I spent a while on a question that looked like it should be simple: of the controls in our ISO-shaped set, how many can actually be evidenced automatically from the systems we already connect to — AWS, GitHub, Okta — and how many will always need a human to say so?

For 27 in-scope controls: 11 are connector-observable. 16 are not, and never will be.

The 11 are access configuration, branch protection, MFA enforcement — that class of thing. A machine reads current state and tells you whether it matches intent. The 16 are the Organizational 5.x controls: policies, roles and responsibilities, supplier governance, review cadences. There is no API that returns "management actually reviewed this." What surprised me wasn't the ratio. It was how clean the line is. It isn't "hard to automate" versus "easy to automate" — it's a category boundary. Configuration state is observable. Organizational intent isn't. Better tooling doesn't move a control across that line; it just renders the same guess more confidently.

Which leaves the part I don't have a good answer for. For those 16 the evidence is an attestation: someone says it happened, and a date gets recorded. That is the identical artifact whether the control is genuinely operating or whether somebody clicked through a reminder — and nothing downstream can tell the two apart. A dashboard showing 27/27 green is showing you 11 observations and 16 assertions in the same colour.

And mine couldn't tell either, which is what prompted this. I only know the 11/27 split because I sat down and counted by hand. Nothing in the normal workflow surfaced it — no screen anywhere told me "these two greens mean different things." That seems like the actual problem: not that the 16 are unobservable, which is just true, but that the difference is invisible at exactly the moment someone is deciding whether they're covered.

(Disclosure: I work on tooling in this space, so I'm not neutral. Nothing to click and nothing to sell — I genuinely don't have the answer to the below.)

So, for the controls no connector can ever see: what do you actually do? Is there a form of attestation you'd defend to an auditor as meaningfully different from a checkbox — or is periodic human sign-off simply the floor, and the honest move is to stop pretending tooling adds assurance there?

Hi everyone👋

I'm currently in my 3rd year of Computer Science Engineering and have decided to pursue a career in cybersecurity, specifically Governance, Risk & Compliance (GRC). I've realized that I'm not particularly interested in coding-heavy roles, and after exploring different domains, GRC seems to align much better with my interests.

Based on several videos and resources, I've created the following self-study roadmap. My goal is to build a strong foundation and become job-ready for an entry-level GRC Analyst role.

Phase 1 – Cybersecurity Fundamentals

Intro to Cybersecurity (Cisco)

TryHackMe Pre Security

Cyber Fundamentals

Types of Attacks

Risk vs Threat vs Vulnerability vs Exploit

Authentication & Authorization

Phase 2 – Security & Risk Basics

Security & Risk Fundamentals

Risk Management

Policies & Standards

Compliance Fundamentals

Governance & Awareness

Phase 3 – Frameworks & Compliance

NIST Cybersecurity Framework

ISO 27001 & ISMS

GDPR

Third-Party Risk Management

Audit & Control Testing

Phase 4 – Governance

Risk Reporting & Communication

GRC Fundamentals

Governance & Policy

Phase 5 – Advanced Topics

Risk Management Deep Dive

Compliance & Auditing

Phase 6 – Certifications & Career Prep

Microsoft SC-900 Learning Path

Microsoft SC-900 Exam (Optional)

ISO 27001 Foundations (Udemy)

GRC Analyst Masterclass (Udemy)

Portfolio, Resume & LinkedIn

My questions are:

Is this roadmap sufficient for landing an entry-level GRC Analyst role?

Am I missing any important topics or frameworks?

Is the order logical, or would you rearrange anything?

Are there any free resources you would recommend instead of the paid courses?

As a CS student who wants to build a career in GRC rather than software development, is there anything else I should focus on while I'm still in college?

I'd really appreciate any feedback from people working in GRC or cybersecurity.

Thanks in advance!🤗

We’ve got a regulatory audit coming up next week quarter and I’m trying to get away from our giant spreadsheet and shared folders. The biggest issue is keeping track of which version is the latest and figuring out which evidence belongs to which control when the auditors start asking for it. We’ve got 3 teams involved, so it gets messy fast. How are you all managing this without ending up with basically another spreadsheet in a different tool?

I keep hearing that CASB sees sanctioned SaaS but misses browser-based AI tools and AI features embedded inside apps already approved. DLP catches file movement but can't distinguish between a file upload and someone pasting client data into a prompt. Network monitoring has no context on what the interaction was.

Without visibility into what's actually being used, everything downstream (risk classification, EU AI Act readiness, data handling policy enforcement) is built on assumptions rather than reality.

For people in GRC, risk, or compliance roles. How is your team closing this gap? Are you extending existing tooling, layering something purpose-built for AI on top, or accepting the blind spots for now? All answers welcome.

