Security Governance, Risk & Compliance Guide

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

A risk has an owner, a control, and a date

Governance is who may accept a risk. Risk is a sentence: what can go wrong, how bad it is, what you do about it. Compliance is a framework you were told to use, answered with evidence. None of these is a certificate you award yourself. The framework guides are the specific names. This page is the register that sits under all of them.

The risk register generator drafts rows. A row without an owner is a wish. A row that says accept with no name and no date is a gap. The framework selector helps you stop pretending one spreadsheet satisfies every law.

Evidence is a record you can find: a ticket, a config, a report, a training completion. A policy no one can locate is not evidence. The policy guide is how the document gets an approver.

This is not legal advice and not an audit opinion. An auditor, a customer, or a regulator sees your evidence, not this guide.

Five risks, each with a name

Write five risks that are actually yours: a lost laptop, a leaked mailbox, an unpatched internet-facing service, a vendor who holds data, a detection nobody owns. Each gets an owner, a control you already have or a gap, and a review date.

Pick one framework only if a customer or a law already named it. Otherwise the register is enough for this window. Do not start twelve frameworks because the selector listed them.

For one risk, point at evidence. If you cannot, the control is a gap, and the gap has a ticket. A green cell with no link is red.

Review is a meeting with the owners, not a colour change the night before a questionnaire.

A change you can finish

The change is the register and the one gap ticket. Buying a tool or claiming certification is not this window.

Rollback is the previous register, kept so an edited row can be compared.

List risks in sentences.
Give each an owner and a date.
Mark control or gap.
Link evidence or open a ticket.
Choose a framework only if you were already required to.
Say in the ticket that this is not a certification.
Schedule the review with the owners.

Mistakes that outlive the command

governance, risk, and compliance fails in the same few ways. Each one looks finished on the day you type it. The list is here so the ticket can forbid them before the window, not so you can recognise them in an incident review.

A register with no owners.
Calling the register a certification.
Starting every framework at once.
Evidence that is a tick mark.
Accepting a risk with no name.
A questionnaire filled from memory the night before.
Legal conclusions in the register.
Deleting the old register instead of versioning it.

Decisions to write down before the window

One decision for governance, risk, and compliance: Every row has an owner and a review date. Gaps have tickets. Evidence is a link or the item is a gap. Framework work waits for a real obligation, then uses that framework's guide. This page does not certify you. Counsel owns legal readings. The previous register is kept. Owners will actually meet. The policy guide owns document approval. And one gap is in progress before the next framework starts.

The hour you stop

Write the hostname or the system name, the owner, and the clock time before you change anything for governance, risk, and compliance. If the system is serving people and you do not have a spare, this hour is a plan, not a change. A plan you can read tomorrow is a success. A change you cannot undo is not.

Use a lab or a copy. The log line you test with is one you created, or one you are already allowed to hold. You do not point a tool at a network, a mailbox, or an account you do not administer. The tools on this site run in the browser. They do not log in, and they do not scan.

prompt-for-this is a reminder that a secret is missing. It is not a password, a token, or a key you save. The real secret stays in the password store. If a draft, a log, or a ticket still contains a live secret, stop and rotate it. Then delete the copy.

One change. A firewall, a detection, a DNS record, and a policy do not share a window. If two things move and the outcome is wrong, you will not know which one did it. The rollback is the previous value, written down while the system still works.

A second person reads the scope aloud: which host, which domain, which account. If they cannot find it in the ticket, the ticket is not ready. Silence is not agreement.

Documentation addresses stay in the lab. 192.0.2.0/24, 198.51.100.0/24, and 203.0.113.0/24 are not your production network. example.com is not your domain. Replace them before a real record or a real rule is published.

Do not allow every address because a test failed. A rule, a header, or a detection that matches the world is a draft you delete. Management stays on the prefix you named. A service port opens when the service is ready, for the clients you named.

Keep the previous file. A generator draft is not the previous file. The previous file is what you reload if the new one is wrong. You practised the reload on the lab, with a console or a second session open when the change can lock you out.

If a step fails twice, stop. The failure is the result. Adding a command from a forum beside a half-applied config produces a system nobody can explain. Rebuild the lab from the copy you kept.

When the checks pass, the next system waits until someone else can repeat the proof from the notes. governance, risk, and compliance is done for this window when the proof is written, not when the tool printed a file.

This page is a planning guide. It is not legal advice, not an audit opinion, not a vendor manual, and not the text of a standard. If a lawyer, an auditor, or a regulator must see the decision, they see the ticket and the evidence, not this paragraph.

Hand the finished note to the neighbouring guide that owns the next step, and leave this system alone until that guide has its own window.

GRC checks before the register is shown to anyone outside the team

Confirm this before you call the change done: Five or fewer risks were written as sentences. Each has an owner. Each has a date. Gaps have tickets. Evidence links open. No cell says certified. A framework was added only if required. The old register is still available. A second person read one row aloud. Legal wording was left to counsel. The review meeting is on a calendar. The policy guide is named where a document is missing. The hostname in the prompt matches the hostname in the ticket for governance, risk, and compliance. The result line includes the time and the person, not only the command. You can point at the rollback value without searching a chat history. And done is a sentence a second person can repeat: the proof for governance, risk, and compliance happened, and the next host is not started early. If one of those fails, stop.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Guides in this cluster

These supporting pages belong to this pillar.