IT governance, risk and compliance

In short

IT governance, risk and compliance (GRC) is the management layer of information security: governance decides *who* sets direction and who answers for it, risk management decides *how much* security is enough and where to spend, and compliance proves it to regulators, auditors and customers. It converts technical controls (firewalls, encryption, access control) into measurable, auditable business decisions expressed in rupees, risk scores and recovery times. In Indian universities it is examined as "information security management", "cyber law" and "security audit" units; in GATE CS/DA it appears only lightly, but it is heavily tested in placement interviews for Infosys, TCS, Wipro, Accenture, Deloitte, EY, KPMG, PwC, HCLTech and the bank/BFSI technology teams. Working knowledge of the DPDP Act, 2023, the CERT-In directions of 2022, the RBI and SEBI frameworks and ISO/IEC 27001:2022 is now a hiring filter for security analyst, GRC analyst and IT auditor roles.

Explained

Governance: direction, accountability, structure

• IT governance = ensuring IT delivers value and risk stays within appetite, set by the board; IT management = running IT day to day. Governance *evaluates, directs and monitors* (COBIT's EDM); management *plans, builds, runs and monitors*.
• GRC binds three disciplines: Governance (policy, structure, accountability), Risk (identify, assess, treat), Compliance (legal, regulatory, contractual obligations). Done together it removes duplicate controls and duplicate evidence.
• Roles: Board / Audit Committee (ultimate accountability, under SEBI LODR for listed firms) → CEO → CISO (owns the security programme) → CRO / risk committee (enterprise risk) → asset owners (accept risk for their system) → custodians (operate controls) → internal audit (independent assurance). Security is *owned by the business*, *operated by IT*, *assured by audit*.
• Three lines model: 1st line = operations owning and managing risk; 2nd line = risk and compliance functions setting standards and challenging; 3rd line = internal audit, independent of both, reporting to the audit committee.
• Policy hierarchy: Policy (mandatory, board-approved, "what and why", rarely changes) → Standard (mandatory specifics, e.g. AES-256, TLS 1.3) → Baseline (minimum configuration per platform) → Procedure (step-by-step) → Guideline (recommended, optional). Students must not swap these in exams.
• Supporting mechanisms: AUP (acceptable use), exception/waiver process with expiry and compensating control, segregation of duties (SoD), least privilege, RACI matrices, annual policy review, security awareness training, KPIs/KRIs reported to the board.
• COBIT 2019 (ISACA) is the main IT-governance framework: a governance system built from 40 objectives — 5 governance objectives (EDM) plus 35 management objectives in four domains APO (Align, Plan, Organise), BAI (Build, Acquire, Implement), DSS (Deliver, Service, Support), MEA (Monitor, Evaluate, Assess). Tailored using design factors (enterprise strategy, risk profile, threat landscape, compliance needs) and measured by capability levels 0–5.
• Maturity models: CMMI-style levels — 1 Initial, 2 Managed, 3 Defined, 4 Quantitatively managed, 5 Optimising. Used to show year-on-year programme improvement.

