The GRC Role, Mandate & Three Lines of Defence¶
The job with no authority¶
In your first month you issue a sensible instruction: the French maintenance contractor's remote access must be logged and reviewed. Nothing happens. The plant manager in France is polite but unmoved. You are "head office", the contractor is "his", and he has a line to keep running. You have a title, an email signature, and no actual power. You can advise, but you cannot require.
This is the most common reason a first CISO achieves nothing in their first year: they were hired into responsibility without authority. Fixing that, and understanding exactly what kind of role the CISO holds, is the work of this Lesson.
What the cyber-GRC role actually is¶
It helps to be precise about the job, building on the distinction flagged in Lesson 1.2. The cyber-GRC function is an oversight function: it sets direction and policy, it monitors and challenges, and it reports. It does not, as a rule, operate the systems it governs. The CISO is the leader accountable for security, and in a firm Scaldimet's size the same person often wears two hats: they lead the GRC oversight and may also run operational teams such as monitoring or identity and access. That is normal and allowed; it does not make them any less the second-line overseer when they put that hat on. What must stay clear is which line a given piece of work sits on, because oversight and operations are different jobs even when one person holds both. Recall the steering-versus-rowing image from Lesson 1.2: the GRC work steers, whoever also happens to be rowing.
Authority is granted¶
A mandate is the written grant of the role's authority. It should be explicit because authority that is not documented can be difficult to apply consistently. In most companies, the mandate is granted by the executive committee, although the exact arrangement depends on the organisation. The mandate should state what the CISO can require, which decisions are within the role's authority, and how the role reports to senior management. Visible board support can strengthen that authority, particularly where the role must influence operational areas that have not previously reported to a security function.
A workable mandate states four things. Miss one and the authority leaks:
| Part | What it settles | Scaldimet |
|---|---|---|
| Scope | What your authority covers | All information and systems, both sites, IT and OT, and third-party access. Not just "head-office IT". |
| Authority | What you may decide and require | Set policies and standards; require remediation in agreed timeframes; require that an unacceptable risk be treated or formally accepted before an activity continues. |
| Reporting line | To whom, how often | To an executive or the board, on a regular cadence, not only after an incident. |
| Escalation | What happens when someone refuses | A path to a named executive who must compel action or record formal acceptance of the risk. |
One subtlety in the reporting line: independence
I often get asked whether a CISO should report to the CIO. There is no single correct answer. In my view, the most important point is how the governing body structures the function.
There are good reasons for a CISO to sit in the CIO's organisation. It makes discussion with the first line easier, with fewer organisational barriers, and the CISO is usually part of the IT leadership team, where they can directly influence a major part of cybersecurity. In practice, that proximity can make security decisions faster and more effective.
But it also creates a tension. The second-line CISO is there to oversee and challenge the first line, while the CIO owns many of the systems and decisions being overseen. This is why the structure needs a second, unfiltered route to the ExCo or governing body. The CISO must be able to raise significant risks, disagreements and incidents without the first line being able to filter or block the message.
Independence is therefore less about where the CISO sits on the chart than whether the governance structure gives them a path their findings cannot be blocked on.
The trap is scope. A mandate scoped to "IT" excludes the very systems that matter most at Scaldimet: the OT at both sites, especially Site Beta's production-control systems. Scope must say, in plain words, that it reaches the whole organisation.
The three-lines model: where the role sits¶
A mandate gives you authority. The three-lines model (originally the "three lines of defence", and the standard way organisations divide responsibility for managing risk) tells you where your authority sits relative to everyone else's. It is worth learning properly, because the next Lesson uses it to solve a genuinely hard problem.
| Line | Who | Role in managing risk |
|---|---|---|
| First line | Operational management: the people who own and run the systems (IT operations, OT operators, system owners) | They own and manage the risk day-to-day: they run the controls and make operational decisions, and they live with the consequences. |
| Second line | Risk, compliance and security oversight: the cyber-GRC function (and the CISO in their oversight capacity) | It sets policy and standards, monitors, advises and challenges the first line, and reports. It does not run the systems (a CISO who also runs an operational team does so wearing a different, first-line hat). |
| Third line | Internal audit | It provides independent assurance that the first and second lines are actually working. |
The cyber-GRC oversight role lives in the second line, and keeping it there resolves much of the confusion about what the function should do. You define what good looks like and check that it is happening; the first-line owners decide how to achieve it and do the work; audit independently confirms the whole thing functions. The subtlety for a CISO who also runs first-line teams (monitoring, identity and access) is that they then sit on two lines at once. That is workable and common, but the second-line oversight must not quietly become a review of the CISO's own first-line work, or the function ends up reviewing its own work. The fix is to keep the oversight judgement, and ideally the people who exercise it, separate from the operations being judged.
Scaldimet across the three lines
- First line: the Alpha IT manager (cloud ERP, MES, IIoT), the Beta operations director (SCADA and production control), and whoever owns identity and access. They run the systems and own the risk.
- Second line: you, wearing your GRC oversight hat. You set the policies and standards these owners must meet, monitor whether they do, challenge them when they do not, and report upward (if you also run an operational team, that part of your job is first-line).
- Third line: internal or external audit, giving the board independent assurance. Scaldimet has none yet, which is itself a finding.
Scaldimet is small, so people will sometimes wear more than one hat. That is allowed, but it must be deliberate and written down, and the independence of the third line must be protected. The next Lesson is about drawing these lines where they are genuinely unclear.
Application: locate the role and draft the scope¶
Two short exercises by hand. First, take five Scaldimet activities and place each in a line: (a) the Beta operations team patches a control system; (b) you write the standard that says how remote access must be controlled; (c) an external auditor checks whether the standard is being followed; (d) the Alpha IT manager decides how to segment the IIoT network; (e) you report the top risks to the ExCo (and the board).
Second, write the scope clause of Scaldimet's mandate in one or two sentences, deliberately phrased so it cannot be read as "IT only".
Model answer (open after you've drafted yours)
Placing the five activities. a and d are first line (operate and decide); b and e are second line (set standards, report); c is third line (assurance).
The scope clause. A version that cannot be read as "IT only": this mandate covers the security of all Scaldimet information and information systems at both sites, including operational technology and the access of third parties to it. Yours passes if it names both sites, OT explicitly, and third-party access, the three things a narrow "head-office IT" reading would drop.
Key takeaway
The cyber-GRC oversight role is a second-line function: it sets policy, monitors, challenges and reports, but does not operate the systems. A CISO may also lead first-line teams, in which case they sit on two lines and must keep the oversight separate from the operations it judges. Its authority must be granted in writing through a mandate stating scope, authority, reporting line and escalation, with scope deliberately reaching OT and both sites. The three-lines model locates everyone: first line owns and runs the risk, second line (you) oversees, third line (audit) assures. Knowing you sit in the second line settles most questions about what a CISO should and should not personally do, and sets up the boundary problem in the next Lesson.
Next: Lesson 2.2.B · Where cyber-GRC ends and operational governance begins →