Week2-GRC

Week-2: Cyber GRC - Governance, Risk & Compliance

Ali Jaddoa, ,

Ali.Jaddoa@roehampton.ac.uk

Date:


25/26
Week2-GRC

What is you job ambition after this course

Either

Or

  • Scan

25/26
Week2-GRC

Learning Objectives

  • Define GRC and its core components
  • Understand the role of GRC in cyber security operations
  • Analyse how governance and compliance support secure system design
  • Review some UK-based legislations

25/26
Week2-GRC

Definations

Policy A concise directive from upper management that sets a course of action for the entire organisation.
Standards Detailed definitions for hardware and software usage to ensure consistent security controls.
Procedures Written instructions for implementing policies and standards, including plans for action, installation, testing, and auditing.
Guidelines Recommended actions for applying policies, standards, or procedures, which can be specific or flexible.

25/26
Week2-GRC

Hierarchical IT Security Policy Framework

  • Policies: Apply to the entire organisation.

  • Standards: Specific to a given policy.

  • Procedures & Guidelines: Define usage and implementation.

  • This will help define the roles, responsibilities, and accountability throughout.

width:1OO% center


25/26
Week2-GRC

GRC


25/26
Week2-GRC

What is GRC?

  • Governance -Who decides, and how?
  • Risk Management -What could go wrong, and how bad is it?
  • Compliance -Are we following required laws and policies?

GRC = Integrated structure to align cyber security with organisational accountability


25/26
Week2-GRC

GRC in the cyber security Lifecycle

A robust cyber security lifecycle embeds GRC principles at every stage:

  • Governance provides the structure for secure design and deployment.
  • Risk Management identifies threats and sets priorities and controls.
  • Compliance ensures alignment with legal, regulatory, and policy obligations.
GRC acts as the backbone for accountable, adaptive, and defensible cyber security.
cyber security Lifecycle Diagram

25/26
Week2-GRC

1. Governance in GRC


25/26
Week2-GRC

Governance in cyber security

Effective governance ensures that cybersecurity decisions are made with

clarity, accountability, and strategic intent.

  • Clear security ownership and escalation processes.
  • Visibility of decisions across stakeholders.
  • Strategic alignment between technical and organisational objectives.
Governance turns cybersecurity from ad-hoc control into a managed, measurable discipline.
Cybersecurity Governance

25/26
Week2-GRC

Why Governance is important Technically

Governance is more than policy - it shapes day-to-day engineering and operations.

  • Stops unauthorised or ad hoc system changes
  • Ensures security is built into design, deployment, and maintenance
  • Translates high-level policy into enforceable practice (e.g. secure defaults)

Without governance, controls may be implemented inconsistently or ignored entirely.


25/26
Week2-GRC

Governance in Practice (e.g.)

  • GitHub / GitLab:
    • Branch protection rules
    • Code reviews as enforcement mechanisms
  • CI/CD Pipelines:
    • Approval gates, signed builds, rollback policies
  • Cloud IAM: (Week-4&5)
    • Role-based access control (RBAC)
    • Resource tagging for ownership visibility

These tools embed governance into developer and sysadmin workflows.


25/26
Week2-GRC

Let's find other examples

Either

Or

  • Scan

25/26
Week2-GRC

Lifecycle Governance Touchpoints

Design → Develop → Deploy → Monitor

Governance must be embedded across the entire system lifecycle:

  • Security ownership is clearly assigned at each stage --> accountability
  • Approval workflows ensure peer-reviewed changes and accountability
  • Change control procedures support secure rollbacks and version tracking
  • Monitoring provides visibility with audit-ready logs and alerts

Security isn’t something added later - it must be built into every step of the pipeline.


25/26
Week2-GRC

Challenges of Governance in cyber security

Challenge i.e.
Ambiguous roles and responsibilities Unclear ownership of security tasks and decision-making authority
Poor communication between teams Disconnected workflows between IT, security, development, and leadership
Shadow IT and untracked systems Bypassing governance by using unsanctioned tools or services
Overly complex policies Difficult to implement or align with operational realities
Weak security culture Security treated as a compliance issue rather than a fundamental design goal

Clear governance requires not only structure, but also buy-in and communication across the organisation.


25/26
Week2-GRC

Case Study: NHS and the WannaCry Attack
Date 12 May 2017
Exploit Used EternalBlue (SMB vulnerability) - unpatched despite prior advisories
Governance Failures • No centralised asset/patch management
• Poor visibility & accountability
• Unclear escalation & communication
• Outdated systems (e.g., Windows XP)
Impact • 81 NHS trusts & 600+ orgs affected
• Thousands of appointments cancelled
• 5 A&E units diverted patients
• Data access & clinical systems disrupted
Outcome / Lessons • Could have been prevented by basic cyber hygiene
• Need for tested response plans & lifecycle governance

“Could have been prevented if basic cybersecurity practices had been followed.”


