Governance Risk & Compliance Most organisations are becoming increasingly aware of the need for a holistic approach to managing the security of their data, systems and people. Cyber security capabilities such as intrusion prevention, data loss protection and identity and access management must be unified with appropriately designed and tested policy, processes and procedures, as well as embedded within the culture of the organisation through training and awareness. The success of any GRC approach is the organisation`s ability to successfully communicate. Business leaders need to be able to communicate their requirements and concerns to their IT Department. In turn, the IT Department need to be able to communicate technical risk considerations with business leaders in a language they can understand. There are significant financial, social and ethical benefits to a co-ordinated approach to Information Security GRC: Existing capabilities can be optimized to facilitate effective risk based decision making, leading to quality business outcomes Preparedness to comply with existing and new government regulations reducing the impact and cost associated with bringing an organisation `into compliance` Effectively managing audit findings leading to an improved information security risk posture, as well as closing findings themselves Protection against the loss of intellectual property, privacy and organisational reputation Long term reductions in the operational costs of ineffective and inefficient information security management Tim Jackson ©