Topic 5 of 6
Governance, risk, and compliance (GRC)
Laws define how to protect data, where to store it, and who answers for an incident. GRC is the set of practices for meeting them in an orderly way while managing business risk. This topic sets the stage for the whole compliance domain with Microsoft Purview.
Contents
What is GRC?
Organizations operate in an increasingly complex regulatory environment and face internal and external risks that can disrupt operations, expose data, or damage trust. GRC brings together policies, processes, and technologyto handle it in a structured way.
A structured approach to GRC helps to:
Governance
It's the system of rules, practices, and processes an organization uses to direct and control its activities. Many rules come from external standards, obligations, and expectations. For example, defining who can access which resources, who has admin privileges and for how long, and what happens when those rules are broken.
In security, governance includes:
- Defining and enforcing policies for classifying, handling, and retaining data
- Setting identity and access management standards
- Creating approval processes for privileged access
- Assigning owners and accountability for each security control
- Setting the overall direction of the security strategy
Key idea
Governance is the structure that risk management and compliance operate on. Without defined rules and owners, there's no way to measure risk or prove compliance with anything.
Risk management
It's identifying, assessing, and responding to threats or events that can affect objectives or customer trust. Every organization has risk: the goal isn't to eliminate it all, but to understand it well enough to decide what to do about each one.
External risks
Cyberattacks, natural disasters, economic disruptions, regulatory changes, and third-party supplier actions.
Internal risks
Accidental data exposure by employees, insider threats, fraud, and gaps in security processes.
The process usually follows four steps:
Identify
Discover risks to systems, data, and operations through interviews, vulnerability assessments, audit findings, and ongoing monitoring.
Assess
Evaluate each risk by its potential impact and likelihood. The result is a score that helps prioritize which ones need the most attention.
Respond
Define a plan for each significant risk: accept, mitigate, transfer, or avoid it.
Monitor
Track identified risks, measure control effectiveness, and update the assessment as the environment changes.
The 4 risk responses
| Response | What it means | Example |
|---|---|---|
| Accept | Take on the risk because its impact is low | An internal system with no sensitive data goes without a costly control |
| Mitigate | Implement controls that reduce impact or likelihood | Requiring MFA to reduce account takeover |
| Transfer | Shift the financial impact to a third party | Buying cyberattack insurance |
| Avoid | Change the process that creates the risk | Stopping storage of a data type that isn't needed |
Compliance
It's following the laws, regulations, standards, and policies that apply based on industry, geography, and data type. They define what data to protect, what processes to have, and what penalties apply for noncompliance.
HIPAA
Health Insurance Portability and Accountability Act: US regulation on protecting and handling health information.
ISO 27001
International standard for information security management systems.
SOC 2
Service Organization Control 2: audit standard for providers that store or process customer data.
Compliance isn't the same as security
Compliance sets the minimum the law requires. Security is broader: it covers every process, technology, and practice that protects data and systems. An organization that only does the minimum can be technically compliant and still have serious vulnerabilities.
Residency, sovereignty, and privacy
Data residency
Regulations on which physical locations data can be stored in and how and when it's transferred, processed, or accessed internationally. They vary widely by jurisdiction. In the cloud, you need to check where the provider physically stores data and whether those locations meet the requirements.
Data sovereignty
Data is subject to the laws of the country or region where it's collected, held, or processed. The same data collected in one country, stored in another, and processed in a third is subject to the laws of all three. Global organizations need to know which jurisdictions apply and how their laws interact.
Data privacy
Proper handling of personal data: any information about an identified or identifiable person, whether direct (name, email, phone) or indirect (location or browsing history).
Privacy laws require organizations to:
- Be transparent about what personal data they collect and how it's used
- Obtain appropriate consent before collecting certain categories of data
- Give individuals rights over their data: access, correct, or delete
- Protect personal data against unauthorized access or exposure
These laws apply wherever the organization operates and wherever its customers are, so global companies often have to comply with several privacy regulations at once.
How the three pieces fit
Governance · the framework
Decides rules, owners, and processes.
Risk · the priorities
Shows which threats matter most and what to do about each.
Compliance · the proof
Demonstrates that external obligations are met.
In domain 4 you'll see how Microsoft supports each piece: the Service Trust Portal and privacy principles, Compliance Manager to measure compliance, and the Purview solutions to protect and govern data.
Exam scenarios
| Situation | Concept | Why |
|---|---|---|
| Defining who approves admin access and for how long | Governance | They're rules and processes to direct and control activities. |
| Calculating the impact and likelihood of a ransomware attack | Risk management (assess) | It produces a score to prioritize. |
| Proving to an auditor that ISO 27001 is met | Compliance | It's adherence to an external standard. |
| A law requires citizens' data to be stored inside the country | Data residency | It governs the permitted physical location. |
| Data collected in one country, stored in another, processed in a third | Data sovereignty | It's subject to the laws of all three. |
| A customer asks for all their personal data to be deleted | Data privacy | Privacy laws grant the right to deletion. |
| A company decides not to launch a service because of its legal risk | Avoid the risk | The process that creates the risk is changed. |
Common exam traps
❓ A law requires citizens' data to be physically stored inside the country. Residency or sovereignty?
Data residency: it's about the permitted physical location. Sovereignty is about which laws apply to the data based on where it is.
❓ Buying cyberattack insurance is which risk response?
Transferring the risk. Mitigating would be implementing controls; avoiding would be changing the process that creates it.
❓ Does complying with a standard guarantee the organization is secure?
No. Compliance is the legal minimum; security covers every process and technology that protects data and systems.
❓ Is the goal of risk management to eliminate all risk?
No. It's to understand risks well enough to decide how to respond to each one.
❓ Is a person's browsing history personal data?
Yes. Personal data includes indirect information that can identify someone, such as location or browsing.
❓ Assigning an owner to each security control: risk or governance?
Governance: it defines owners and processes.
❓ Is an employee exposing data by mistake an external risk?
No. It's an internal risk, like insider threats and fraud.
Did you get this topic?
Test what you just learned
A company collects customer data in Germany, stores it in Ireland, and processes it in the United States. Which concept explains why that data is subject to the laws of all three countries?
Ready to test "Governance, risk, and compliance"?
Original questions, each with a full explanation.
Start a mock exam