Cybersecurity area
GRC
GRC connects governance, risk management, compliance, security policies, audits, evidence, and reporting into one manageable framework.
Acronym Glossary
This glossary explains acronyms used in this part so the intended security function is clear.
- GRC
- Governance, Risk and ComplianceThe connection of governance, risk, policies, controls, compliance, and auditable evidence.
What This Area Covers
GRC connects governance, risk management, and compliance into a manageable system. It is not only documents and audit spreadsheets, but the ability to connect risks, policies, controls, evidence, ownership, suppliers, and reporting across the organization.
Why It Matters
Regulations such as NIS2, DORA, ISO 27001, GDPR, and internal security frameworks require organizations to prove not only that controls exist, but that they work. GRC technologies reduce manual effort, keep policies consistent, manage supplier risks, and prepare understandable reports for leadership, risk owners, and auditors.
How To Navigate This Area
GRC technologies help turn regulatory and audit requirements into continuous risk management. The important capability is to map controls to technical evidence, automate evidence collection, and maintain a consistent view of risk across the organization. With NIS2, DORA, GDPR, and ISO 27001, ownership of risk, third-party risk, and auditability of decisions become increasingly important.
When selecting a GRC solution, the organization should decide whether it mainly needs risk assessment, compliance automation, policy management, audit reporting, or third-party risk. Some tools are suitable for simple registers, while others support complex workflows, control-to-evidence mapping, automated evidence collection, and tracking of remediation actions.
The technology list below works as a map of the GRC area. The practical sequence is to name the security problem first, select the closest technology category second, and only then compare relevant vendors. This helps separate similar-sounding solutions and reduces the risk of adding another tool without a clear architectural role.
Technical Section Schema
Questions To Ask When Selecting A Solution
- Which regulations, standards, or internal frameworks must the organization meet?
- Is evidence collected manually or automatically from technical tools?
- Is the bigger issue reporting, policy management, or third-party risk?
- How will exceptions, remediation actions, and risk owner accountability be tracked?
- Who owns risks and controls in different parts of the organization?
How To Use This Section
Each technology page expands one category, explains its architectural role, and lists SecTec portfolio vendors related to that area. The section page is therefore the orientation layer, while the detail pages support concrete mapping to solutions.
Vendors From The SecTec Portfolio
Attack coverage and defensive context
MITRE ATT&CK® Enterprise version 19.1 is used as a reference model. The mapping is a SecTec expert interpretation and does not imply endorsement by MITRE.
Practical attack scenarios
- Phishing and identity abuseAn adversary manipulates a user, obtains credentials, or abuses a trusted account to gain access to the environment.
- Public application or API abuseAn adversary exploits a vulnerable web application, API, client-side code, or software component for initial access and execution.
- Cloud and SaaS compromiseAn adversary abuses cloud identities, permissions, configurations, or application integrations to access services and data.
- Lateral movement inside the networkAfter initial access, an adversary discovers systems, accounts, and services and moves toward higher-value assets.
- Ransomware and availability impactAn adversary encrypts or manipulates data, stops services, inhibits recovery, and creates operational impact.
- Supply chain and trusted accessAn adversary abuses a supplier, software dependency, external access path, or trusted relationship to bypass normal controls.
- Attacks on OT and IoT environmentsAn adversary discovers industrial or connected devices, abuses remote access and network services, and threatens operational availability.
- Business Email Compromise and mailbox takeoverAn adversary takes over or impersonates a trusted email identity and abuses communications for fraud, payment diversion, data collection, or further phishing.
- Privilege escalation and persistenceAn adversary expands privileges, creates or modifies accounts and policies, and establishes repeatable access to systems, identities, or cloud environments.
- Defense evasion and control impairmentAn adversary hides activity, removes evidence, disguises code, or weakens security tools, encryption, firewalls, and recovery mechanisms.
- Insider threat and authorized access abuseAn insider or an adversary with a valid account abuses legitimate permissions to discover, copy, manipulate, or transfer sensitive data.
- DDoS and resource exhaustionAn adversary floods a network, application, API, or endpoint and exhausts capacity, connections, or compute resources to reduce service availability.
- Unsafe consumption of third-party APIsAn application trusts data or redirects from a partner API more than ordinary input and propagates a supplier compromise into its own environment.
Relevant ATT&CK techniques
- T1078 · Valid AccountsPrevent, Validate
- T1098 · Account ManipulationValidate
- T1133 · External Remote ServicesPrevent, Validate
- T1195 · Supply Chain CompromisePrevent, Validate
- T1484 · Domain or Tenant Policy ModificationValidate
- T1685 · Disable or Modify ToolsValidate
- T1686 · Disable or Modify System FirewallValidate