← grc.engineering

The GRC Engineering Cheat Sheet

For decades, auditors and governments defined and molded Legacy GRC in their image. Today, engineers and analysts are transforming it into something new: GRC Engineering. This cheat sheet outlines what makes GRC Engineering different.

First Principles

GRC

"Governance, risk, and compliance (GRC) are three related facets that aim to assure an organization reliably achieves objectives, addresses uncertainty and acts with integrity."
— Wikipedia: Governance, risk, and compliance

Engineering

"Engineering is the practice of using natural science, mathematics, and the engineering design process to solve problems within technology, increase efficiency and productivity, and improve systems."
— Wikipedia: Engineering

GRC Engineering

GRC Engineering is the practice of using science, math, user-centered design, and modern software development to assure an organization reliably achieves objectives, addresses uncertainty, and acts with integrity, all while continuously improving its efficiency, productivity, and systems.
— The GRC Engineering Cheat Sheet

Legacy GRC vs. GRC Engineering at a glance

A side-by-side comparison of the legacy GRC mindset and the GRC Engineering approach across the five program areas.

Legacy GRC and GRC Engineering by program
Program	Legacy GRC	GRC Engineering
All	Framework-centric approaches Shallow & narrow problem solving mindset Cumbersome user experience (UX) across GRC processes, tools, etc. Work products = static documents, manual workflows, disjointed processes, and theatrical controls Processes are excessively, if not exclusively, manual Trivial outputs conflated with meaningful outcomes GRC treated as a program that serves GRC teams' needs and preferences	Objectives-centric, risk-focused, and threat-informed approaches Systems thinking applied broadly (organizational governance, risk analysis, control modeling, etc.) Design thinking harnessed to make the right thing to do the easy thing to do Work products = dynamic systems, automated workflows, embedded processes, and enforced guardrails Processes are automated, early on and often Measurable, meaningful outcomes (or bust) GRC treated as a product that serves internal and external customers' needs and preferences
Governance	Mainly consists of static policies, standards, and procedures that everyone "acknowledges" but never remembers Static governance documentation rarely reflects reality of controls Committees exist to check boxes but rarely, if ever, drive strategic decisions that effect change Awareness training checks boxes but is too infrequent, delayed, unengaging, and ill designed to durably change behaviors	Mainly consists of strong guardrails (e.g. policy-as-code) that enforce risk tolerance & paved paths that make it easy to do the right thing the right way Dynamic governance documentation is enforced via policy-as-code, expressed via policy-to-code, and reconciled via policy-from-code Committees exist to define/refine decision making frameworks & to facilitate strategic decisions Real-time behavioral interventions prevent improper behaviors, while awareness training leverages science-based pedagogy to durably change behaviors
Risk	Risk program is built on qualitative risk analyses that are heavily, if not entirely, based on unvalidated assumptions, uncalibrated intuition, and generic heatmap frameworks "Risks" are ambiguous hypotheticals or "control gap findings" that are detached from a real-world understanding of relevant threats, threat vectors, weaknesses, assets, and/or impacts Numerical risk scores conflated with "risk quantification" Risk tolerance/appetite are imaginary concepts that exist in policy documents with no real-world grounding Fear, uncertainty, & doubt (FUD) dominates risk register entries and risk conversations Risk team operates as "accountability police" that attempts to pressure, shame, or strong arm fellow teams into taking action Third-party risk management (TPRM) is really just third-party compliance management (TPCM) in disguise, focused entirely on third-party controls/mitigations while overlooking first-party risk mitigation opportunities	Risk program is built on quantitative risk analyses that are based in scientifically-sound forecasting methods, statistical modeling, real-world evidence, and proven frameworks (e.g. FAIR) "Risks" are holistic scenarios that account for threats, threat vectors, weaknesses, assets, controls, and impacts True risk quantification is in place, with quantitative inputs producing quantitative outputs Risk tolerance/appetite is derived from real-world and measurable constraints, such as insurance limits, cash reserves, organizational goals, and executive leaderships' values and principles Evidence, logic, math, & reason (ELMR) dominates risk register entries and risk conversations Risk team operates as "decision support partners" that enable their organization to make smart risk decisions TPRM is actually managing risk, focused on holistic scenarios, quantitative risk analyses, and both first-party and third-party controls/mitigations
Compliance	Control monitoring is done periodically, infrequently, and manually Control design evaluations and testing methods are ignorant of real-world threat models Control evidence assessments are sampling-based and are partially or totally unscientific, ignorant of effect size, statistical power, etc.	Control monitoring is event-driven (i.e. real-time) whenever possible, highly automated, and frequent Control design evaluations and testing methods are rooted in evidence-based real-world threat models Control evidence assessments are full population-based. When sampling is unavoidable, sampling methods are scientific and account for effect size, statistical power, etc.
Trust & Assurance	Trust signals are predominantly in the form of questionnaires and static documents Customers gather trust & assurance artifacts via cumbersome RFP/RFI processes that are largely mediated over email or support tickets	Trust signals in the form of historical control monitoring metrics are transparently and programmatically provided, and are consumable in human-readable and machine-readable formats Customers can easily self-serve their way through gathering trust & assurance artifacts, getting questionnaires automatically completed, etc.

