Most GRC programmes fail by becoming paperwork. We help you build one that runs on how your team already works, and we give you the ISO 27001 policy templates to start with, free.
Policies approved by management, named owners for every control, a management review that happens on a calendar and produces decisions. Governance is the difference between a document set and an organisation that follows it.
A risk method people can repeat, a register that is reviewed rather than written once, treatment decisions with an owner and a date, and risk acceptance signed by someone entitled to accept it. Our ISO 31000 work builds this.
ISO 27001, ISO 20000, the DPDP Act 2023 and GDPR each ask for evidence. Compliance is keeping that evidence as a by-product of normal work, so an audit is a sampling exercise and not a scramble.
None of it needs a software platform to start. It needs owners, a calendar and records that are kept as the work happens. We set that up with you, using your own tools, and stay with it until the first surveillance audit or regulator question has been answered from the records.
Policies, procedures and a Statement of Applicability for all 93 Annex A controls. Read them in full, then download the PDF with a free account.
Browse the templates →Your domain, DNS, public exposure and website read together, with findings rated by what an attacker could do. A good first input to the risk register.
Run the review →Scope, risk method, Statement of Applicability, internal audit and management review, built around how you work.
See the service →A risk method and register your team can repeat, with treatment owners and review dates.
See the service →Data mapping, consent, notices, breach process and the grievance route the Act requires.
See the service →For organisations that handle the data of people in the EU or UK, mapped to the same controls.
See the service →GRC stands for governance, risk and compliance. In cyber security it is the management side of the work: who is accountable, how risk is assessed and treated, and how the organisation shows it meets a standard such as ISO 27001 or a law such as the DPDP Act.
Not to begin. A GRC programme works in a spreadsheet and the ticketing system you already have. A platform is worth buying once the process exists and the volume of risks, controls and evidence makes manual tracking the bottleneck. Buying the tool first usually produces an empty tool.
ISO 27001 is a GRC framework for information security. Its clauses cover governance (leadership, roles, review), risk (assessment and treatment) and compliance (internal audit, evidence, improvement). Certifying to it is one way to prove a GRC programme works.
In the policy library: a full set of ISO 27001 policies and procedures, a Statement of Applicability for all 93 Annex A controls, and ISO 20000 service management documents. Each can be read in full on the site, and the PDF is free with an account.
No template is. Certification depends on your own risk assessment, the controls you actually run and evidence that you follow your documents. The templates save the drafting time so the effort goes into your decisions.