Research Library
GRC: governance, risk & compliance
Connect accountable decisions, risk, obligations, and evidence.
Three connected questions
Governance, risk, and compliance (GRC) connects organizational decisions with uncertainty and obligations. Its scope can include cybersecurity, privacy, physical security, suppliers, and business operations.
- Governance: who decides and who is accountable?
- Set direction, assign responsibilities, establish policies, and decide how risks and performance will be reviewed.
- Risk: what could affect our objectives?
- Understand important information and activities, consider what could go wrong, prioritize actions, and review whether those actions work.
- Compliance: which obligations apply?
- Identify relevant laws, regulations, contracts, and internal policies. Connect them to actual working practices and evidence.
Begin with the work, then organize the evidence
A useful starting point is to define the scope, identify obligations and their sources, assign owners, and keep a record of decisions and operating evidence. For example, an access policy needs an accountable owner, a reason for its restrictions, a working review process, and records showing what happened.
Documents and templates can help organize that work. They need to reflect the organization’s actual systems and practices. A completed checklist alone does not show how a control operates.
Frameworks and official sources
- NIST Cybersecurity Framework (opens in a new tab) — outcomes for understanding and communicating cybersecurity risk, including governance.
- NIST Risk Management Framework (opens in a new tab) — a process for managing security and privacy risk through a system’s life cycle.
- CISA Cross-Sector Cybersecurity Performance Goals (opens in a new tab) — voluntary practices for prioritizing important cybersecurity improvements.
- Defense CIO: official CMMC program information (opens in a new tab) — program scope, current implementation updates, and assessment information.
- The Cyber AB (opens in a new tab) — the CMMC accreditation ecosystem and its role in assessment oversight.
CMMC as one example
The U.S. defense CMMC program concerns protection of Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) in the defense supply chain. It illustrates questions about scope, ownership, requirements, and evidence; organizational GRC extends beyond CMMC.
Check current official program material and the applicable contract when determining requirements. An educational map, sample template, or crosswalk helps you investigate relationships; it is not an official interpretation, a certification decision, or proof that two requirements are interchangeable.
CMMC resources connected with Bill’s work
These are independent learning and project resources, with official sources linked alongside them.
CMMC Brain resource hub (opens in a new tab)
Explore CMMC basics (opens in a new tab), a readiness roadmap (opens in a new tab), evidence and ownership (opens in a new tab), and the official-reference directory (opens in a new tab).
Interactive CMMC Brain (opens in a new tab)
Bill’s connected resource for exploring compliance relationships and sample material. The interactive viewer requires JavaScript. Verify a source’s scope and revision before applying what you find.
Bill Weber’s CMMC project page (opens in a new tab)
Personal and professional context for his CMMC work and the development of CMMC Brain. Professional-service offers on linked sites are separate from this SecSIG learning library.
For another perspective on connected research, see Knowledge management. The Risk & infrastructure topic provides a shorter reference starting point.
Sources and links reviewed October 24, 2026. External publishers maintain their own material.