GRCOPILOT Insights

Insights, guidance and product updates on cybersecurity, GRC and compliance.

Segregation of duties: the control small teams think they cannot have
GRC Fundamentals

Segregation of duties: the control small teams think they cannot have

No single person should be able to complete a sensitive process end to end unchecked. The combinations that matter, why "we are too small" is not an answer, and the compensating controls that work.
Security maturity models: why "implemented" is only halfway
GRC Fundamentals

Security maturity models: why "implemented" is only halfway

Maturity scoring appears in SAMA CSF, HITRUST and many internal programmes. What the levels mean, why most organisations plateau at the middle, and how to climb without inventing bureaucracy.
How to run a gap analysis that produces a real plan
GRC Fundamentals

How to run a gap analysis that produces a real plan

A gap analysis is the first thing you do for any framework and the input to every budget conversation. How to scope it, score honestly, avoid the optimism trap, and turn output into a sequenced plan.
The four risk treatment options, and when each is the right answer
GRC Fundamentals

The four risk treatment options, and when each is the right answer

Mitigate, transfer, avoid, accept. Three of them are used properly; one is used as a synonym for doing nothing. How to choose, document and evidence each - including what insurance actually transfers.
The Statement of Applicability: the document auditors read first
GRC Fundamentals

The Statement of Applicability: the document auditors read first

The SoA records which controls apply, why, and their status. It is the bridge between your risk assessment and your control set - and the single most scrutinised artefact in an ISO 27001 audit.
Running an internal audit programme that is worth doing
Audit

Running an internal audit programme that is worth doing

Internal audit is mandatory for ISO 27001 and valuable everywhere else - but only if it is independent and finds things. How to plan, staff, conduct and evidence it, including when you are small.
Correction vs corrective action: closing findings so they stay closed
Audit

Correction vs corrective action: closing findings so they stay closed

Fixing the instance an auditor found is a correction. Fixing why it happened is corrective action. Confusing the two is why the same finding returns every cycle - and why auditors check.
The management review: the meeting that certifies your ISMS
Audit

The management review: the meeting that certifies your ISMS

A mandatory ISO 27001 clause that most organisations treat as a formality - and then fail on. What inputs are required, what outputs must be recorded, and how to run one that is genuinely useful.
Security KPIs vs KRIs: measuring performance and measuring danger
GRC Fundamentals

Security KPIs vs KRIs: measuring performance and measuring danger

A KPI tells you how well something is running. A KRI warns you that risk is rising. Why the distinction matters, which metrics are worth reporting, and why measurement is what unlocks maturity scoring.
How to scope a compliance programme (the decision that costs the most)
GRC Fundamentals

How to scope a compliance programme (the decision that costs the most)

Scope determines effort, cost, audit duration and whether you pass. How to draw a boundary that is defensible, what belongs inside it, and why the smallest honest scope usually wins.
Compliance is not security - but it is not the enemy either
GRC Fundamentals

Compliance is not security - but it is not the enemy either

Compliant organisations get breached and secure organisations fail audits. Why the two diverge, where each is genuinely useful, and how to run a programme that delivers both from the same work.
Types of security controls, and why auditors test them differently
GRC Fundamentals

Types of security controls, and why auditors test them differently

Preventive, detective and corrective. Administrative, technical and physical. Design versus operating effectiveness. What each distinction means in practice and how it changes the evidence you need.
© 2026 GRCOPILOT