25/26
Week2-GRC

Governance Weakness: Warning Signs

(That Everyone Ignored Anyway, sadly)

  • No up-to-date asset inventory
  • Privilege creep and shadow admins
  • No security gates/controls in deployment pipelines
  • Inconsistent or undocumented configuration practices

Ask: “If something breaks or is breached, can we trace the decision and responsibility?”


25/26
Week2-GRC

Quick Activity: Governance in Action (5–10 min): Work in groups of 3

  1. Think of an organisation or setting you know (e.g., a university, hospital, charity, or company).
  2. Identify one cybersecurity decision - such as handling a data breach, approving access, purchasing new software, or responding to an outage.
    • Who should make the decision
    • What governance process or control should guide it
    • What could go wrong if this process is unclear
Decision Area Governance Control Risk if Absent
Approving new software Formal review and approval policy Shadow IT and data exposure

Why is it important to define who decides and how in cybersecurity governance?


25/26
Week2-GRC

2. Risk Management in GRC


25/26
Week2-GRC

Risk Management in GRC

Risk management is the process of identifying, evaluating, and mitigating threats to information systems.

It enables:

  • Informed governance and security decision-making
  • Prioritisation of controls and resources
  • Resilient system design under uncertainty

25/26
Week2-GRC

Cyber Risk: What Could Go Wrong?

Common risk scenarios include:

  • Use of outdated or unpatched software
  • Misconfigured cloud storage or public-facing assets
  • Weak or reused authentication credentials
  • Vulnerabilities introduced through third-party vendors

Effective risk management anticipates both internal and external threats.


25/26
Week2-GRC

The Risk Management Lifecycle

A simplified process:

  1. Identify -What threats or vulnerabilities exist?
  2. Assess -What is the likelihood and potential impact?
  3. Mitigate -What controls can reduce or eliminate the risk?
  4. Monitor -Are the risks changing? Are controls effective?

This cycle is continuous - not a one-time task.


25/26
Week2-GRC

Governance and Risk: The Link

Governance ensures that risk decisions are formalised, traceable, and accountable:

  • Who owns each risk?
  • Who decides whether to accept, transfer, or mitigate it?
  • What process validates and documents those decisions?

Without governance, risk assessments may lack follow-through or ownership.


25/26
Week2-GRC

Risk Management

More in the upcoming weeks


25/26
Week2-GRC

From Risk to Compliance

  • Risk Management identifies what must be protected
  • NEXT --> Compliance ensures controls are in place and operating as intended

Risk is forward-looking; compliance is confirmatory.


25/26
Week2-GRC

3. Compliance GRC


25/26
Week2-GRC

Why do we need Ethics and Policies?

Either

Or

  • Scan

25/26
Week2-GRC

Imagine if there were no air traffic controllers and airplanes flew freely.

  • Trying to take off and land would be extremely dangerous.
  • Many more accidents would have happend.
    • Such a situation would wreak havoc.

width:1OO% center


25/26
Week2-GRC

Compliance

Compliance = adherence to:

  • Legal obligations
  • Regulatory requirements
  • Internal policies

25/26
Week2-GRC

Cybersecurity Laws and Regulations in the UK

  • ISSUE: There is no overarching, primary national cybersecurity law.

  • But, there are sevral critical legislation schemes that govern cybersecurity, data privacy, and data protection in the UK:

    • CMA: Computer Misuse Act 1990
    • DPA: Data Protection Act 2018
    • UK-GDPR: UK General Data Protection Regulation
    • NIS Regulations: Network and Information Security Regulations 2018:
    • PSTI: Product Security and Telecommunications Infrastructure Act 2022.
    • RIPA:Regulation of Investigatory Powers Act 2000
    • Online Safety Act 2023

25/26
Week2-GRC

Core UK Cyber Laws

1. Computer Misuse Act 1990 2.DPA: Data Protection Act 2018: Post-Brexit
Focus Prevent unauthorised access or misuse of computer systems Protect privacy and lawful use of personal data
Covers Hacking, ransomware, DDoS, unauthorised data modification Collection, storage, and sharing of personal information
Applies to Anyone accessing systems without consent All organisations handling personal data in the UK
Main Goal Deter and prosecute cybercrime Ensure accountability and responsible data handling
Penalties 6 months–10 years imprisonment or unlimited fines Up to £17.5 million or 4% of global turnover

25/26
Week2-GRC

Core UK Cyber Laws (Cont.)