Timeline

A history of governance, risk, and compliance milestones — from the first federal IT security standards to the emergence of GRC Engineering as a discipline.

Jun 1974FIPS 31

1977Control Objectives

Aug 1979FIPS 65

Aug 1983The Orange Book

Apr 1988NIST SP 500-153

Apr 1992SAS 70

Sep 1992COSO Internal Control Framework

Feb 1995BS 7799

Apr 1996COBIT

Aug 1996HIPAA

Jul 2002SOX

Dec 2002FISMA

Dec 2002OCEG founded

2004OCEG Red Book published

Oct 2005ISO 27001

Jun 2011SSAE 16 & SOC

Feb 2014NIST CSF

May 2016GDPR

2021Netflix hires first GRC Engineer

Jan 2023DORA

Jan 2023NIS2 Directive

Nov 2023GRC Engineering Podcast launches

Jul 2024GRC Engineering Manifesto published

Terms

Vocabulary that distinguishes GRC Engineering thinking from legacy GRC.

GRC Engineering terms and definitions
Term	Description
Active Testing	Exercising controls to confirm they function—not just checking they exist. Analogous to software automated tests.
Compliance	Acting with demonstrable integrity so the organization can prove it does what it claims — full-population control evidence, real-time monitoring, and code as the source of truth.
Control Monitoring	Observing whether controls operate as intended. GRC Engineering automates this continuously and holistically.
Decision Support	Providing data, analysis, and options so stakeholders make informed risk decisions. Replaces the "accountability police" model.
Design Thinking	Human-centered problem-solving methodology. Harnessed to make the right thing to do the easy thing to do.
ELMR	Evidence, Logic, Math, Reason. The GRC Engineering alternative to FUD—grounded in verifiable data and sound reasoning.
Evidence Populations	Complete control records collected automatically over a period. Eliminates sampling risk with full coverage.
Evidence Samples	Legacy subset of records selected to demonstrate control operation. Incomplete and vulnerable to selection bias.
FUD	Fear, Uncertainty, and Doubt. Legacy fear-based risk communication used to justify budget without rigorous analysis.
Governance	Governing with due care so the organization reliably achieves its objectives — paved paths, guardrails, and policy-as-code.
GRC as a Product	Treating GRC programs as products serving internal and external customers, with user research, feedback loops, and measurable outcomes.
Heatmaps	Legacy likelihood × impact matrices on ordinal scales. Obscure actual risk magnitude behind coarse, subjective categories.
Histograms	Frequency-distribution charts conveying risk shape, range, and confidence intervals in objective, data-driven terms.
Monte Carlo Simulations	Probabilistic simulations producing distributions and histograms instead of single-point estimates and heatmaps.
Policy-as-Code (PaC)	Policies written as executable code; the code is the source of truth, enabling version control, testing, and deterministic enforcement.
Policy-from-Code	Deriving policy documentation from code, configurations, or runtime behavior. Closes the gap between docs and control reality.
Policy-to-Code	Translating human-readable policy documents into executable code, bridging policy authors and enforcement systems.
Qualitative Risk Analysis	Subjective High/Medium/Low scales based on expert judgment. Manual, inconsistent, and difficult to aggregate.
Quantitative Risk Analysis	Numerical models, probability distributions, and measurable data. Automated, reproducible, and comparable across scenarios.
Risk	Managing risk with due diligence so the organization addresses uncertainty — threat-informed quantitative analysis, evidence-based scenarios, and continuous exposure monitoring.
Risk Scenarios	Holistic descriptions combining threat + attack vector + affected asset + impact into a single analyzable unit.
Scientific Pedagogy	Evidence-based learning science—spaced repetition, scenario-based exercises, measurable retention—applied to security training.
Systems Thinking	Examining how components interrelate and work together over time within larger systems. Applied across governance, risk analysis, and control modeling.
Threat-Informed	Grounding policies, controls, and trainings in real-world threat intelligence rather than abstract framework checklists.
TPCM	Third-party compliance management. Legacy questionnaire-focused approach that conflates compliance with risk.
TPRM	Third-party risk management. Balanced third + first-party focus, evaluating real-world threat scenarios and value-at-risk.

