GRC (Governance, Risk Management and Compliance) – the foundation for an NIS2-ready organization

GRC (Governance, Risk Management and Compliance) – the foundation for an NIS2-ready organization

With the entry into force of the NIS2 directive, organisations in all fields of activity face a double challenge: on the one hand, to ensure the continuity of their critical processes, and on the other hand, to demonstrate compliance with increasingly stringent cybersecurity requirements. From the experience of the Safetech Innovations team, we have learned that order is essential: when the business is protected and essential functions are guaranteed, compliance becomes a natural consequence. In this endeavor, the GRC (Governance, Risk Management and Compliance) framework is not just a control tool, but a central pillar that provides structure, visibility and resilience.

GRC principles also play a key role in achieving the requirements of the NIS2 Directive, as they involve defining a clear governance strategy, developing/implementing a risk management program based on their actual assessment, applying appropriate security policies and controls, and developing continuity and incident response plans. In addition, GRC includes staff training and support, along with centralized management of documentation and audit processes, facilitating compliance and strengthening cyber resilience.

GRC, brief history

GRC is an integrated framework that aligns organizational policies, structures and processes, threat identification and management, and compliance with legal and ethical standards. The concept has its roots in corporate governance in the first half of the twentieth century, was strengthened by the development of risk management practices in the 1970s and 1980s, and accelerated following the financial scandals of the 2000s (Enron, WorldCom), which led to the introduction of stricter regulations. Since the late 2000s, organizations have understood that the separate approach of these three components – Governance, Risk and Compliance – generates redundancies and slows down the decision-making process, which is why GRC has evolved into a unitary framework, essential today for transparency, resilience and compliance.

GRC framework – the basis for NIS2 compliance

In cybersecurity, GRC is a unifying framework that integrates governance, risk management, and compliance, providing organizations with a coherent and structured approach to protecting critical assets and services. In the context of NIS2, GRC principles take on particular relevance, guiding how organizations establish responsibilities, assess and manage cyber risks, and comply with applicable legal requirements and regulations, thus building a robust security strategy.

GRC principles, applicable in accordance with NIS2, work as follows:

1. Governance, according to ISO 37000, encompasses the set of activities through which an organization is directed, supervised and held accountable for the achievement of its defined purpose. This includes clearly defining the purpose, values and ethical principles, establishing a governance structure with well-defined roles, committees and responsibilities, and adopting framework policies such as the code of conduct or risk appetite. Governance also involves monitoring performance through regular reports and strategic indicators, a constant dialogue with stakeholders – from shareholders and regulators to communities – and periodically reviewing the governance framework, in order to adapt it to internal and external changes.

For NIS2 compliance, governance becomes essential as the Directive requires direct management accountability, the need to implement documented policies and processes, regular reporting of cybersecurity performance and the creation of an organisational culture – including through employee training – that supports compliance with legal requirements.

2. The risk/risk management component of GRC represents, according to ISO 31000, the set of coordinated activities through which an organization is directed and controlled in relation to risks. This process starts with establishing the internal and external context, and defining the risk criteria, followed by identifying the risks (threats and opportunities) in the processes and projects. Subsequently, risks are analyzed according to probability and impact, assessed to be prioritized, and treated through strategies such as avoiding, reducing, transferring (through insurance) or accepting them. Risk management also includes monitoring and reporting key risk indicators (KRIs), as well as continuously reviewing and improving the management framework, to ensure the resilience and adaptability of the organization.

Risk management also plays a central role in the provisions of NIS2. The Directive requires the implementation of technical and organisational measures for the detection, monitoring and response to security incidents and the management of software vulnerabilities (existing or likely to be induced by misconfigurations). In addition, organizations must ensure access to teams of specialists, internal or external, with certified skills, capable of providing 24/7 monitoring, periodic risk assessment and rapid response to incidents, complying with the technical and technological norms provided by the regulations.

3. Compliance is the set of activities through which an organization ensures and maintains compliance with legal requirements, applicable regulations, contractual obligations and internal policies. This includes, according to ISO 37301, identifying relevant legal and regulatory obligations, developing and updating compliance policies and procedures, and conducting regular audits and checks to ensure compliance. Compliance also involves the management of non-compliance reports and internal investigations, the monitoring and reporting of key compliance indicators (KCIs), and the implementation of corrective and preventive actions to prevent and remedy any deviation from the applicable rules.

In terms of compliance, NIS2 requires, on the one hand, the phased reporting to the National Directorate of Cyber Security (DNSC): early warning, notification of the incident, interim report and final report and compliance with the specific deadlines for each. At the same time, entities must periodically carry out external audits on the cybersecurity status (1 year after registration and thereafter, every 2 years), and submit the audit report to the DNSC. Find out more details about the deadlines and obligations imposed by NIS2, by accessing the article “Legislative and normative framework for starting the process of compliance with NIS2 in Romania and the calendar of compliance with national legislative provisions” .