THREAT‑WATCH
Glossary
GRC (Governance, Risk & Compliance)
The combined discipline of setting security policy (governance), managing exposure (risk), and meeting legal/regulatory obligations (compliance).
GRC treats governance, risk management, and compliance as one connected program rather than separate silos, since a policy decision affects risk exposure, which affects what compliance frameworks require. Organizations use GRC platforms to track controls, evidence, and audit findings across multiple frameworks (NIS2, ISO 27001, GDPR) at once instead of managing each in isolation.