GRCOPILOT Insights

Insights, guidance and product updates on cybersecurity, GRC and compliance.

Policy vs standard vs procedure vs guideline
GRC Fundamentals

Policy vs standard vs procedure vs guideline

Four document types, constantly conflated. What each is for, why the distinction affects how often you get audit findings, and how to structure a document set that stays maintainable.
Risk appetite vs risk tolerance: making the difference useful
GRC Fundamentals

Risk appetite vs risk tolerance: making the difference useful

Appetite is how much risk you are willing to seek; tolerance is how far you will let a specific risk drift before acting. How to write both so they change decisions rather than decorating a policy.
GDPR vs CCPA/CPRA: opt-in versus opt-out
Comparisons

GDPR vs CCPA/CPRA: opt-in versus opt-out

The GDPR asks permission; California regulates what you must let people refuse. How the two privacy regimes differ in structure, rights and scope - and what a GDPR programme still leaves undone.
The three lines of defence, explained without the jargon
GRC Fundamentals

The three lines of defence, explained without the jargon

The operating model behind most risk and compliance functions: who owns risk, who oversees it, and who independently assures it - plus the failure modes when the lines blur.
DORA vs NIS2: which applies, and what if both?
Comparisons

DORA vs NIS2: which applies, and what if both?

Two EU regimes with overlapping subject matter and different legal machinery. Who each covers, how the reporting clocks differ, and how the lex specialis principle resolves the overlap for financial entities.
ISO 42001 vs the EU AI Act: standard versus law
Comparisons

ISO 42001 vs the EU AI Act: standard versus law

One is a certifiable management system you choose; the other is law that applies whether you like it or not. How they differ, where they align, and why certification does not equal compliance.
Ransomware readiness: the controls that decide the outcome
Security Practices

Ransomware readiness: the controls that decide the outcome

Ransomware outcomes are determined long before the ransom note. The controls that prevent it, the backup properties that survive it, and the decisions to make in advance rather than under pressure.
Logging and monitoring: collecting logs is not the control
Security Practices

Logging and monitoring: collecting logs is not the control

Frameworks do not ask whether you have logs. They ask what you log, how long you keep it, whether it is tamper-resistant, and who reviews it. The last one is where most programmes fail.
How to run a tabletop exercise that finds real problems
Security Practices

How to run a tabletop exercise that finds real problems

A tabletop that everyone passes was a waste of an afternoon. How to design scenarios that expose gaps, who to include, how to inject pressure, and what to record so it counts as audit evidence.
Penetration testing vs vulnerability scanning: what auditors expect
Security Practices

Penetration testing vs vulnerability scanning: what auditors expect

They answer different questions, and substituting one for the other is a common audit finding. How each works, what frameworks actually require, and how to scope a test that produces value rather than a PDF.
Encryption and key management: the part auditors actually probe
Security Practices

Encryption and key management: the part auditors actually probe

Enabling encryption is easy. Managing keys is where programmes fail. What frameworks require, the key lifecycle, who should hold keys, and the questions that expose weak implementations.
EU Cyber Resilience Act: security obligations that ship with the product
EU & UK

EU Cyber Resilience Act: security obligations that ship with the product

The CRA regulates products with digital elements sold in the EU - imposing secure development, vulnerability handling and support-period obligations on manufacturers. What changes, and who is affected.
© 2026 GRCOPILOT