Risk management: the full cycle

• Definitions: Asset (anything of value); threat (potential cause of harm); threat actor; vulnerability (weakness a threat can exploit); exposure; impact (consequence); likelihood; risk = likelihood × impact; inherent risk (before controls); residual risk (after controls); risk appetite (how much risk the board will take) vs risk tolerance (acceptable variation per risk) vs risk capacity (maximum survivable).
• ISO 31000:2018 process: establish scope/context/criteria → risk identification → analysis → evaluation → treatment → monitoring and review, with communication/consultation and recording throughout. ISO/IEC 27005 applies it to information security.
• Steps of an information-security risk assessment:
• Define scope and build an asset inventory with owners and data classification (Public / Internal / Confidential / Restricted).
• Identify threats and vulnerabilities per asset (threat intelligence, VA/PT reports, audit findings, incident history).
• Assess impact on confidentiality, integrity, availability (plus privacy and regulatory penalty).
• Assess likelihood from frequency data or expert judgement.
• Compute inherent risk, map on a risk matrix (commonly 5 × 5).
• Assess existing control effectiveness → residual risk.
• Choose treatment, assign owner and date, record in the risk register.
• Monitor via KRIs, re-assess at least annually or on major change.
• Qualitative assessment uses scales (Low/Medium/High) — fast, subjective, good for breadth. Quantitative uses money (SLE, ALE) — defensible for budget cases, but needs data. Semi-quantitative maps scales to rupee bands and is what most Indian enterprises actually use. FAIR is a quantitative model expressing risk as loss event frequency × loss magnitude, often as a distribution rather than a single number.
• Four treatment options (ISO 31000 wording in brackets): Avoid/terminate (stop the activity), Mitigate/modify (add controls), Transfer/share (cyber insurance, outsourcing, contract indemnity — note liability for personal data cannot be fully transferred), Accept/retain (formal sign-off by the risk owner, with an expiry date). Ignoring a risk is not acceptance.
• Control classification: by *function* — preventive, detective, corrective, deterrent, recovery, compensating; by *nature* — administrative/managerial, technical/logical, physical. Defence in depth layers them.
• Risk register fields: ID, description, asset, threat, owner, inherent score, existing controls, residual score, treatment, target date, status, KRI, review date.
• Third-party/vendor risk: due diligence before onboarding, right-to-audit clause, SLA and security schedule, SOC 2 Type II or ISO 27001 certificate review, breach-notification clause, exit/data-return plan, and for banks the RBI outsourcing requirements. Supply-chain risk (SBOM, dependency scanning) is the fastest-growing category.
• Business continuity and disaster recovery: BIA determines criticality and sets MTD/MTPD (maximum tolerable downtime), RTO (how fast a service must be back) and RPO (how much data loss is tolerable); then strategy (hot/warm/cold site, cloud DR), BCP/DRP documents, and testing (checklist → walkthrough/tabletop → simulation → parallel → full interruption). Standard: ISO 22301. Recovery sequence and call tree are examinable.

Frameworks and standards

• ISO/IEC 27001:2022 — the certifiable ISMS standard. Mandatory clauses 4 Context, 5 Leadership, 6 Planning, 7 Support, 8 Operation, 9 Performance evaluation, 10 Improvement, built on PDCA. Requires: ISMS scope, information security policy, risk assessment and treatment methodology, Statement of Applicability (SoA), risk treatment plan, objectives, internal audit, management review, corrective action.
• Annex A of ISO/IEC 27001:2022 has 93 controls in 4 themes — Organizational (37), People (8), Physical (14), Technological (34) — restructured from the 114/14-domain layout of the 2013 edition. ISO/IEC 27002:2022 gives implementation guidance; ISO/IEC 27017 cloud, 27018 cloud PII, 27701 privacy (PIMS), 27035 incident management, 27031 ICT continuity.
• NIST CSF 2.0 (February 2024): six functions — Govern, Identify, Protect, Detect, Respond, Recover ("Govern" was added in 2.0) — with Categories, Subcategories, Tiers and Profiles. NIST SP 800-37 Risk Management Framework: Prepare → Categorise → Select → Implement → Assess → Authorise → Monitor; SP 800-53 control catalogue; SP 800-30 risk assessment.
• CIS Critical Security Controls v8: 18 controls in Implementation Groups IG1–IG3 — the most practical starting list for a small Indian firm.
• PCI DSS v4.0 / v4.0.1: 12 requirements across 6 goals, mandatory for card data; SAQ for small merchants, QSA/ROC audit for large ones; future-dated requirements became effective 31 March 2025. Driven by contract with card networks, not by Indian statute.
• SOC 1 / SOC 2 (AICPA): SOC 1 covers financial-reporting controls (ISAE 3402 equivalent); SOC 2 covers the Trust Services Criteria — Security, Availability, Processing Integrity, Confidentiality, Privacy. Type I = design at a point in time; Type II = design *and* operating effectiveness over 6–12 months. Indian IT services firms produce these for US clients.
• Comparison: ISO 27001 = certifiable management system; COBIT = governance and IT process coverage; NIST CSF = voluntary risk-outcome framework; CIS = prescriptive technical controls; PCI DSS = mandatory prescriptive standard for one data type.

