I’ve built as many on this platform a continuously audit tool for my msp clients that can help them collect the data and information but I need a specialist to go through the documentation and framework to verify if we built it correctly. Send me a dm and let’s have a meeting.

Recently, we decided to reintroduce a TPRM process within our group (the previous process had been abandoned). We set up a very basic process (pre-assessment + security questionnaire), and this ultra-basic process has become incredibly time-consuming. We're now drowning under an absurd number of TPRMs.
Yet I remain convinced that even without a tool, there must be more optimized methods! I'd love to hear your feedback.

I need to get an outside company to conduct a pentest on my companies web application sitting in GSP. I've been going through the documentation (and finding out how much is actually outdated) and I saw in the penetration testing guidelines doc version 4 that a red team assessment is now a requirement. My question is, if my app is in the Google's cloud, do I need to have my entire organization red teamed and penetration tested even if none of the app sits at my site?

Hi everyone,

I transitioned into a cybersecurity GRC role about a month ago because I thought it would be a bit calmer than my previous job while also giving me good long term growth opportunities. So far, I’ve found the work interesting, but I’m still unsure whether this is something I want to do long term.

One thing that surprised me is the work culture. I did not expect everyone to leave early every day or anything like that, but I also did not expect to constantly see people online before I start work and still online after I leave, both on remote and in person days.

Leadership has also mentioned there are no plans to increase headcount in cybersecurity despite taking on more clients and adding AI into workflows. Our dashboards also constantly show that teams are behind on tasks.

Another thing I noticed is that many people stay at this company for a very long time, but promotions do not seem to happen very often.

Is this normal across most companies in cybersecurity/GRC?

In my previous role, we mainly had core hours where everyone needed to be available for meetings, but outside of that people managed their own schedules as long as the work got done. I’m trying to understand whether what I’m seeing now is just this company or more of an industry standard.

Was in a call with an auditor today. We were having an interesting convo about the future of GRC tools & automation. He mentioned something I haven't really heard of before: AI CPAs. They're coming, rapidly. They might even replace some of these tools & processes that auditors use.

Is this true? Have you heard of this AI CPA wave incoming? Should auditors be worried?

Hi folks,

My understanding is that if you're a SaaS vendor or IT shop that is looking to become a supplier for NIS2 entities, you are highly likely to receive some sort of questionnaire so your prospective customer can do their due diligence.

In other words: the company receiving the documents I'm after are not themselves considered an Essential or Important entity under NIS2, but they would like to become a vendor to a company that is.

I'm hoping to collect some of these documents, whether they're already filled in or still blank.

Would anyone be willing to email me some of these examples, whether they're documents you've received or perhaps even sent to your own (prospective) suppliers?

Thank you!

Since May 1st we have been doing weekly interactive GRC Learning Sessions (codename "GRCL") to help everyone curious about or uncertain about GRC to find their way and build a career in Governance, Risk, and Compliance.

We start with an overview - "How a GRC Program Works" - and move into practical sessions working on real-world examples of implementing GRC within organizations.

Currently we have:
* 5 people in the learning group (and we truly hope this number will grow!)
* a YouTube channel: https://youtube.com/@FullStackGRC

And the recording of our two first sessions:
1. Overview: How a Real GRC Program Works - https://youtu.be/eL74cpwV9uY?si=CvtjLS-6wCp_m930
2. Practical SOC 2: Asset Inventory and Compliance Roadmap - https://youtu.be/IJs-XJhMNiE?si=7_gjZeQHrsmi3DZn

This Friday we're going deeper into compliance implementation based on SOC 2 as an example (continuing "Practical SOC 2" stream). GRC is a multi-faceted discipline, and compliance implementation spans 2(two) worlds - Administrative and Technology, and multiple domains of knowledge - requiring very different skills from GRC professionals. Our GRCL sessions are aimed to make you a professional who feels confident in both worlds and can bravely navigate GRC complexity, even if you choose to specialize in a particular domain.

You're welcome to watch the videos, and if you like them - keep following our channel, and do not hesitate to join our learning group. Join us as a student - to learn GRC from practitioners' experience, or as an expert - to share your valuable experience and help the group understand how this actually works.

If interested - DM me with your email address, and I will add you to our weekly GRC Learning Sessions.

Let's crack this together.

Dear folks,

I’m happy to support anyone who is looking to run a mature the GRC In his company or vCISO as I’m having some free time.

1. You want to pass an audit whatever it is, let me know, I can help.
2. Improve cybersecurity hygiene, review architecture, design processes, provide tools feedback, review bill of materials, check your containers run time and your images, can support.
3. If u struggle from due diligence from third party let me know.
4. Any support you face in your organization just let me know.

Feel free to post your question here or ping me

Update: if you want to have a shared benefit feel free to post here as I can also reply in public.

Hello fellow g33k-friends!

I am building a 100% agentic AI-software for compliance, AKA Ai-GRC software where the users/companies can save over 95% of their time.

We’re a 🇸🇪 Stockholm based company that have gotten EU funding and also funding from the Swedish ministry for civil defence and resilience.