3.UK-GDPR (UK General Data Protection Regulation) 4.NIS: (Network and Information Security Regulations 2018)
Focus Regulates how personal data is collected, stored, and processed Strengthens cybersecurity and operational resilience
Covers Fairness, transparency, minimisation, accuracy, security, purpose, accountability Essential Services (OES): energy, health, transport
Digital Service Providers (RDSPs): cloud, marketplaces
Main Goal Protect individual rights and ensure responsible data handling Ensure essential services can prevent, detect, and respond to cyber incidents
Requirements Follow 7 data protection principles; ensure data subject rights Implement security controls, conduct audits, report major incidents
Penalties Up to £17.5 million or 4% of global turnover Up to £17.5 million

25/26
Week2-GRC

How the DPA Act Works With the UK-GDPR?


25/26
Week2-GRC

Core UK Cyber Laws (Cont.)

PSTI: 5.Product Security and Telecommunications Infrastructure-2022 6.RIPA:Regulation of Investigatory Powers Act 2000
Focus Secures consumer smart and IoT devices Regulates lawful surveillance and interception of communications
Key Requirements Unique passwords, vulnerability reporting, defined update policies Authorised access to communications data by public authorities
Enforced by Office for Product Safety and Standards (OPSS) Law enforcement and oversight bodies
Main Goal Improve IoT security and consumer protection Ensure surveillance and data access remain lawful and accountable
Penalties Up to £10 million or 4% of global revenue Prosecution or disciplinary action for misuse

These laws collectively strengthen the UK’s approach to cybersecurity, privacy, and accountability.


25/26
Week2-GRC

7. Online Safety Act 2023

Protects users - especially children and vulnerable groups - from illegal or harmful online content and holds digital platforms accountable for user safety.
Scope Applies to social media, search engines, and user-to-user services operating in the UK.
Regulator Ofcom - empowered to enforce compliance, issue guidance, and impose fines.
Key Duties - Conduct risk assessments for harmful/illegal content
- Implement age verification and moderation
- Remove or limit illegal content quickly
- Publish transparency and compliance reports
Penalties Up to 10% of global annual turnover for non-compliance or repeated violations
Notable Features - Focus on child safety and online harm prevention
- Covers user-generated content and recommendation systems
- Extends to fraudulent ads and deepfake harms

“A safer digital space where users, especially children, can engage without exposure to harm.”


25/26
Week2-GRC

Compliance as a Technical Concept

  • Access controls
  • Logging and retention
  • Configuration baselines
  • Consent mechanisms

25/26
Week2-GRC

Auditing and Monitoring

  • Internal audits
  • External audits
  • SIEM/log review

25/26
Week2-GRC

Compliance-by-Design

  • Logging from Day 1
  • Secure defaults
  • Config hardening
  • Audit trail review

25/26
Week2-GRC

Case Study-1: Data Breach at Marriott International (2018)

  • Incident: Unauthorised access to the Starwood guest reservation database.
  • Ethical Implications:
    • Negligence: Failure to detect and prevent the breach from 2014 to 2018.
    • Impact: Exposed personal information of approximately 500 million guests.
    • Response: Implemented enhanced security measures and notified affected customers.

width:1OO% center


25/26
Week2-GRC

Case Study-2: Ethical Dilemma in Surveillance - Clearview AI (2020)

  • Unlawfully storing facial images.
  • Ethical Implications:
    • Privacy Violation: Unauthorised scraping of personal images.
    • Impact: Legal actions and public criticism over privacy concerns.
    • Response: Company faced restrictions and regulatory scrutiny in several countries.

width:1OO% center


25/26
Week2-GRC

GRC: An Integrated Model

Each component strengthens the others - GRC is not siloed


25/26
Week2-GRC

CyBOK Perspective

Refer to: Security Governance & Management
https://www.cybok.org

“cyber security governance empowers us with wisdom, risk management equips us with foresight, and compliance holds us accountable…”


25/26
Week2-GRC

Discussion

How would you explain the difference between security controls and security governance?


25/26
Week2-GRC

Lab

  • Review and complete this week’s activity from here.

  • If you missed last week’s session, you can catch up by reviewing the Week 1 activity here.


25/26

**Cyberspace cannot continue to flourish without some assurances of user security.**

![bg contain right 80%](../../figures/ITFRAMWORK.jpg)

--- ### Activity: How the DPA Act Works With the UK-GDPR? - Both the UK-GDPR and the DPA 2018 **work together** in **conjunction** to regulate data protection and data privacy in the UK. - - While the `DPA` 2018 `applies` to all UK `businesses` that **control the processing of personal data**, - the **GDPR** applies to those that **process** personal data on **behalf** of **controllers**