Indian law, regulators and compliance

• Information Technology Act, 2000 (amended 2008): s.43 damage to computer resources, s.43A compensation for failure to protect sensitive personal data with reasonable security practices, s.65/66/66C/66D offences and identity/computer fraud, s.69 interception and decryption, s.70A NCIIPC for critical information infrastructure, s.70B CERT-In, s.72A punishment for disclosure of information in breach of lawful contract, s.79 intermediary safe harbour (conditioned by the IT Rules, 2021), s.43/s.43A compensation claims go before the Adjudicating Officer, with appeal to TDSAT, while s.72A is a criminal offence (up to 3 years' imprisonment and/or ₹5 lakh fine) tried by a court. The SPDI Rules, 2011 define sensitive personal data and name ISO/IEC 27001 as an accepted "reasonable security practice"; they continue to operate until the DPDP framework fully displaces them (the DPDP Act omits s.43A on commencement of that provision, 13 May 2027).
• Digital Personal Data Protection Act, 2023: applies to digital personal data; roles are Data Fiduciary, Data Processor, Data Principal, Consent Manager, Significant Data Fiduciary (extra duties: DPIA, independent data audit, India-resident Data Protection Officer). Obligations: lawful purpose and consent (or "legitimate uses"), notice, accuracy, reasonable security safeguards, erasure when purpose is served, breach notification to the Data Protection Board of India and to affected principals. Penalties in the Schedule go up to ₹250 crore for failure of security safeguards and ₹200 crore for failure to notify a breach; ₹50 crore residual. The DPDP Rules were notified on 13 November 2025 with phased commencement: these obligations and the penalties apply from 13 May 2027 (Consent Manager registration from 13 November 2026).
• CERT-In Directions of 28 April 2022 (under s.70B(6)): report listed cyber incidents within 6 hours of noticing; maintain ICT logs for 180 days within Indian jurisdiction and produce them on demand; synchronise system clocks to NIC/NPL NTP; data centres, VPS/VPN and cloud providers to keep subscriber records for 5 years after de-registration; virtual-asset providers to keep KYC and transaction records 5 years.
• RBI: Master Direction on Information Technology Governance, Risk, Controls and Assurance Practices (November 2023, effective 1 April 2024) — board-level IT Strategy Committee, IT Steering Committee, Head of IT, CISO, information-security committee, IS audit; Master Direction on Outsourcing of IT Services (2023); cyber-incident reporting to RBI within 6 hours; cyber security framework for banks (2016) and its baseline/advanced controls; separate directions for UCBs, NBFCs and payment system operators; storage of payment system data in India (2018 circular).
• SEBI: Cybersecurity and Cyber Resilience Framework (CSCRF, 2024) consolidates earlier circulars for all regulated entities, with graded obligations (MII / Qualified / Mid / Small / Self-certification), SOC coverage, VAPT and cyber audits.
• Others: IRDAI information and cyber security guidelines for insurers; Telecommunications Act, 2023 with the Telecom Cyber Security Rules, 2024; NCIIPC for power, banking, telecom, transport, defence and strategic sectors; CEA cyber-security guidelines for the power sector; Companies Act, 2013 — directors' responsibility for internal financial controls and the auditor's reporting on IFC adequacy, which pulls IT general controls (access, change, operations) into statutory audit; IS 17428 (Data Privacy Assurance) — Part 1 requirements, Part 2 guidelines — the Indian privacy-management standard; STQC and CERT-In empanelled auditors perform the audits regulators ask for.
• Cross-border: GDPR (EU) with 72-hour breach notification and fines up to the higher of €20 million or 4% of global turnover; HIPAA (US health data); SOX s.302/404 for US-listed groups — all commonly in scope for Indian IT services clients.

