<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: governance-risk-compliance
description: >-
  Enterprise governance, risk, and compliance (GRC) management including
  security policy frameworks, enterprise risk assessment, risk register
  management, control framework mapping, board-level risk reporting,
  risk appetite statements, key risk indicators, third-party risk management,
  exception management, regulatory compliance tracking, security program
  maturity assessment, and audit readiness programs.
domain: cybersecurity
subdomain: governance-risk-compliance
tags:
  - grc
  - governance
  - risk-management
  - compliance
  - risk-assessment
  - control-mapping
  - board-reporting
  - tprm
  - maturity-assessment
  - audit-readiness
  - regulatory-compliance
  - policy-framework
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  nist-csf: ["GV.OC", "GV.RM", "GV.RR", "GV.PO", "GV.SC", "ID.RA", "ID.IM"]
  frameworks: ["NIST CSF 2.0", "ISO 31000", "ISO 27001:2022", "COSO ERM", "FAIR", "CMMI"]
---

# Governance, Risk & Compliance

## When to Use

Activate when the operator asks about GRC programs, security governance,
enterprise risk management, risk registers, control framework mapping,
board reporting, risk appetite, KRIs, third-party risk, exception management,
regulatory tracking, maturity assessments, or audit readiness.

Mode: `[MODE: ARCHITECT]` for GRC program design; `[MODE: BLUE]` for operational implementation.

## Quick Reference

| Domain | Scope | Key Frameworks | Review Cycle |
|--------|-------|----------------|--------------|
| Security Policy | Policy hierarchy and lifecycle | ISO 27001, NIST CSF, CIS | Annual review |
| Risk Assessment | Threat identification and analysis | NIST 800-30, FAIR, ISO 31000 | Annual + trigger |
| Risk Register | Risk tracking and treatment | ISO 31000, COSO ERM | Quarterly review |
| Control Mapping | Cross-framework control alignment | NIST CSF, ISO 27001, CIS, SOC 2 | Per framework update |
| Board Reporting | Executive risk communication | NACD guidance, ISO 31000 | Quarterly |
| Risk Appetite | Risk tolerance statements | ISO 31000, COSO ERM | Annual board approval |
| KRI Monitoring | Early warning risk indicators | COSO ERM, FAIR | Continuous |
| Third-Party Risk | Vendor and supply chain risk | SIG, CAIQ, NIST 800-161 | Per vendor tier |
| Exception Mgmt | Policy exception governance | Internal governance | Per request |
| Regulatory Tracking | Obligation monitoring | Regulation-specific | Continuous |
| Maturity Assessment | Program capability measurement | CMMI, NIST CSF tiers, C2M2 | Annual |
| Audit Readiness | Continuous audit preparedness | SOC 2, ISO 27001, PCI DSS | Continuous |

## Workflow

### 1. GRC Program Architecture

```
Enterprise GRC structure:
├── Governance Layer
│   ├── Security policies and standards
│   ├── Roles, responsibilities, and accountability
│   ├── Board and committee oversight
│   └── Risk appetite and tolerance framework
├── Risk Management Layer
│   ├── Enterprise risk assessment (annual)
│   ├── Risk register (living document)
│   ├── Key risk indicators (continuous)
│   ├── Third-party risk management
│   └── Exception and acceptance management
├── Compliance Layer
│   ├── Regulatory obligation tracking
│   ├── Control framework mapping
│   ├── Evidence collection and management
│   ├── Audit readiness programs
│   └── Maturity assessment and improvement
└── Reporting Layer
    ├── Board-level risk dashboards
    ├── Operational KRI dashboards
    ├── Compliance status reports
    └── Audit findings tracking
```

### 2. Risk Management Lifecycle

```
ISO 31000 risk management process:
├── Establish context
│   ├── Internal: org structure, objectives, culture
│   ├── External: regulatory, threat landscape, industry
│   └── Risk criteria: appetite, tolerance, limits
├── Risk assessment
│   ├── Identify: threats, vulnerabilities, impacts
│   ├── Analyze: likelihood × impact (qual or quant)
│   └── Evaluate: compare to risk criteria
├── Risk treatment
│   ├── Avoid, mitigate, transfer, accept, share
│   ├── Control implementation
│   └── Residual risk evaluation
├── Monitor and review
│   ├── KRI monitoring
│   ├── Control effectiveness testing
│   └── Trigger-based reassessment
└── Communicate and consult
    ├── Board and executive reporting
    ├── Risk owner engagement
    └── Stakeholder communication
```

### 3. Compliance Program Operations

```bash
# GRC platform integration points:
# - ServiceNow GRC / Archer / LogicGate
# - Vanta / Drata / Secureframe (SaaS compliance)
# - OneTrust (privacy and GRC)

# Automated evidence collection workflow:
# 1. Define control → evidence mapping
# 2. Configure automated collection schedules
# 3. Validate evidence quality and completeness
# 4. Store in evidence repository with retention
# 5. Link to audit requests when needed

# Maturity tracking:
# Assess → Score → Gap → Roadmap → Implement → Reassess
```

## Verification

- [ ] Security policy framework established with full hierarchy
- [ ] Enterprise risk assessment completed with methodology documented
- [ ] Risk register populated with owners and treatment plans
- [ ] Control framework mappings reduce duplicate compliance efforts
- [ ] Board receives quarterly risk reports in business language
- [ ] Risk appetite statements approved by board annually
- [ ] KRIs automated with threshold monitoring and alerting
- [ ] Third-party risk management covers all critical vendors
- [ ] Exception management process prevents shadow risk acceptance
- [ ] Regulatory obligations tracked with deadline management
- [ ] Maturity assessment shows year-over-year improvement
- [ ] Audit readiness maintained at >95% evidence availability

## References

- NIST CSF 2.0 — Govern function (GV)
- ISO 31000:2018 — Risk Management Guidelines
- ISO 27001:2022 — Information Security Management Systems
- COSO ERM Framework — Enterprise Risk Management
- FAIR — Factor Analysis of Information Risk
- NIST SP 800-30 — Guide for Conducting Risk Assessments
- NIST SP 800-39 — Managing Information Security Risk
- CMMI Institute — Capability Maturity Model Integration