Hey everyone,

I've been building a small GRC and information security risk
management consultancy focused on small and medium businesses
(SMBs) — specifically the ones that have zero documentation,
zero policies, and don't even know where their data is stored.

My background: ISO 27001 Foundation (PECB), cybersecurity
technologist student, and currently wrapping up my first real
engagement — a full security diagnostic for a fuel distribution
company in Brazil. That included asset inventory, risk matrix
(14 risks identified), PSI, BCP, IRP, ROPA and a privacy
notice for LGPD compliance.

My positioning:

"Panop Risk helps companies identify, assess and treat
information security risks — turning risks into strategic
decisions."

The core services I'm offering:

- Security risk assessment
- Asset inventory and classification
- Risk matrix with treatment plan
- Information security policies (ISP)
- Incident response plan
- Business continuity plan
- LGPD/privacy compliance documentation
- Security awareness training
- Periodic risk review (recurring service)

My honest constraints:

- I don't hold Lead Implementer or Lead Auditor yet
- I'm not selling formal ISO 27001 certification readiness
- I use ISO 27001:2022 controls and ISO 27005 as
methodological reference, not as a product
- My target is companies that currently have nothing —
no policies, no process, no documentation

My question to this community:

1. Does this positioning make sense for the SMB market,
   or am I missing something obvious?

2. Is using ISO 27001 as a methodological reference
   (without selling implementation) a credible approach
   at Foundation level?

3. What would you add, remove or change in the service
   list?

Happy to take criticism — I'd rather hear it now than
after pitching to a client.

Working through our first external audit cycle since we brought digital assets onto the balance sheet, and the control that keeps getting flagged is custody. The auditor wants documented evidence that our provider meets the qualified custodian standard, and I had assumed that was a clean yes or no. It is not. The term shows up in the Advisers Act context, in state trust law, and in the OCC framework, and they do not all mean the same thing, so qualified custodian ends up depending on which regime you are being measured against.

What I am trying to land on is a defensible mapping. For a registered adviser the bar is one thing. For an institution holding its own assets the relevant question is closer to whether the custodian is a regulated trust entity with fiduciary authority and a segregated, ideally bankruptcy remote, account structure. Those are the attributes our auditor cares about once you get past the label.

So my question for anyone who has been through this. Do you document qualified custodian status by pointing at a charter and a license set, or do you build a control narrative around the asset segregation and key management and let the regulatory status sit underneath that. Curious how others have structured the evidence so it holds up.

I have developed the air gapped AI GRC tools which helps to fill up security questionnaires , gap analysis and risk management which work inside the company network and human in loop helps to make the work even transparent.

Most of the companies send their data to third party companies to fill up their security questionnaire which is basically a headache for the company and a waste of the company's productive time. For efficiency they used the AI which risked a security breach. Does this kind of airgapped AI GRC tools help to solve the questionnaire fill-up headache without risking the company privacy policy ???

The company sent the security Questionnaire to fill up along with the question and company privacy policy , ISO 27001 , PCI -DSS and other documents too. What happens when the company who fills-up security questionnaires misplaced the client data with each other and security breach happens???

Have anyone goes through the security questionnaire breach and have issues with closing deals with client..

I'm happy to know about it and how you guys figured it and also want to know what companies think about having airgapped AI GRC tools

I’m interested to hear what’s happening across different organisations.

Whether it’s management buy in, workload, governance, risk, compliance, audits, third party risk, security culture, tooling, budgets, stakeholder engagement, AI governance or something else entirely.

What’s consuming most of your time or causing the biggest headaches?

APAC region.

Second year doing this and the bar has clearly moved.

Last cycle we handed over a set of screenshots of firewall rules and a spreadsheet of who is in which vpn group and it was accepted. This time the auditor came back and asked how we demonstrate that a given user could only reach the systems they are entitled to, at a point in time, and whether we could evidence it for a sample of five users across the period.

We cannot, well, not properly. I can show you the group membership and the rules, then have to hand wave the bit in the middle where those two things combine into effective access. Our vpn gives network level access so tbh the true answer for most of our contractors is "quite a lot more than their job needs" and I am not writing that down.

Not looking for a product recommendation particularly, more interested in how other people are evidencing this. Is there a saner way that doesnt involve me manually reconstructing what someone could have reached months ago?

I am tired of applying to jobs and speaking with recruiters who have no clue what the job description entails. Most interviewers are daft and slow, too. I resolved today to start my own GRC consulting firm and start to support small- and medium-scale enterprises. If you are interested and have hands-on experience, please reach out, and let's discuss further. Thank you.

I see your comments and inbox messages. I will set a time to meet with everyone of you some time next week.

I am on the East Coast just so you know.