Audit, assurance and evidence

• Audit types: internal (first/second line reviews and internal audit), external/statutory, certification audit by an accredited body (Stage 1 documentation, Stage 2 implementation, then annual surveillance and 3-yearly recertification), regulatory audit, vendor audit, and self-assessment.
• Audit process: scoping and audit plan → risk-based test selection → evidence gathering (inspection, observation, enquiry, re-performance, CAATs, sampling) → finding with criteria/condition/cause/effect → rating (major/minor nonconformity, observation) → management response and CAPA → closure and follow-up.
• Evidence must be sufficient, reliable, relevant and timely; a screenshot without date, system and scope is weak evidence. Auditors favour system-generated, population-complete evidence.
• Key control concepts tested: SoD (the maker, checker and approver must differ; developers must not deploy to production), compensating control (meets the intent when the stated control is infeasible — must be documented and approved), control testing of design vs operating effectiveness, ITGC (access management, change management, IT operations, SDLC), user access review and privileged-access recertification.
• Metrics: % assets with owner, patch SLA compliance, % closed audit findings, mean time to detect/respond, training completion %, open high risks beyond due date — these are the KRIs/KPIs a GRC analyst reports monthly.
• Careers and certifications: CISA (audit), CRISC (risk), CISM (management), CISSP, ISO 27001 Lead Implementer/Lead Auditor, DCPLA/privacy certifications; GRC platforms used in India include MetricStream, Archer, ServiceNow IRM, SAP GRC and OneTrust.

Key points

• GRC - governance sets direction and accountability, risk decides spend, compliance proves it externally.
• Governance vs management - governance evaluates, directs and monitors; management plans, builds, runs and monitors.
• Three lines model - operations own risk, risk/compliance challenge, internal audit assures independently.
• Policy > standard > baseline > procedure > guideline - only the first three (plus procedures) are mandatory; guidelines are advisory.
• Risk = likelihood × impact; inherent risk is before controls, residual risk after, and residual risk must sit inside the board's risk appetite.
• Four treatments - avoid, mitigate, transfer, accept; acceptance needs a named owner, a reason and an expiry date.
• SLE = AV × EF; ALE = SLE × ARO - the quantitative core of any security business case.
• ISO/IEC 27001:2022 - certifiable ISMS, clauses 4-10, PDCA, 93 Annex A controls in 4 themes, with a Statement of Applicability justifying inclusions and exclusions.
• NIST CSF 2.0 - six functions: Govern, Identify, Protect, Detect, Respond, Recover.
• COBIT 2019 - 40 objectives: 5 governance (EDM) + 35 management (APO, BAI, DSS, MEA), capability levels 0-5.
• BIA outputs RTO, RPO and MTD; RTO is time to restore service, RPO is tolerable data loss, and backup frequency sets the RPO floor.
• CERT-In 2022 directions - 6-hour incident reporting, 180-day Indian-jurisdiction logs, 5-year subscriber records for VPN/cloud/data-centre providers.
• DPDP Act, 2023 - consent, purpose limitation, security safeguards, breach notification to the Data Protection Board; penalties to ₹250 crore; Rules notified November 2025 and phased in.
• IT Act s.43A + SPDI Rules, 2011 - compensation for failing "reasonable security practices", with ISO 27001 named as an accepted practice.
• RBI Master Direction on IT Governance (effective 1 April 2024) - board IT strategy committee, CISO, IS audit for regulated entities; SEBI CSCRF (2024) for market intermediaries.
• SOC 2 Type II proves controls operated over a period; Type I only that they were designed at a point in time.
• Compliance is not security - a certificate proves scoped controls at audit time, not continuous protection.
• Control types - preventive, detective, corrective, deterrent, recovery, compensating; administrative, technical, physical.

Formulas and examples

Example 1 — SLE, ALE and ROSI for a ransomware control. A manufacturer's ERP is valued at ₹2,00,00,000; a ransomware event is estimated to destroy 20% of that value (EF = 0.20). The firm has suffered 3 serious events in the last 5 years.

