---
description: >-
  This chapter covers the theory and practice of cybersecurity GRC in
  enterprises
---

# Cybersecurity GRC

## Topics covered in this chapter

[Cybersecurity GRC in plain English](cybersecurity-grc/cybersecurity-grc-in-plain-english)

This section demystifies cybersecurity GRC. This discussion situates cybersecurity management within IT governance and presents GRC as a cybersecurity risk management framework.

[IT governance](cybersecurity-grc/it-governance)

This section introduces IT governance as the highest level/most abstract conceptual framework for operationalizing information security management within organizations.

[Compliance frameworks and industry standards](cybersecurity-grc/compliance-frameworks-and-industry-standards)

This section covers key cybersecurity compliance frameworks and industry standards, including NIST, GDPR, ISO, SOC, HIPAA, and PCI.

[Important cybersecurity regulations](cybersecurity-grc/important-cybersecurity-regulations)

This section shed light on the main cybersecurity regulations and standards pertinent to information security risk management.

[The GRC approach to managing cybersecurity](cybersecurity-grc/the-grc-approach-to-managing-cybersecurity)

This section situates GRC within IT governance and presents GRC as a risk management framework.

[Ethical AI frameworks, initiatives, and resources](cybersecurity-grc/ethical-ai-frameworks-initiatives-and-resources)

A literature review of ethical AI frameworks for the design and governance of AI systems and a pragmatic framework and approach for the ethical design of AI systems.
