Chapter 2.2 · The GRC Role & Mandate¶
Two Lessons. The first establishes the cyber-GRC role, the written mandate that gives it authority, and the three-lines model that locates it inside the organisation. The second uses that same model to solve a problem that has no clean answer: where your oversight ends and other people's operational governance begins.
Objectives¶
- Explain why a CISO's authority must be granted in writing, and name the four parts of a workable mandate.
- Place the cyber-GRC function in the three-lines model (operational owners, oversight, audit).
- Draw the boundary between cyber-GRC and operational governance for real systems, and explain the cost of leaving it undefined.
Lessons¶
| Lesson | Title | Time |
|---|---|---|
| 2.2.A | The GRC Role, Mandate & Three Lines of Defence | ~50 min |
| 2.2.B | Where cyber-GRC ends and operational governance begins | ~45 min |
The Chapter quiz is at the end of Lesson 2.2.B.