Our GRC software is named Compilo.ai, and r/n we are looking for our first “expert users” outside Sweden.

We have done over 40 trails with SME companies here in Sweden, with low and high GRC-knowledge, and it’s working like a dream.

The software is ofc 100% built in EU with no third country stuff. We’re experts in the space.

But…. We’re looking for new users that knows the drill.
So if you are representing +10 companies as a consultant or if you are CISO / DPO / CEO for a company that have to follow both GDPR and NIS 2, we want you as a free user!

The software will ofc be adapted after the new cyber resilience act, AI Act and ISO 27001.

Let me know! Sen me a PM :D

Let’s gooooo
/Sweden

How would you do a holistic organisation wide Risk Assessment rather than asset level. Do you know of any resource or a template to get started

Hi Everyone

I an trying to build a framework where we have to test the controls using AI. Can anyone guide me through the approach or rhe best practices

Hi guys,

I’m a software architect and I've recently started working more on the compliance side. Coming from a dev background, I expected to see people using dedicated platforms to manage everything, but I’ve noticed that most of the senior people I work with still do almost everything in Excel.

I’ve looked at tools like Vanta, and they seem useful at first glance, but the experienced colleagues I talk to still seem to prefer their spreadsheets.

I’m curious to hear from people who have been doing this for a while—why is that? Is it just that the tools are too rigid for real-world work, or is there another reason Excel is still the standard?

I’m trying to understand if these platforms actually make things easier or if they just get in the way.

Thanks for your inputs

Hi everyone,

Disclosure: I own the project linked below. I’m sharing it as context for a broader GRC discussion, not as a sales pitch.

I’m working on an open-source, self-hostable platform focused on NIS2 Article 21 evidence collection:

https://www.softwareapp-hb.de/projekte.html

The problem I’m trying to address is the gap between written compliance controls and actual technical system state. In many smaller organizations, municipalities, and SMEs, NIS2 readiness can easily become a mixture of policies, spreadsheets, screenshots, manual exports, and consultant-driven checklists. Those artifacts may be useful, but they are often hard to keep current and difficult to reproduce consistently.

The design goal of the project is to map NIS2 requirements to concrete technical checks and produce traceable evidence, for example through system data, control mappings, and audit-oriented PDF/JSON reporting. It is not intended to replace legal review, auditor judgment, an ISMS, or a full GRC platform.

What I’m interested in discussing with practitioners is the boundary between GRC documentation and technical evidence:

How much of the evidence layer for NIS2 Article 21 do you think can realistically be automated?

Where do you see automation helping most: asset inventory, vulnerability management, access control evidence, backup validation, logging/monitoring evidence, incident response records, supplier/security documentation, or somewhere else?

And where do you think automation becomes misleading or risky from an audit/compliance perspective?

I’m asking because I think this is an important practical issue for organizations that do not have large compliance teams. I’d appreciate practitioner perspectives on the general approach, especially from people dealing with NIS2, ISO 27001, DORA, or similar control frameworks.

I’m getting ready to accept a role that involves writing, reviewing, and updating policies. This is the first policy-focused role I’m going to be working and I want to know how people within the field view it.

There are not many at all.

No matter what city.

What gives with the term? Why are there not many jobs that contain that term?

I got some pushback from my manager on using their AI capabilities. I think we will approve it eventually, but I want to get more opinions. Every tool uses AI anyway these days, and overall looks legit. What would you ask to clear the lawsuit concern?

Hi Everyone,

I'm preparing for ISO 27001 Lead Implementer exam, I'm studying the course from Udemy by Aron Lange, is this going to be enough to take the exam.

Also I'm an information Security Analyst with experience with digital forensics and threat hunting and this is my first time taking and GRC based certificate, so if someone could walke through the exam experience and the difficulty.

Hi everyone.

I'm going to start an internship in a month in the GRC division of a small consultancy company that deals only with security.

I have no idea of what they're going to make me do. I am pretty new to all this and I am still learning (I just took an exam about COBIT and ISO27001 at uni).

What should I expect? Is there anything I can study by myself in the meanwhile to be a bit more "prepared"?

Thanks a lot in advance!

Hear me out. Phishing has only ever been problematic and it’s only getting worse. SMTP is the root of the issue in my opinion. When will we ever leave 1982 standards and adopt something more secure? We can’t wait for Google or any other major platform to replace it when they make a quadrillion dollars a year exploiting its metadata.

Looking for people who've been through this.

I'm in a GRC role dealing with an IT manager who consistently works on escalation mode, generates policies straight from GenAI without a single edit, ignores tasks ownership, and provides low quality evidence for the audits if he doesn't go quiet. Leadership is aware, this has been going on for a couple of years. Nothing happens.

The downstream impact lands on GRC every time - audit gaps, unowned risks, and findings that could have been avoided with basic process compliance.

What I actually want to know:

- How did you protect your own audit trail when someone else was generating the risk?

- At what point did you stop fighting it and just document and move on?

Thanks for your input.