Architecting for governance, risk and compliance (GRC)
Domain 1 tests how security architecture is governed: who decides, who owns risk, and how obligations become architecture requirements. Expect scenario questions on architecture review boards, exception handling, risk appetite, and control mapping across frameworks.
From policy to architecture
Governance assigns decision rights through a policy hierarchy: policy (mandatory intent), standard (measurable requirement), procedure (steps), guideline (advice). The architect translates business objectives and risk appetite into architecture principles, then controls. Risk appetite is the risk the organization is willing to pursue; risk tolerance is acceptable variation around it. Treatment options are avoid, mitigate, transfer, and accept, and acceptance belongs to the business risk owner, not the architect.
Compliance without duplication
Map each obligation to controls once, then reuse the mapping across frameworks (ISO/IEC 27001:2022 Annex A, NIST SP 800-53, PCI DSS v4.0). Use common controls and inheritance so a shared platform's controls are claimed once and inherited by hosted systems. The Architecture Review Board gates designs and records exceptions with compensating controls, an owner, and an expiry date.
Worked example
A unit requests a SaaS CRM holding EU customer data in a non-approved US region. The architect does not simply refuse. First, identify obligations: GDPR cross-border transfer rules, contractual residency clauses, internal data classification. Second, assess risk against the register. Third, present options: reject; accept with SCCs plus a transfer impact assessment, customer-managed encryption keys, and region-limited support access; or move to an approved region. The risk owner signs the residual risk and the exception expires in 12 months. Reasoning: the architect supplies evidence and options; accountability stays with the business.
Traps
Zero-risk thinking; the architect accepting risk for the business; exceptions with no expiry or compensating control; claiming compliance from a certificate; ignoring the scope of inherited controls.