Pillar guide

GRC explained: governance, risk and compliance without the jargon

GRC is three old ideas joined together: who decides, what could go wrong, and are we following the rules. Done well it saves time and removes surprises. Done badly it becomes a second job for everyone. This guide explains what it is, when you need it and how to tell a platform that helps from one that only adds screens.

3 questionsgovernance, risk and compliance

1 controlshould answer many frameworks

30%of breaches now involve a third party (Verizon 2025)

263 daysto find and contain a breach in India (IBM 2025)

Executive summary

GRC brings governance, risk management and compliance onto one set of controls, owners and evidence, so the same fact is not written down three times.

It is a way of working before it is a tool. The three lines model says who owns what; software should make that visible.
The case for connecting is evidence, not dashboards. One control, mapped to several frameworks, collected once.
Suppliers are now half the risk story. Breaches involving a third party doubled to 30% in a year.
Not everyone needs a platform on day one. A single standard and a small team can start with a disciplined spreadsheet.

01What GRC means, in three questions

The three letters stand for three questions every organisation has to answer, whether or not it uses the word.

Exhibit 1GRC at a glanceThree questions, one body of evidence

	The question	What it looks like day to day
Governance	Who decides, and who is accountable?	A board that sets risk appetite. Policies with named owners. Clear lines for who approves exceptions.
Risk	What could go wrong, and how bad would it be?	A risk register you actually use. Scores for likelihood and impact. Treatments with owners and dates.
Compliance	Are we following the rules we signed up to?	Controls mapped to laws and standards, evidence collected, audits passed without a scramble.

Each is useful alone. They are discussed together because they share the same raw material: the same assets, controls and evidence. When they live in separate files, the same fact is recorded three times and quietly drifts apart.

Exhibit 2Who does what in GRC: the three lines modelAdapted from the Institute of Internal Auditors' Three Lines Model

Board and senior managementSet direction, risk appetite and accountability. Receive assurance.

First lineRun the businessProcess and control owners. They own and manage risk day to day and produce the evidence.

Second lineOversee and adviseRisk, compliance and information security. They set standards, monitor and challenge.

Third lineAssure independentlyInternal audit. Reports to the board on whether the first two lines work.

External assurance and regulatorsAuditors, certification bodies, supervisors.

How to read it. Most GRC problems are a blurring of these lines: control owners who think compliance is someone else's job, or compliance teams doing the first line's work for them. A platform should make each line's task and evidence visible.

02Why spreadsheets work, and then stop working

Spreadsheets are a perfectly good start. One person, one standard, one audit a year: a well-kept workbook will do. The trouble starts when the world gets bigger.

More frameworks. A customer asks for SOC 2. The regulator adds a circular. You add ISO 27001. The DPDPA arrives. Each has its own checklist and its own workbook.
More people. Control owners sit in IT, HR, legal and operations. Chasing them by email becomes a full-time job.
Evidence goes stale. A screenshot from March proves nothing in October, and nobody remembers where it lives.
The board asks a simple question. “Are we compliant?” takes a week to answer, and the answer is out of date when it arrives.

Exhibit 3One control, many asksIllustrative: how one piece of work answers several regimes

One controlAccess to customer data is reviewed every quarterOwner: IT. Evidence: signed review and ticket trail.

SOC 2 logical access criteria
ISO 27001 access control
DPDPA reasonable security safeguards
Your regulator RBI, SEBI or IRDAI expectations

How to read it. Done once and mapped four ways, the evidence is collected once. Done in four spreadsheets, someone chases the same screenshot four times a year.

That is the case for connecting the pieces: not more dashboards, but one place where a control, its owner, its evidence and the frameworks it serves are the same record.

03Risk: starting from the data, not the template

A risk register is only as good as its inputs. Generic lists produce generic risks. A better start is the evidence of how breaches really begin, then asking where you are exposed.

Exhibit 4Two things that doubled or jumped in a yearShare of breaches, Verizon Data Breach Investigations Report

15%Third-party involvement, 2024

30%Third-party involvement, 2025doubled

32%Ransomware present, 2024

44%Ransomware present, 2025+12 pts

How to read it. Almost one breach in three now involves a supplier or partner, up from one in seven. Your vendors' security is part of your security, and under the DPDPA it is part of your legal duty.

Source: Verizon 2025 Data Breach Investigations Report, executive summary: 22,052 incidents and 12,195 confirmed breaches from 139 countries. The human element was involved in roughly 60% of breaches.

Exhibit 5How breaches in India beginShare of breaches by initial attack vector, 2025

Phishing18%

Third-party or supply-chain compromise17%

Exploited vulnerability13%

How to read it. The first two are about people and suppliers. Neither is fixed by buying another firewall. Together with a third of breaches, they point the same way the DPDPA duties do: control your vendors, train your people, patch your systems.

Source: IBM Cost of a Data Breach Report 2025, India. The three most common vectors; other causes make up the rest.

Exhibit 6A risk heat map, in practiceIllustrative: likelihood against impact, with six example risks

Impact ↑

BADFCE

Likelihood →

A Phishing leads to credential theft
B Key supplier suffers a breach
C Regulatory penalty for a late breach report
D Unpatched internet-facing system
E Lost laptop with personal data
F Expired vendor certificate unnoticed

How to read it. Anything in the top-right needs an owner, a date and a decision at board level. The value is not the picture; it is that every dot has a treatment plan attached and moves when the work gets done. The risks shown are examples, not a finding about any organisation.

Note what the first two exhibits imply for your register: supplier compromise and phishing should be on it, with named owners, because they are the most common routes in. A register that lists “server failure” and omits them is describing a different decade.