• ARO = 3 ÷ 5 = 0.6 /year
• SLE = 2,00,00,000 × 0.20 = ₹40,00,000
• ALE(before) = 40,00,000 × 0.6 = ₹24,00,000 /year
• An EDR + immutable-backup programme costs ₹8,00,000 /year and is expected to cut ARO to 0.15: ALE(after) = 40,00,000 × 0.15 = ₹6,00,000
• ALE saved = 24,00,000 − 6,00,000 = ₹18,00,000; net benefit = 18,00,000 − 8,00,000 = ₹10,00,000
• ROSI = 10,00,000 ÷ 8,00,000 = 125% → approve. (Residual risk ₹6,00,000/year is then accepted or insured.)

Example 2 — ranking three treatments against a ₹30 lakh budget.

Spend = ₹12,00,000 of ₹30,00,000; ALE falls from ₹33,00,000 to ₹14,20,000. Highest ROSI, not highest ALE, is funded first; the DLP suite is uneconomic as scoped, so the risk is retained with a documented acceptance or partly insured.

Example 3 — inherent vs residual risk on a 5 × 5 matrix. An unpatched internet-facing portal: Likelihood 4 (Likely), Impact 5 (Severe — personal data of 2 lakh customers).

• Inherent = 4 × 5 = 20 → Extreme (board-level, immediate action)
• A WAF plus a 15-day patch SLA cuts likelihood to 2: residual = 2 × 5 = 10 → High — still above a target of ≤ 6.
• Adding tokenisation and data minimisation cuts impact to 3: residual = 2 × 3 = 6 → Moderate, now inside appetite. Note impact was reduced by changing the *data*, not the perimeter — the lesson examiners look for.

Example 4 — BIA: RTO, RPO and MTD. An e-commerce order service earns ₹1.2 crore/day spread evenly over 24 h.

• Loss per hour = 1,20,00,000 ÷ 24 = ₹5,00,000 /h
• The board tolerates at most ₹20,00,000 of loss from one outage → MTD = 20,00,000 ÷ 5,00,000 = 4 h
• With WRT (reconciliation, backlog clearing) of 1 h, RTO = 4 − 1 = 3 h
• Hourly backups give RPO = 1 h → up to ₹5,00,000 of unrecorded orders; 15-minute log shipping cuts RPO to 0.25 h → about ₹1,25,000. The DR design must beat both RTO 3 h and RPO 15 min.

Example 5 — availability SLA arithmetic. 8,760 h in a year.

Moving from 99.9% to 99.99% avoids about ₹39,42,000 of expected downtime loss a year; if active-active DR costs more than that, 99.9% plus a credible DR plan is the rational choice.

Where it is used

• IT services and consulting (TCS, Infosys, Wipro, Accenture, Deloitte, EY, KPMG, PwC): GRC analyst, IT auditor and ISO 27001/SOC 2 readiness roles — the largest single employer pool for this skill in India.
• Banking, NBFC and payments (HDFC, ICICI, SBI, Paytm, Razorpay, PhonePe): RBI IT Governance and cyber-security framework compliance, IS audit, payment data localisation, PCI DSS for card data, 6-hour incident reporting.
• Capital markets (NSE, BSE, CDSL, brokers, AMCs): SEBI CSCRF implementation, VAPT cycles, cyber audits and SOC coverage reporting.
• Product and SaaS companies: SOC 2 Type II and ISO 27001 certificates as a sales prerequisite, vendor security questionnaires, DPDP readiness and data-processing agreements.
• Healthcare, insurance and telecom: IRDAI and telecom cyber-security rules, ABDM/health-data handling, IS 17428 privacy assurance.
• Critical infrastructure and government: NCIIPC-protected systems in power, transport and defence; STQC and CERT-In empanelled audits before go-live of government applications.

