Security governance, risk, and compliance, also known as "GRC," is a way to make sure that a company or organization is following all of the rules and regulations related to security.
Imagine that you have a special club that you and your friends started, and you have some rules about who can join and what you can do in the club. You might have a special notebook where you write down all of the rules and make sure that everyone follows them. Security GRC is a little bit like that notebook, but instead of rules for a club, it's rules for keeping a company or organization safe from harm. These rules might include things like making sure that all employees use strong passwords, or that sensitive information is kept in a secure place. By following these rules, we can help make sure that the company or organization is secure and stays safe.

GRC covers a wide range of topics. Few capabilities are as below

1. Exception Management - Is a way to deal with situations that are outside of the normal rules and procedures. Imagine that you have a rule in your club that everyone has to be dressed smart casuals. One day, one of your friends shows up wearing a say summer beach attire. In this case, you might make an exception and allow your friend to join the club even though they're not wearing the right shirt. In the context of security governance, risk, and compliance (GRC), exception management is a way to handle situations where something unexpected happens and you need to deviate from the normal rules and procedures. Exception management helps to make sure that you can still get things done even when something unexpected happens, while also making sure that you are still following the rules and keeping things secure.

2. Standards Management - is the process of creating and maintaining rules and guidelines for how a company or organization should operate. These rules and guidelines are called "standards," and they can be related to things like security, quality, or safety. Imagine that you have a club and you want to make sure that everyone is following the same rules. You might write down all of the rules in a special notebook and make sure that everyone knows what they are. An example of standards might be related to things like how to keep sensitive information secure or how to deal with potential threats to the company's computer systems. By having clear standards in place, it helps to ensure that everyone in the company or organization is following the same rules and working towards the same goals.

3. Risk Assessment Mgmt - is the process of identifying and evaluating potential risks to a company or organization, and then taking steps to mitigate or eliminate those risks. Imagine that you have a club and you want to make sure that everyone is safe and that the club stays safe too. One way to do this is to think about all of the things that could go wrong and make a plan to deal with them. Having a panic/assistance alarm installed at places where staffs couldn't be present as a measure to alert centre of any potential issues or ensuring proper visibility of Fire Safety Signs to ensure the club is prepared to evaluate are examples.

4. Incident management and investigation - is a way to deal with unexpected events or problems that happen in a company or organization. Imagine that something unexpected happens at your club, like someone gets hurt or something gets broken. When this happens, it's important to figure out what happened and how to fix it so that it doesn't happen again. In this case, if something unexpected happens, we need to find out what happened and how to prevent it from happening again. This might involve things like talking to people who were there, looking at records or video footage, or running tests to figure out what went wrong. By doing all of these things, we can help make sure that the club is safe and secure.

5. Training and awareness - is the process of teaching people about how to stay safe and secure in a company or organization. Imagine that you have a club and you want to make sure that everyone knows what to do in an emergency. You might have a special meeting where you talk about things like what to do if there's a fire or if someone gets hurt. In this case, we might have special meetings or training sessions to teach people about things like how to keep their passwords secure or how to recognize potential threats to the company's computer systems. By teaching people about these things, we can help make sure that everyone in the company or organization is aware of how to stay safe and secure.

GRC also looks into Policy Management, Compliance Mgmt and audit management

The GRC are responsible to formulate and manage the Do's and Don't for an organization. By following these rules, we can help make sure that the company or organization is secure and stays safe.