What is the role of governance, risk, and compliance in ISSAP?

• A. Ensures alignment with business strategy, clarifies risk posture, and ensures security controls meet legal/regulatory requirements via policies, standards, and auditing.
• B. Focuses only on daily operations; ignores regulatory requirements.
• C. Replaces internal audit; eliminates governance structures.
• D. Only handles data classification; not risk management.

Answer: (B)

In ISSAP, governance, risk, and compliance is about aligning security with business strategy, understanding the organization’s risk posture, and ensuring that security controls meet legal and regulatory requirements through a structured program of policies, standards, and auditing. This means governance structures guide decision making, risk management identifies and prioritizes threats and controls based on risk appetite, and compliance ensures adherence to laws, regulations, and contractual obligations, with assurance provided through monitoring and audits.

The idea that this function focuses only on daily operations and ignores regulatory requirements misses the essential oversight and accountability role of GRC. It’s not enough to handle routine tasks; GRC integrates strategic direction, risk-aware planning, and regulatory compliance into the security architecture, ensuring controls are appropriate, effective, and defensible to regulators and leadership. The other options don’t fit because governance, risk, and compliance isn’t about replacing internal audit or eliminating governance structures, nor is it limited to data classification without addressing risk management.