118xBanin18xban.hashnode.dev·Sep 26 · 13 min readKickoff: Your First GRC Meeting// @18xBan · GRC Series · Chapter 16 4 questions. Everything else is your homework, not theirs. The sentence at the end of the March review The management review is nearly over when Maya says the t00
118xBanin18xban.hashnode.dev·Sep 26 · 15 min readGovernance Roles and Responsibilities// @18xBan · GRC Series · Chapter 15 Who decides, who does, who signs, and who covers when they're away. Monday, 9:15 AM: one name, 5 Boxes Gotham Mutual's contract arrives with a security schedule00
118xBanin18xban.hashnode.dev·Sep 25 · 14 min readRisk Appetite vs Risk Tolerance // @18xBan · GRC Series · Chapter 14 Capacity, appetite, tolerance, trigger. Only one of them is a number. Tuesday, 10:40 AM: "Is that OK?" Priya's team wants to ship a product analytics SDK. It's 00
118xBanin18xban.hashnode.dev·Sep 23 · 13 min readManagement Review: Running the Meeting That Matters// @18xBan · GRC Series · Chapter 13 7 inputs in, decisions out, and a document that survives an audit. Monday, 11:00 AM: "When was your last management review?" The firm Maya funded for the intern00
118xBanin18xban.hashnode.dev·Sep 23 · 13 min readBoard Metrics That Actually Get Read// @18xBan · GRC Series · Chapter 12 6 numbers, 3 decisions, one page. Thursday, 2:00 PM: 14 Charts Maya gives you 10 minutes at the monthly leadership meeting. It's the first time security has bee00
118xBanin18xban.hashnode.dev·Sep 22 · 14 min readMaturity Models: CMMI vs CSF Tiers vs C2M2// @18xBan · GRC Series · Chapter 11 Same company, same week, 3 honest answers. Monday, 9:30 AM: The dropdown Gotham Mutual's vendor portal has a new section. One field, one dropdown: Rate your In00
118xBanin18xban.hashnode.dev·Sep 21 · 13 min readBuilding a Security Program on a $0 Budget@18xBan · GRC Series · Chapter 10 0$ , 90 hours, 56 safeguards. Month one. Monday, 10:00 AM: The number is 0. You walk into Dan's office with a one-page sheet. 4 quotes: a SIEM, a GRC platform, an 00
118xBanin18xban.hashnode.dev·Sep 20 · 15 min readYour First Security Policy Set (What You Actually Need)@18xBan · GRC Series · Chapter 09 40 documents, 4 approvals, 0 readers. Monday, 9:00 AM: forty policies in three minutes Tom Bergeron starts as a backend developer. Farah's onboarding email is frie00
118xBanin18xban.hashnode.dev·Sep 20 · 14 min readThree Lines of Defence Explained@18xBan · GRC Series · Chapter 08 3 lines, drawn honestly.2 of them are the same person, and one is empty. Friday, 9:10 AM: "Who reviews you?" Gotham Mutual's analyst sends the 3 questionnaire item00
118xBanin18xban.hashnode.dev·Sep 20 · 16 min readThe Evidence Chain Map@18xBan · GRC Series · Chapter 07 6 links from "we do this" to "here's the proof." 4 were broken, and the other 2 were weak. Monday, 8:50 AM: "Show us, don't tell us" The email from Gotham Mutual's00
