IT & GRC Encyclopedia
What each concept, method, document and standard means, how it works and how to apply it, with the official sources behind each answer.
Complete guides
- ISO 27001 Complete GuideRead these in order and you will follow the sequence a real certification project takes, from understanding the standard to checking your own system.
- NIS2 Complete GuideThis path starts with the question most companies ask first, does NIS2 apply to them, and then goes through its duties in the order you would tackle them.
- Risk Management Complete GuideThese articles build on one another. By the end you will be able to set up a risk process that a small team can really keep running.
- Business Continuity Complete GuideContinuity planning goes wrong when it starts with the plan. This path starts with what the business actually needs, and ends with the means of recovering it.
Risk management
- What Is a Risk Register?A risk register is the running list of what could hurt a company: who answers for each risk, how serious it is, what is being done about it and how far that work has got.
- Risk Matrix ExplainedA risk matrix is a grid crossing likelihood with impact. It lets a company compare very different risks on one scale and decide which to handle first.
- Risk Assessment MethodologyA risk assessment methodology is the fixed way a company finds, analyses and evaluates its risks, so that two people assessing the same thing reach comparable results.
- Risk Treatment PlanA risk treatment plan says what will happen to each risk the company is not willing to leave as it stands: which option, which actions, who does them, by when, and what result to expect.
- Risk OwnershipA risk owner is the person accountable for a given risk, with the authority to decide its treatment, pay for it and accept whatever remains.
- ISO 27001 Risk AssessmentISO/IEC 27001 requires a defined process for assessing information security risks (clause 6.1.2), run at planned intervals (clause 8.2), which identifies risks and their owners, analyses them and evaluates them against set criteria.
- Asset InventoryAn asset inventory is the up-to-date list of the information, systems, devices and services a company depends on, each with an owner. You cannot protect what you do not know you have.
Compliance
- GDPR Risk AssessmentA GDPR risk assessment looks at the risks a processing activity creates for people's rights and freedoms. Where that risk is likely to be high, Article 35 requires a data protection impact assessment, or DPIA.
- What Is Compliance Management?Compliance management is the ongoing work of knowing which obligations apply to a company, meeting them, proving it, and correcting whatever falls short.
- Compliance Questionnaire GuideA compliance questionnaire is a structured set of questions showing where a company stands against a law, standard or contract, and where it falls short.
- Internal Controls ExplainedAn internal control is a measure that gives reasonable assurance a company will reach its objectives despite its risks: a required approval, a separation of duties, a review, a technical restriction.
- What Is ISO 27001?ISO/IEC 27001 is the international standard for an information security management system: the way a company governs, assesses and improves the security of its information.
- Statement of ApplicabilityThe Statement of Applicability is the mandatory ISO/IEC 27001 document stating which controls a company needs, why, whether they are implemented, and why any Annex A control is left out.
- What Is NIS2?NIS2 is the EU directive (2022/2555) setting cybersecurity obligations for medium and large entities in critical sectors: risk management measures, incident reporting and the accountability of management.
- NIS2 ChecklistA NIS2 checklist follows the directive's own structure: scope, the duties of the management body (Article 20), the ten measures of Article 21(2) and the reporting deadlines (Article 23).
- What Is GDPR?The General Data Protection Regulation (EU) 2016/679 sets the rules for using personal data in the European Union. It has applied since 25 May 2018.
- Compliance MonitoringCompliance monitoring is the regular checking, by those responsible, that obligations are still being met and controls are still working, so that problems surface before the audit does.
Business continuity
- What Is Business Continuity?Business continuity is a company's ability to keep delivering its most important products and services at an acceptable level during a disruption, whatever caused it.
- What Is Disaster Recovery?Disaster recovery is the set of plans and technical means that bring IT systems and data back after a serious disruption, within the times the business has agreed.
- Business Continuity vs Disaster RecoveryBusiness continuity keeps the business operating during a disruption, and disaster recovery restores the IT it depends on. Recovery is one part of continuity.
- Business Impact AnalysisA business impact analysis, or BIA, works out what happens over time if each activity stops, and uses that to set its priority and recovery targets.
- RTO ExplainedThe recovery time objective, or RTO, is the time within which an activity or system must be back after a disruption, before the consequences become unacceptable.
- RPO ExplainedThe recovery point objective, or RPO, is the most recent data a company can afford to lose, expressed as a length of time before the incident.
Audit
- Internal Audit GuideAn internal audit is an independent, planned and documented check of whether a company's practices meet its requirements and work as intended.
- Audit ChecklistAn audit checklist is the auditor's working document. For each criterion, it says what to look at, who to ask and what to sample, and it records what was found.
- Audit FindingsAn audit finding compares evidence with a criterion. It states what should be happening, what was seen, why it matters and why it happened.
- Network Audit ChecklistA network audit checklist verifies that a network is known, segmented, up to date, monitored and accessible only to those who should reach it, with evidence for each line.
Third-party risk
- Vendor Risk AssessmentA vendor risk assessment works out what could go wrong through a specific supplier, how well that supplier is prepared, and whether the remaining risk is acceptable.
- Third-Party Risk ManagementThird-party risk management is the programme that controls the risks of relying on suppliers and partners, from selecting them to ending the relationship.
- Security QuestionnairesA security questionnaire is the list of questions a buyer sends a supplier to check its security practices. Answering them well has become part of selling.
Practical guides
- What is GRC? Governance, risk and compliance explainedGRC stands for governance, risk and compliance: how a company sets its rules, manages what could go wrong and proves it meets its obligations.
- How to define the scope of an ISMSThe scope states which part of the company the ISMS covers. Clause 4.3 of ISO/IEC 27001 asks you to determine its boundaries and applicability, and to keep it as documented information.
- How to run a compliance gap assessmentA gap assessment compares your current practice with a framework's requirements, to show what is missing and what to do first. It is often the first step of a compliance project.
- DORA requirements: the five pillars explainedThe Digital Operational Resilience Act, Regulation (EU) 2022/2554, applies since 17 January 2025 to EU financial entities and sets one set of rules on ICT resilience.
- HIPAA Security Rule: safeguards and what to documentThe HIPAA Security Rule (45 CFR Part 164, Subpart C) sets US standards to protect electronic protected health information held by covered entities and their business associates.
- The 12 PCI DSS requirements explainedPCI DSS is the card industry's security standard for any company that stores, processes or transmits cardholder data. This guide follows version 4.0.1, published in June 2024: check the PCI SSC document library for the latest version.
- GDPR data breach: what to do within 72 hoursUnder Article 33 of the GDPR, a personal data breach must be notified to the supervisory authority within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people.
- SOC 2 vs ISO 27001: differences and which to chooseISO/IEC 27001 certifies a management system; a SOC 2 report gives an auditor's opinion on your controls. They overlap a great deal, and the right one depends mostly on what your customers ask for.
- Policy, procedure, standard, guideline: what is the difference?These four kinds of document answer different questions. Keeping them apart makes each one shorter, easier to approve, and easier to keep current.
- User access reviews: how to run themAn access review checks that people still need the access they hold. It is one of the most frequently tested controls, and failures here often appear in audit findings.
- How to write an incident response planAn incident response plan says who does what when something goes wrong. Written in advance, it saves the hours when decisions matter most.