Governance, Risk, and Compliance Fundamentals
Governance, Risk, and Compliance (GRC) Fundamentals tests whether you can connect security activity to business accountability. GCT-2A-324 questions in this domain focus on risk terminology, control selection, policy hierarchy, and the correct use of frameworks such as ISO/IEC 27001, NIST CSF 2.0, and SOC 2. A certificate or completed checklist is evidence of a process, not proof that risk is acceptable.
Core rules and concepts
- Governance sets direction and accountability; management executes. Risk appetite is the broad amount of risk the organization is willing to pursue; risk tolerance is the acceptable variation around a specific objective.
- Risk is commonly scored as likelihood × impact. Inherent risk exists before controls; residual risk remains after controls. Treatment options are avoid, reduce, transfer, and accept. Acceptance must be made by the accountable business owner with an expiry and rationale.
- Policy states mandatory intent; a standard gives specific, measurable requirements; a procedure gives step-by-step instructions; a guideline is advice.
- Controls can be preventive, detective, or corrective, and administrative, technical, or physical. The three-lines model separates operational management, independent risk/compliance oversight, and internal audit.
- Compliance mapping shows how a control satisfies multiple requirements, but duplicate evidence does not automatically mean effective control operation.
Worked example
A billing server exposed to the internet is missing a critical patch. Likelihood is rated 4/5 and impact 5/5, giving inherent risk 20. A WAF and network segmentation reduce likelihood to 3 and impact to 4, so residual risk is 12 - above the appetite of 8. The team applies an emergency patch within 72 hours, enables virtual patching, and records a 14-day CISO-approved exception with daily checks. After patching, residual risk is rescored at 6. The reasoning is not the arithmetic alone: scales must be defined, and acceptance belongs to the business owner, not the administrator.
Traps that cost marks
- Treating “compliant” as “secure”; a passed audit samples controls at a point in time.
- Confusing risk appetite with tolerance, or residual risk with inherent risk.
- Choosing “transfer” when insurance leaves reputational and regulatory risk with the organization.
- Accepting an exception with no owner, expiry, or compensating control.