Why GRC matters · Scaldimet's "why now"¶
Two manufacturers, different outcomes¶
Picture two companies very like Scaldimet. Both make parts for the car industry. Both are hit, in the same month, by the same kind of attack: ransomware that locks up the systems running their production lines.
The first company has no one in charge of security decisions. When the line stops, nobody knows which systems matter most, whether backups exist, who is allowed to authorise paying the attackers, or whom the law requires them to tell. Days pass in confusion. Their biggest customer, whose own factory now sits idle waiting for parts, starts looking for a replacement supplier.
The second company is no more "technical" than the first. But someone there had already written down which systems were critical, what the company's tolerance for downtime was, who decides what in a crisis, and what the legal reporting duties were. When the attack came, the response was not improvised. The line was back within the agreed recovery time. The customer was kept informed, the regulator was notified on time, and the contract held.
The difference between those two companies is not better firewalls. It is Governance, Risk and Compliance: the management system that turns scattered security activity into decisions someone is accountable for.
What GRC actually is¶
"GRC" bundles three disciplines that are stronger together than apart. You will spend whole Modules on each; here is the one-line version of each, and what it does for an organisation.
| Discipline | The question it answers | What it produces |
|---|---|---|
| Governance | Who decides, who is accountable, and what are we trying to achieve? | Direction, authority, ownership, oversight |
| Risk | What could go wrong, how badly, and what will we do about it? | Informed, prioritised decisions |
| Compliance | What are we required to do (by law, by contract, by our own policy) and can we prove it? | A defensible, evidenced baseline |
Notice that none of these is "install security technology." GRC is not the work of defending systems; it is the work of directing that defence (deciding what matters, choosing what to do, proving you did it, and being able to answer for the result). A company can own every security product on the market and still be in the first manufacturer's position, because nobody decided what to protect, or who answers when it fails.
That is why GRC matters. It is the difference between activity and a programme. Security spending without governance is a pile of tools. Risk reduction without compliance can still leave you breaking the law. Compliance without risk thinking (as you will see in Module 4) can leave you legally clean and genuinely unsafe. The three only work as a set.
GRC is a management discipline first
This is the most important reframing in the whole course. As a CISO, your scarcest resources are usually attention, authority and budget. GRC is how you spend those wisely: by being clear about objectives (governance), choosing where to act (risk), and proving you have met your obligations (compliance).
Why Scaldimet, and why now¶
Organisations rarely build a GRC programme because it is a good idea in the abstract. They build one because something forces the question. For Scaldimet, three pressures have arrived at once.
1. A commercial trigger: the customer's requirement. Scaldimet's largest customer, a major car manufacturer, has made contract renewal conditional on two things: demonstrable alignment with the international information-security standard ISO 27001, and readiness for the European cybersecurity law NIS2. This customer represents a large share of Scaldimet's revenue. There is no version of this where Scaldimet ignores the request and keeps the contract. This is the believable "why now" (and it is realistic). Increasingly, large companies push security obligations down their supply chains, because their own resilience depends on their suppliers'.
2. A regulatory trigger: the law now reaches Scaldimet. NIS2 is not optional and not something Scaldimet can argue its way out of. Because of what Scaldimet makes and how large it is, the law clearly applies. (Module 3 works through exactly why, and what it requires.) For now, the headline: a European directive obliges Scaldimet to manage cybersecurity risk to a defined standard, to report serious incidents quickly, and (as Module 6 covers) to make its own board accountable for all of it.
3. An operational trigger: the company is exposed and knows it. Even without the customer or the law, Scaldimet has a real problem sitting in France: an acquired site with ageing factory systems, no separation between office and factory networks, and weak security habits. A single incident there could stop production and trigger penalties from the very customer now demanding improvement.
The drivers acting on Scaldimet
- Commercial: the OEM customer's ISO 27001 + NIS2 condition for contract renewal (large share of revenue at stake).
- Regulatory: NIS2 applies; obligations on risk management, incident reporting, and board accountability.
- Operational: Site Beta's ageing, unsegmented factory environment is a live exposure.
These three reinforce each other. The same improvements that satisfy the customer also move Scaldimet towards the law, and also reduce the operational risk. A good GRC programme serves all three at once (which is exactly why you build a programme, not three separate taskforces).
Application: name the drivers¶
Here is a short list of statements about Scaldimet. For each, decide which of the three drivers it represents (commercial, regulatory, or operational) and jot down your answer before reading the debrief. Some could be argued for more than one; the value is in the reasoning.
- "If we don't show ISO 27001 progress by the renewal date, we lose the contract."
- "The factory machines in France run software that no longer gets security updates."
- "We are legally required to report a serious incident to the authorities within a tight deadline."
- "Our office network and our production machines in France are on the same flat network."
- "The board can now be held personally accountable if cybersecurity measures aren't approved and overseen."
Debrief. 1 is commercial (a customer condition). 2 and 4 are operational (real technical exposure, independent of any outside demand). 3 and 5 are regulatory (legal obligations under NIS2, note that 5 lands on the board, not just on you; that is the whole reason Module 6 exists).
The skill being built here is small but important: a CISO who can name why a piece of work is being demanded can prioritise it, fund it, and explain it to the people holding the budget. "We should do this because it's good practice" loses to "we must do this or we lose the contract and breach the law." Same task; far stronger case.
Come back to your three things¶
Back in Lesson 0.1.A, before you had read any of this, you wrote down the three things you would want to understand first as Scaldimet's new CISO. Take them out now; this is the end of Module 0, and the moment to look at them again.
Look at what your instinct reached for. Most people, on that first Monday, reach for something concrete: the state of the French factory, the systems, the tools, the technology. Those instincts are not wrong, and you will deal with all of them. But notice what Module 0 has just reframed. What actually decides whether you succeed is not which systems are weak; it is whether anyone has decided what matters, who is accountable, what the customer and the law require, and how you will prove it. That is the shift from thinking like an engineer to thinking like a CISO: from scattered activity to a directed programme.
So compare, without scoring yourself. How many of your three were about technology, and how many were about direction, accountability, obligation or evidence (which are the raw material of governance, risk and compliance)? If most were technical, that is completely normal, and this course is largely the work of widening that instinct. If some already reached for accountability or the contract or the law, you have started to think in GRC terms sooner than most.
Keep the three. You will look at them one last time near the end of the course, when a whole programme sits behind you, and the change in how you read them will be sharper still.
Key takeaway
GRC matters because it turns security activity into a directed, prioritised, provable programme that someone is accountable for (the difference between the two manufacturers in the opening story). Scaldimet needs it now because three pressures have converged: a customer demanding it, a law requiring it, and a real exposure that could hurt all on its own. A single coherent programme can answer all three (which is why we treat GRC as one system, not three separate jobs).