Tools

Open-source and commercial tools that enable GRC Engineering practices — policy-as-code, continuous compliance, evidence automation, quantitative risk, and compliance-as-code.

Tools for GRC Engineering
Tool	Description
Ansible	Policy-as-code via playbooks and roles; continuous compliance through idempotent automated configuration enforcement.
Checkov	Static IaC scanner (Terraform, CloudFormation, Kubernetes, ARM…); policy-as-code and continuous compliance in CI/CD.
Chef	Continuous compliance via InSpec's human-readable audit DSL; Policyfiles express policy-as-code for environment configuration.
claude-grc-engineering	Claude Code plugin suite for evidence collection, SCF crosswalks, multi-framework gap reports, and OSCAL workflows.
Cloud Custodian	YAML-based rules engine for cloud governance, security, and continuous compliance with serverless auto-remediation.
CloudQuery	Infrastructure-as-data platform syncing cloud and SaaS configurations into queryable databases for evidence pipelines.
Compliance to Policy (C2P)	Bridges OSCAL compliance-as-code with policy-as-code engines (Kyverno, OCM, Auditree); generates policies and ingests assessment results.
Compliance Trestle	OSCAL-native compliance-as-code platform for CI/CD authoring, validation, and governance of compliance artifacts in git.
Corsair	Signs compliance findings as W3C Verifiable Credentials (Ed25519 / JWT) so any party can verify integrity without trusted intermediaries.
FAIR	Open standard decomposing risk into measurable factors (threat event frequency, vulnerability, loss magnitude).
Gemara	OpenSSF seven-layer logical model for automated GRC engineering — standardised, machine-readable schemas (CUE) for compliance interoperability.
GigaChad GRC	Open-source modular GRC platform for compliance (SOC 2, ISO 27001, HIPAA), risk registers, vendor assessments, and audits. AI-powered, containerized, self-hostable.
The GRC Companion	Formerly GRC Engineering Lab Builder. GRC learning companion grounded in Ayoub Fandi's corpus, supporting real-work learning loops, concept tutoring, and synthetic labs — source.
GRClanker	Spec-driven open-source AI GRC CLI — bring your own AI agent (Claude, Codex, Gemini…) to generate Go CLIs for FedRAMP, KEV, EPSS, SCF crosswalks.
HashiCorp Sentinel	Embedded policy-as-code framework for Terraform, Vault, Consul, and Nomad — gates infrastructure changes pre-apply.
How to Harden	Community-developed open-source hardening guides focused on cloud services and integration / supply-chain attack prevention.
Kubewarden	CNCF Kubernetes policy engine; policies as WebAssembly modules in Rust, Go, Rego, CEL, and others.
Kyverno	Kubernetes-native policy engine that validates, mutates, and generates resource configurations at admission time.
myctrl.tools	Fast, searchable reference site for security compliance controls across frameworks (FedRAMP Rev5, DoD SRG, and more).
OPA Gatekeeper	Kubernetes admission controller built on OPA. Enforces Rego policies on cluster resources at admission time.
Open Policy Agent (OPA)	General-purpose policy engine for unified policy decisions across the cloud-native stack.
Open Source Cybersecurity Training	Free SCORM-compatible interactive security & privacy training modules — phishing, CEO fraud, secure coding, and more (live demo).
Prowler	Open-source cloud security platform. Continuous compliance across AWS, Azure, GCP, Kubernetes, M365, and more.
Pulumi Policies	CrossGuard policy-as-code for Pulumi infrastructure-as-code, written in TypeScript, Python, or Go.
Puppet	Policy-as-code via Puppet manifests; continuous compliance through automated drift detection and remediation.
Rego	OPA's declarative policy language. Enables Policy-as-Code evaluation in CI/CD pipelines.
riskquant	Netflix's open-source library for quantifying risk via FAIR-based Monte Carlo simulations.
Salt Stack	Event-driven configuration management with policy-as-code in SLS files; continuous compliance via reactor and beacon engines.
SCF API	API for the Secure Controls Framework (1,400+ controls mapped to 200+ laws, regulations, and frameworks).
ScoutSuite	Multi-cloud security auditing tool. Active testing against CIS, PCI DSS, and HIPAA benchmarks.
Steampipe	Cloud APIs as SQL tables. Full-state infrastructure queries for evidence populations across 100+ services.
Terraform	Declarative infrastructure-as-code for provisioning cloud and SaaS resources. In GRC Engineering, the version-controlled, peer-reviewed source of truth for infrastructure — plan/state output serves as audit evidence, policy-as-code (Sentinel, OPA) gates changes pre-apply, and drift detection surfaces unauthorized configuration changes.

