Request Demo

Today, every organization strives to optimize the speed with which they access information. Data is being stored, processed, transmitted, and utilized in almost every day-to-day occurrence in both business and in life. The tech ecosystem has observed and taken part in deploying large amounts of capital both in funding and purchasing cybersecurity and information security technologies with the goal of helping secure and manage all of this data. Both public and private organizations have heavily invested time and resources into implementing complex technologies and point solutions in order to reach security.  

While doing so, organizations have run into major problems- the most pertinent stemming from implementing too much too fast, with no overarching framework to measure their best practices. Either the small to medium business has implemented some best practices but hasn’t used any framework to align with, or the enterprise has chosen one of not many more frameworks or standards to align with (often adding others due to compliance requirements). Both of these execution approaches lack measurement, visibility in their cybersecurity posture, and organization. 

Governance, Risk Management, and Compliance (GRC) programs evolved during the early 2000s, when mandates such as the Sarbanes-Oxley Act (2002) were released and prominent. As the pace of regulatory change accelerated in parallel with the growing risk landscape, organizations began to struggle to manage a number of regulatory standards, standard frameworks, hybrid or custom frameworks, and vendor questionnaires. In short, too many redundant compliance requirements across an increasing number of unique applications.

Thus, governance, risk, and compliance (GRC) technologies were developed to aid organizations of all sizes to keep up with the pace of regulatory change, organize risk and compliance data, and help increase Chief Information Security Officers (CISOs) and their teams’ decision making and performance. Organizations were searching for ways to reduce the redundancy of compliance requirements centralize their programs, ideally on one single platform.

GRC products: Serving their purpose, but lagging behind market needs.

GRC solutions were built on a solid vision, but were not executed in a way that could evolve and change with the modern-day organization-- much less the regulatory change, cybersecurity program complexity, and needs of both security and business leadership. CISOs and security leaders need to easily communicate their posture to executive management, have a single source of truth to reference all of their program data, and show program success based on metrics that both technical- and business-side leaders can understand and get behind. Operational teams within the cybersecurity program need to know where to remediate for the best return on investment (ROI), they need to manage compliance as a continuous, “always on” function and consistently be in sync on what the most effective plan of action is both now and in the future.

These objectives are difficult to achieve in a single product. Many of the first GRC technologies took a bottom-up as opposed to a top-down approach to building their technologies - focusing on operational functionalities and features that would allow risk and compliance teams to get as granular as possible with relationships between assets and risks, departments, policies and procedures. These GRC best practices, however, led to complex solutions that serve their purpose and are excellent for many functions, but rarely help organizations achieve the vision of an agile, always-on, continuous and risk-aware information security program.

According to Gartner, 69 percent of organizations are not confident that their current GRC activities will be enough to meet their future needs. In addition, enterprise organizations often take anywhere between 1,000 to more than 10,000 hours to complete a cybersecurity risk or compliance assessment. Gartner coined the term “Integrated risk management (IRM)” to speak to the future needs of information security organizations, releasing the first magic quadrant for integrated risk management in 2018 supplanting what everyone only knew as GRC at the time. Recognizing that for forward-thinking organizations, GRC’s product modularity was a detriment; IRM is “a set of practices and processes supported by a risk-aware culture and enabling technologies, that improves decision making and performance through an integrated view of how well an organization manages its unique set of risks” (Gartner). With the end goal of modern information security teams being to deliver data that supports the greater enterprise risk management strategy, taking an integrated approach is critical to delivering on these needs.

We see the shift of legacy GRC to IRM in terms of messaging, but in the current state, the technology of these players remains fundamentally the same. Integrated risk management solutions, as opposed to GRC tools, aggregate assessment data and visualize it in an integrated view - enabling a more effective and informed approach to managing risk within the organization. 

After combing through hundreds of reviews of leading GRC products, speaking directly with hundreds more legacy GRC users who came to CyberSaint seeking a true IRM technology, here are some lessons learned and how to see past the marketing that GRC platforms are doing to convince customers like you that they’re still worth investing in.

Free download: The Three Lies GRC Is Telling You

You may also like

Risk Register Examples for ...
on July 29, 2020

Risk registers are a widespread utility among many cybersecurity professionals that allow practitioners to track and measure risks in one place. This type of reporting can quickly ...

3 Templates for a Comprehensive ...
on July 27, 2020

What is a Cyber Risk Assessment Information security risk assessments are increasingly replacing checkbox compliance as the foundation for an effective cybersecurity program. As ...

Infographic: The Six Steps of the ...
on July 24, 2020

As many organizations begin to mature their cybersecurity program, they are shifting to a risk-based approach to security. In most cases, security leaders are no strangers to ...

3 Cybersecurity Risk Areas to ...
on July 20, 2020

2020 has brought with it immense change across the cybersecurity risk landscape. The effects of COVID-19 pandemic are still ongoing, and the opportunities for new cybersecurity ...

Alison Furneaux
Efficient Demotivation: How Black ...
on July 16, 2020

As information security shifts from a siloed function to an increasingly relied upon business function and enabler, business executives and Boards have taken a greater interest in ...

Developing Your Risk Management ...
on July 14, 2020

The scope and process for an organization seeking to implement the NIST Cybersecurity Framework (CSF) can be daunting for even the most experienced CISO to handle. Despite the ...