GRC (governance, risk and compliance)

GRC stands for governance, risk and compliance. Governance is how an organisation sets security direction, roles and policies. Risk management is identifying what could go wrong, how likely and how harmful it is, and deciding what to do about it. Compliance is showing that the organisation meets laws, regulations, contracts and standards, such as ISO 27001, SOC 2, PCI DSS for payment cards, or privacy laws like GDPR. GRC specialists write policies, run risk assessments, review suppliers, prepare for audits, and explain security in business terms to leaders. It is a strong entry path for people with backgrounds in law, auditing, project management, or business, and strong writing skills are valuable.