GRC Engineering Club · Atlanta chapter
Explore the terms behind policies, controls, audits, privacy, and AI governance. The Atlanta chapter of the GRC Engineering Club connects each concept to a practical example, related terms, and further reading.
Search terms, acronyms, definitions, and topics. Your search stays in this browser.
6 terms shown · 48 in the collection
An organization’s high-level direction or expectation for how people and systems should operate.
It gives teams a shared requirement to turn into practical work.
An access policy says that privileged access must use MFA.
Organizational policy in the Building Blocks lesson; usage differs by source.
A safeguard or activity used to address risk and support an objective or requirement.
A written intention needs an operating practice behind it.
An identity system blocks privileged sign-in unless MFA succeeds.
Building Blocks uses “control” for a safeguard that operates. Frameworks may also use the word for a stated control objective or requirement.
Information used to support a conclusion about what happened or how something works.
Reviewers need relevant, reliable information for the question and period they are checking.
A dated access-review record shows who reviewed accounts and what they removed.
Practitioner explanation connected to Building Blocks and the Field Guide; sufficiency depends on the evaluation.
Uncertainty that could affect an objective, such as the possibility and consequences of unauthorized access.
It helps teams decide which problems deserve attention and resources.
A team considers how stolen administrator credentials could interrupt its service.
Security-focused illustration; risk definitions and rating methods depend on the source and organizational context.
The organized way an organization manages information-security risk and improves its practices.
It connects security work to leadership, objectives, and recurring review.
An owner coordinates risk work, control checks, leadership decisions, and improvement actions.
ISO/IEC 27001:2022 describes requirements for an information security management system.
A catalog that connects cybersecurity and privacy controls with many sources of requirements.
It helps practitioners organize overlapping expectations around common controls.
A team follows one access control’s mappings to investigate several customer requirements.
SCF common-controls approach; mappings do not establish compliance by themselves.