What Is GRC?
Governance, Risk and Compliance
GRC sounds like something only big companies need. For a small business it comes down to three plain questions, and most of the answers are within easy reach.
- A jargon-free guide
- Written for SMBs
- Honest about scope
Who decides? What could hurt us? Which rules apply, and can we prove it?
The GRC staircase for small businesses
Delivered by our team
Achieved through CyberCert
Businesses supported
Three ideas behind every standard
GRC stands for governance, risk and compliance. Consultants can make it sound complicated, but every standard, framework and certification is built on the same three ideas.
For a small business, governance might be a written acceptable use policy and a regular access check. Risk might be a short risk register and an honest look at your controls, using the ASD Essentials as a guide. Compliance might be SMB1001 certification and knowing your Privacy Act obligations.
Governance
Who is responsible for what, and how decisions are made and recorded.
Risk
What could hurt the business, and what you are doing about it.
Compliance
Which rules apply, and whether you can prove you follow them.
Together
Knowing who owns security, what matters and how to prove it.
The GRC staircase for Australian SMBs
Businesses move through four broad stages over years. For most small businesses, the honest advice is to get stages one and two right first.
Foundations
The basics done well: multi-factor authentication everywhere, core policies, tested backups, staff who can spot phishing and an incident response plan. Many businesses are partly here already.
Formalised posture
SMB1001 certification, an Essential Eight maturity level if you still report against it, regular access reviews, accurate insurance answers and basic supplier checks. Now you can prove your security to others.
Mature programme
A risk register reviewed by leadership, ISO 27001 alignment, an outsourced CISO and board reporting. Typical past 100 staff or in regulated industries.
Enterprise grade
Full ISO 27001 certification, GRC platforms, internal audit and formal assurance programmes. Specialist territory for GRC and audit firms.
We build the foundations and hand off when it is time
We deliver stages one and two. For stages three and four, we refer clients to trusted Australian GRC specialists.
What we deliver
- Technical security controls, set up and monitored
- Policies in clear, everyday language, including AI use
- Essential Eight maturity assessments, if you still report against it
- SMB1001 certification at Bronze, Silver and Gold
- Cyber insurance readiness and evidence
- Business continuity and incident response plans
What we refer on
- ISO 27001 certification projects
- An outsourced chief information security officer (CISO)
- Enterprise risk management
- Formal GRC programmes and platforms
If you’re a 25-person business, you almost certainly don’t need ISO 27001. We’ll tell you honestly which side of the line you’re on.
Not sure which stage you are at?
A free cyber security assessment shows where you sit today and what to focus on next. Free, with no obligation.
What good enough looks like for a 20-person business
A 20-person accounting firm, medical practice or builder doesn’t need a GRC platform. It needs a short list of things done properly and written down.
- Multi-factor authentication on every account
- Admin rights removed from everyday accounts
- Devices patched and monitored, with EDR
- Backups monitored and test-restored
- Core policies that staff have read
- An incident response plan with names and numbers
- Awareness training and phishing simulations
- A quarterly check of who has access to what
- SMB1001 certification if clients or insurers ask
One director owns GRC. They don’t do the technical work, but they approve policies, decide which risks to accept and check progress a few times a year.
We run the foundations in our own business
SEQ IT achieved SMB1001 Gold through CyberCert. That is stage two on the staircase, and the same work we do for clients.
SMB1001 Gold
Partner
Partner and Cloud Solution Provider (CSP)
Google Cloud Partner
When you have outgrown stages one and two
Move beyond the foundations when something specific changes, such as:
- A government tender requires ISO 27001 or similar
- You are entering the defence supply chain
- You handle health or financial records at scale
- A major client or insurer asks specifically for ISO 27001
- You are going through a sale, merger or due diligence
- Your board wants a formal programme after an incident
- You have grown past about 100 staff or several sites
If none of these apply, stages one and two are the right focus for now.
GRC: common questions
What does GRC stand for?
Governance, risk and compliance. Governance is who is responsible for what and how decisions are made. Risk is what could hurt the business and what you’re doing about it. Compliance is which rules apply and whether you can prove you follow them.
Does a small business need GRC?
Yes, though not in the enterprise sense. For a small business, GRC usually means a handful of policies, the right technical controls, tested backups and evidence you can show an insurer or client when they ask.
What is the difference between GRC and cyber security?
Cyber security is the controls that protect your systems, such as multi-factor authentication, EDR and backups. GRC is the layer around them: who owns security decisions, which risks you accept and how you prove the controls work.
Where should a small business start with GRC?
Start with the foundations: multi-factor authentication, core policies, tested backups, staff training and an incident response plan. Then use SMB1001 or the ASD Essentials to give that work structure. A free assessment is an easy first step.
Do we need ISO 27001?
Probably not yet. ISO 27001 suits larger organisations and businesses tendering for work that requires it. Many small businesses are better served by SMB1001, using the ASD Essentials as a guide. If you do need it, we refer you to trusted Australian GRC specialists.
How often should we review our GRC?
Review policies and risks at least once a year and after any big change, such as a new system or an incident. Check who has access every quarter. SMB1001 renewal builds a yearly review into your calendar.
Where to go from here
Governance and compliance
What we deliver across policies, standards and evidence.
SMB1001 certification
The practical certification for small businesses.
Essential Eight
The ASD Essentials, and where the Essential Eight fits now.
Business continuity planning
Plan for the day something goes wrong.
Free cyber security assessment
See where your business sits today.
Not sure where to start?
Tell us what’s prompting the question. We’ll tell you which stage you’re at and what’s worth doing next, even if that’s nothing yet.
- Which stage your business is at
- The next few things worth doing
- Whether you need a specialist, and when
Prefer to talk? Call 1300 619 750, Monday to Friday.
Tell us what you need and we’ll get back to you.