Teachings

Books, courses, labs, podcasts, talks, blogs, and communities for learning and practicing GRC Engineering.

GRC Engineering learning resources by type
Type	Teaching
Books	GRC Engineering for AWSAJ Yawn
	How to Measure Anything in Cybersecurity RiskRichard Seiersen, Doug Hubbard
	Measuring and Managing Information Risk: A FAIR ApproachJack Jones, Jack Freund
	From Heatmaps to HistogramsTony Martin-Vegue
	The Metrics ManifestoRichard Seiersen
Courses	GRC for the Cloud-Native RevolutionAyoub Fandi
	Cybersecurity Foundations: GRCAJ Yawn
	Leveraging AI for GRCTerra Cooke
	Threat Modeling Learning PathLinkedIn Learning
	CGE-P CertificationGRC Engineering Club
Labs	GRC PlaygroundAshley Pearce · original GitHub repo
Labs	GRC Portfolio LabsAJ Yawn
Podcasts	GRC Engineer PodcastAyoub Fandi
	Cyber Stories — GRC EngineeringDay Johnson (feat. Ayoub Fandi)
	Resilient Cyber — Transforming ComplianceChris Hughes (feat. AJ Yawn)
	MYGRCPOV — Rise of GRC EngineeringMonica Reagor (feat. AJ Yawn)
Talks & Interviews	BSidesSF 2024 — GRC Engineering in RepositoryVarun Gurnaney
	BSidesSF 2025 — Compliance in DevOps PipelineVarun Gurnaney
	Netflix Security — Risk-based Decision MakingPrashanthi Koutha, Shannon Morrison
	fwd:cloudsec 2025 — GRC Engineering for AWSAJ Yawn
	What is GRC Engineering?Lloyd Evans
	Automating Compliance ProcessesLloyd Evans
	CPA to Cybersecurity PivotSteve McMichael (feat. Ayoub Fandi)
	FAIRCon 2022 — Five Objections to FAIRTony Martin-Vegue, Prashanthi Koutha
	GRC Deep Dive on Cyber Risk QuantificationSteve McMichael (with Richard Seiersen)
Blogs & Newsletters	The GRC Engineer NewsletterAyoub Fandi
	From Heatmaps to HistogramsTony Martin-Vegue
	Varun Gurnaney's MediumVarun Gurnaney
	Netflix TechBlog — Open-Sourcing riskquantMarkus De Shon, Shannon Morrison
Community	GRC Engineering DiscordCommunity Discord server
	GRC Engineering LinkedIn GroupCommunity LinkedIn group
	GRC Engineering ClubPatreon community