Interview questions

• Q: What is the difference between IT governance and IT management? A: Governance is the board's job of evaluating, directing and monitoring — setting objectives, appetite and accountability; management executes within that direction by planning, building and running IT.
• Q: Define inherent, residual and accepted risk. A: Inherent risk is the exposure before controls, residual is what remains after existing controls work as designed, and accepted risk is residual risk a named owner has formally agreed to retain, usually with a review date.
• Q: Calculate ALE for an asset worth ₹50 lakh, exposure factor 0.4, with the event expected once in 4 years. A: SLE = 50,00,000 × 0.4 = ₹20,00,000; ARO = 0.25; ALE = ₹5,00,000 per year.
• Q: Would you spend ₹7 lakh a year on a control that removes an ALE of ₹5 lakh? A: Not on the numbers — ROSI is negative; but I would still recommend it if it is a legal or contractual mandate, or if the quantitative model understates tail loss such as a DPDP penalty or licence risk.
• Q: What are the four risk treatment options, with an example of each? A: Avoid (retire the legacy app), mitigate (add MFA), transfer (cyber insurance or outsourcing with indemnity), accept (retain a low residual risk with sign-off).
• Q: What changed in ISO/IEC 27001:2022 from the 2013 version? A: Annex A was restructured into 93 controls under four themes — organizational, people, physical, technological — replacing 114 controls in 14 domains, with 11 new controls such as threat intelligence, cloud security, data masking and secure coding; the management-system clauses 4-10 are largely unchanged.
• Q: What is a Statement of Applicability and why does the auditor ask for it first? A: It lists every Annex A control, whether it is applicable, its justification and implementation status — it defines the scope of the certification audit and links the risk assessment to the controls.
• Q: Explain RTO versus RPO. A: RTO is the maximum acceptable time to restore a service after disruption; RPO is the maximum acceptable data loss measured in time, which is driven by backup or replication frequency.
• Q: Under the CERT-In directions of 2022, how quickly must a cyber incident be reported and how long are logs kept? A: Within 6 hours of noticing or being notified of a listed incident, and ICT logs must be maintained for 180 days within Indian jurisdiction.
• Q: Which Indian law and rules currently govern personal data security? A: The Digital Personal Data Protection Act, 2023 with its Rules notified in November 2025 and phased in, alongside IT Act s.43A/s.72A and the SPDI Rules, 2011, which continue to apply until fully displaced by the DPDP framework.
• Q: Is an ISO 27001-certified company secure? A: No — certification proves a management system covering a defined scope met the standard at audit time; risks outside scope, new threats and day-to-day control failures are not covered, which is why continuous monitoring and audits are needed.
• Q: Why does segregation of duties matter if we already have logging? A: Logging is detective and after the fact; SoD is preventive, stopping one person from both initiating and approving an action — logs help you investigate a fraud that SoD would have prevented.
• Q: Where do you record a risk whose owner refuses to fund the fix? A: In the risk register as a formally accepted risk with the owner's name, justification, compensating controls and a review date, and escalate it in the risk report to the risk committee — never silently close it.

Common mistakes

• Confusing policy, standard, procedure and guideline, or calling a guideline mandatory in an exam answer.
• Mixing up threat and vulnerability, or treating any one of asset/threat/vulnerability as "the risk".
• Multiplying ALE by ARO again (ALE is already annualised) or forgetting that EF is a fraction, not a rupee figure.
• Swapping RTO and RPO, and forgetting that backup interval sets the RPO floor.
• Quoting the old ISO 27001:2013 figures (114 controls, 14 domains) or the five-function NIST CSF 1.1 instead of the six functions of CSF 2.0.
• Saying "we are compliant, so we are secure", or reporting a certificate instead of residual risk to management.
• Treating risk transfer as risk elimination — insurance pays some loss but does not remove regulatory liability for personal data under the DPDP Act.
• Omitting the Indian legal layer in interviews: CERT-In's 6-hour clock, DPDP penalties and the RBI/SEBI frameworks are the differentiators that get candidates selected.

Related topics

Information security fundamentals · Security operations: SOC and SIEM · Identity and access management · Cloud security · Ethical hacking and penetration testing · Digital forensics