GRC and Compliance, Interview Questions.

Governance (direction, roles, policy), Risk management (identify, assess, treat) and Compliance (meeting laws, standards and contracts). Together they connect security work to business objectives and obligations.

Confidentiality (only authorised access), Integrity (data stays accurate and unaltered) and Availability (systems are usable when needed). Risk assessments consider impact on each.

A policy states management intent (mandatory, high level). A standard sets specific requirements. A procedure gives step-by-step instructions. A guideline is advice. Keep them layered and owned.

Mitigate (add controls), transfer (insurance, contracts), avoid (stop the activity) or accept (formally, with owner sign-off). Residual risk remains after treatment.

An audit independently checks conformance against a defined standard and produces formal findings. An assessment evaluates posture or risk more broadly and may be advisory.

ISO/IEC 27001 certifies an information security management system (the 2022 edition has 93 Annex A controls). SOC 2 is an attestation report against Trust Services Criteria (security, availability, processing integrity, confidentiality, privacy). Type I tests design at a point in time, Type II tests operating effectiveness over a period.

Define scope and criteria, identify assets, threats and vulnerabilities, estimate likelihood and impact (qualitative or quantitative), calculate and rank risk, choose treatments, record in a risk register with owners and dates, and review regularly.

Qualitative uses ratings (low, medium, high) and is quick but subjective. Quantitative uses numbers: single loss expectancy times annual rate of occurrence gives annualised loss expectancy, or approaches like FAIR that model loss frequency and magnitude. Quantitative supports cost-benefit decisions but needs good data.

A voluntary framework organising outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Govern was added in version 2.0. Organisations use profiles and tiers to assess current and target state.

Frameworks (NIST CSF, ISO 27001, CIS Controls) are guidance or certifiable standards adopted voluntarily. Regulations (GDPR, HIPAA, PCI DSS rules via contracts, India DPDP Act, RBI directions) are legally or contractually binding.

Assessing and monitoring vendors that touch your data or systems: due diligence questionnaires, evidence review (SOC 2, ISO), contractual security and breach notice terms, access limitation, continuous monitoring and exit planning. Tier vendors by criticality.

Understand scope and criteria, map controls to evidence, collect and test evidence beforehand, fix gaps, brief control owners, keep a single point of contact, and track findings to closure. Continuous control monitoring beats annual panic.

Labelling data by sensitivity (public, internal, confidential, restricted) so controls match risk: access, encryption, retention and sharing. It underpins DLP, privacy and cloud decisions.

Lawfulness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability. Subjects have rights of access, correction and erasure. Breaches must be notified (72 hours to the authority under GDPR).

KRIs signal rising risk (unpatched critical systems, privileged accounts without MFA). KPIs measure performance against goals (percentage of staff trained). Both feed dashboards and decisions.

Use business language: what could happen, how likely, financial and operational impact, how it compares with appetite, options with cost, and the decision needed. Use a few meaningful metrics and trends, avoid jargon, and tie to strategic objectives.

Appetite is the amount of risk the organisation is willing to pursue, set by leadership. Tolerance sets acceptable variation around objectives. They guide which risks need treatment versus acceptance and when to escalate.

Document the gap, assess impact, apply compensating controls, set a remediation plan with owner and date, record time-bound risk acceptance by an authorised executive, and report to the risk committee until closed.

Create a unified control framework: map requirements from ISO 27001, SOC 2, PCI DSS and local laws to common controls, collect evidence once, and report against each standard. It cuts duplicate audit effort.

Defined triggers and roles, a legal and privacy review step, notification templates, deadlines per regulator (such as GDPR 72 hours and CERT-In reporting windows), customer contract obligations, evidence retention and a decision log.

Standards set a baseline at a point in time and can be satisfied on paper. Attackers do not care about audits. Use compliance as a minimum, drive real risk reduction through testing, detection and response, and measure outcomes, not just checklists.

Scope the system and criteria, run a gap assessment, prioritise missing controls and evidence, choose Type I as a first step if timing requires then move to Type II, automate evidence collection, assign owners and track weekly.

Classify the data, run a vendor risk review (security evidence, data location, subprocessors, breach terms), check integration and access design, set contract terms, and approve with conditions or propose alternatives.

Acknowledge the finding, perform the review immediately, remove inappropriate access, assign an owner and calendar, automate reminders and evidence, and show the corrective action to the auditor.