04Where are you on the ladder?

Most organisations that come to us sit at stage one or two, and that is fine. The useful move is the next step, not the top one.

Exhibit 7Four stages of GRC maturityIllustrative, so you can place yourself honestly

1. Ad hocSpreadsheets and email. Knowledge sits with a few people. Audit season is a scramble.
2. DocumentedPolicies and a risk register exist. Evidence is still collected by hand.
3. ManagedControls have owners and due dates. One source of truth for audits.
4. ContinuousControls are checked as work happens. Leadership sees live risk, not last quarter's.

Moving from stage 2 to 3 is where a platform pays for itself: owners, due dates and a single source of truth. Stage 4 needs integrations with your real systems, so evidence is collected as work happens instead of at audit time.

05What a good GRC platform does

Exhibit 8How a connected GRC platform fits togetherIllustrative architecture

SourcesPoliciesSystems and cloudHR and accessVendorsTraining

One control libraryControlsOwners and due datesEvidenceRisks and treatments

FrameworksSOC 2ISO 27001DPDPASector rules

OutputsBoard reportAuditor workspaceGap listRenewals

Frameworks and controls. Load SOC 2, ISO 27001, DPDPA and sector rules once. Map each control to every framework it serves.
Risk register. Score risks, attach treatments, track owners and dates, and show leadership a live view.
Policies and attestations. Version them, route them for approval and record who has read them.
Evidence and audits. Collect evidence against controls and give auditors a workspace instead of an email thread.
Third-party risk. Assess vendors and track their certificates and renewals.
Reporting. Board-ready summaries without a week of formatting.

Just as important is what it should not do: demand a six-month implementation before you see value, or lock you into one framework.

06The Indian context

For Indian organisations GRC is rarely optional. One business may face four of the following at once, which is the “one control, many asks” problem in practice.

Exhibit 9Indian regimes that pull teams towards GRCWho they apply to and what they ask

Regime	Who it applies to	What it asks
DPDPA 2023 and Rules 2025	Anyone processing digital personal data in India	Notice, consent, security safeguards, breach reporting, rights. Main duties from 13 May 2027.
CERT-In directions (April 2022)	Service providers, intermediaries, data centres, companies	Report specified cyber incidents within 6 hours; keep logs for 180 days.
RBI IT governance directions	Banks and other regulated lenders	Board-level IT and cyber governance, risk and assurance.
SEBI CSCRF	Market intermediaries and regulated entities	A cyber security and resilience framework with incident reporting.
IRDAI cyber guidelines	Insurers	Information and cyber security governance.
SOC 2 and ISO 27001	Voluntary, but customers ask	An independent report or certificate on your controls.

Source: Check each regulator's current text; requirements change.

Exhibit 10Cyber security incidents tracked by CERT-InIncidents reported to and tracked by CERT-In, India

1.40 m2021

1.39 m2022

1.59 m2023+14.5%

2.04 m2024+28.2%

How to read it. After a flat 2022, incidents rose 14% in 2023 and 28% in 2024. Over two years that is 46.7% more incidents. Part of that is better reporting, which is itself a sign that the CERT-In reporting rules are working.

Source: Ministry of Electronics & IT reply in the Rajya Sabha, via PIB, 28 March 2025 (2022–2024); CERT-In Annual Report 2022 (2021).

The count of incidents tracked by CERT-In rose from 1.39 million in 2022 to 2.04 million in 2024. Whatever share of that is better reporting, the direction is clear: more things to notice, assess and report, with the same size of team. Our cyber security compliance guide goes through the regimes in detail.

07How to choose: ten questions for any vendor

Can I see my own framework, not a demo one, loaded in the first call?
How does one control map to several frameworks, and what happens when a standard changes?
Can I run it as SaaS and on-premise, and who controls the licence and my data?
Where is my data stored? Is that in India?
How is evidence collected: by hand, by upload, or by connecting to systems?
Can my auditor log in to a limited workspace?
What does week one look like, and when do I see my first real result?
Who do I call when something is wrong, and is it a named person?
What can I export if I leave?
What does the vendor not do well? A confident answer here is a good sign.

We turned these into a one-page weighted scorecard in the GRC Buyer's Guide.

Want to see this in a real product?

We will walk you through CyberMetric GRC using your frameworks, not a canned demo.

Book a walkthrough

?Frequently asked questions

What does GRC stand for?

Governance, risk and compliance: how an organisation decides who is accountable, understands what could go wrong, and shows it is following the rules it has taken on.

Is GRC only for large companies?

No. Any organisation facing more than one framework, such as SOC 2, ISO 27001, DPDPA or a sector regulator, benefits from managing them together. Small teams can start light, with a clear owner and a simple register.

What is the difference between GRC and compliance?

Compliance is one of the three parts of GRC: following specific laws and standards. GRC also covers governance (who is accountable) and risk (what could go wrong) and connects all three.

What is the difference between GRC and IRM?

Integrated risk management puts more weight on risk across the whole organisation. In practice a modern platform covers both.

Do I need a GRC tool for SOC 2?

Not strictly, but SOC 2 evidence is collected over a period, so a tool that assigns controls, tracks evidence and gives your auditor a workspace saves time. See our SOC 2 readiness programme.

How long does it take to implement a GRC platform?

It depends on how many frameworks and systems you connect. A sensible target is your first framework loaded, with owners assigned, within the first few weeks and not months.

§Sources

Figures are quoted from the sources above and were checked on 6 November 2026. Laws and rules change; confirm the current text before relying on any of it. This is general information, not legal advice. Illustrative exhibits are marked as such.

Keep reading