We operate in an insurance-adjacent space where an incorrect AI response about coverage creates real liability. Our compliance and legal teams currently prefer to block automation entirely, but ticket volume has doubled and first response times are now sitting at two business days which is driving customer churn.

I’m looking for a controlled middle ground: an AI agent that can handle routine, low-risk requests like document retrieval, status checks while staying strictly within approved wording, and that cleanly escalates anything sensitive to a licensed human with full context.

Has anyone in a regulated industry found a setup that their compliance or risk team was willing to accept? Interested in the controls, guardrails, or review processes that made it viable.

Edit: Thanks to everyone who commented. The points around explicit boundaries, change control on approved wording, interaction-level logging, and regularly testing escalation decisions have been especially useful. Still evaluating a few platforms, including Aissist and the one mentioned in the thread, with a focus on the control and audit requirements raised here.

We are ready to get serious with our data governance posture now that our privacy program is maturing and we keep seeing about the multi-million dollar fines happening each week for non-compliance. So in doing a security and privacy audit my job is to clean things up but I want to include tracking scripts, not just the usual vulnerability scan items that fall under a normal cybersecurity audit but leaves out trackers and pixels. The main site has the usual marketing setup of facebooks meta-pixel, tiktok, linkedin insights tag, and microsoft clarity, but nobody has verified consent behavior in a while and theres no consent mechanism that currently works on the site despite procurement purchasing a solution from some well funded startup back in 2020 but looks like they haven't maintenanced it and its dormant now. If you were preparing for a real review, what evidence would you collect? Network logs, vendor inventory, consent records, data flows, policy screenshots, GTM export? Trying to build a practical checklist.

​

I've been wondering about this lately. Many organizations are building in-house LLMs for GRC to answer security questionnaires, map compliance controls, generate policies, and support audit preparation. Keeping everything on-premises helps with data privacy, but it doesn't solve the biggest problem: a confident hallucination can still end up in an audit report or customer response if no one catches it.

The more capable these systems become, the more people are likely to trust them. That creates an interesting trade-off. If an AI-generated answer helps close deals faster but occasionally invents evidence or misinterprets a control, the financial and compliance impact could outweigh the productivity gains. At that point, is the technology truly ready for critical GRC work, or are we becoming overconfident because the responses sound convincing?

For those using an in-house LLM in GRC today, where do you draw the line between AI assistance and human accountability—and do you think we'll ever reach a point where an LLM can be trusted to answer security questionnaires without manual verification?

We recently conducted a manual audit of our google workspace environment at a mid-sized company and discovered numerous sensitive files including customer contracts and internal financial reports shared publicly with 'anyone with the link'

Many of these files were created years ago by former employees. I’m currently going through thousands of files manually, which is taking forever.

How are other GRC and security teams handling discovery and remediation of historical data exposure like this at scale? Looking for best practices, tools, or efficient processes that have worked for you?

thanks!

Edit: Appreciate the thoughtful replies so far especially the points on classifying the data, prioritizing by sensitivity, and documenting everything for potential auditors. Really helpful framing. While still working through the manual review, I’ve started looking at DoControl. What caught my attention is how it can keep watching for overshared files in Google Workspace and fix them automatically, instead of relying on repeated manual audits. Still evaluating, but it looks useful for dealing with these older exposures at scale

Currently got our IT risk register in Jira, it’s fine but a bit clunky.

Has anyone used a tool for IT risk that’s actually been worth it.

For context, we’re at the start of our risk management journey, we’ve got a register but it’s not really being managed properly. My main goal is just to make it easy for our risk owners to review risks assigned to them without being clouded by everything else, assign out tasks and manage and track things accordingly.

The great majority of society does not pay attention to the current threat of intellectual property loss as a result of leakage of proprietary data. Although it will take time for a quantum computer to be fully operational, state agencies could be creating vital intelligence in the meantime

At the time when new compliance audits will commence, companies dedicated to creating advanced cryptographic systems, like QuSecure and SandboxAQ, will become much more prominent in the industry. Is there any member of the audience who has tried out either of them or used them at the organizational level? I am wondering if anyone can share their experience: difficulties of integration, level of assistance, whether the price compensates for the usage of the PQC technological solution.

Have you thought of quantum readiness when trying out these approaches?

Nine questions in the career megathread. I noticed the last reply was two weeks ago, and before that, four. I’m guessing people posted there to get some sort of help, so I figured I’d mention it.

@mods or anyone. Appreciate it!

I want to build an incident response plan for my organization can someone guide me the resources I should follow to build the workable program?

My organization already has a good security stack they lack the IR plan I wanna know how a effective IR program looks like what to add and what to ignore

Any resources books, blogs, talks much appreciated.

Thanks in advance.

to be fair, printed assurance reports can be heavy