing and monitoring environmental controls on an ongoing basis, establishing a complete customer lifecycle end-to-end, and avoiding gaps that may result in audit and compliance concerns.

Virtually every enterprise has begun their cloud journey with business applications that are the cornerstones of their operations. Be it ERP, HR, Service Ticketing, or EMR, these applications and infrastructure resources represent most of today’s business applications and many have made their way to the cloud, while others are still on-premises The Hybrid IT environment has come to fruition, and along with it come some risks.

First and foremost, organizations must manage risks associated with Separation of Duties. Important business tasks need to involve more than one actor, and follow rulesets that ensure there is visibility into both potential and actual security risks. Innovative application GRC solutions provide visibility into SoD risks, and a way to ensure the right people have the right access to sensitive and privileged data, apps, and infrastructure at the right time.

Another important challenge organizations struggle with is that different application providers use different GRC security models, and they each speak their own language. SAP does it one way, Oracle does it another way, etc. Given the cloud ecosystem and sheer volume of applications that require different approaches to GRC, a broad solution that provides rulesets for detecting SoD violations is required. To understand this better, let’s compare the traditional coarse-grained approach with the more evolved fine-grained approach.

Many GRC implementations use a coarse-grained approach. They are only interacting at the highest levels of the application’s security model. On the other hand, Saviynt provides cross-application governance, risk, and compliance to leverage a fine-grained approach that looks for potential violations much deeper in the application security model, making it more likely to find potential problems before they become actual risks.