So. GRC or security? It’s a rhetorical question. Is GRC security? Not exactly, but if you can’t demonstrate security, no one knows if you have security or

So. GRC or security? It’s a rhetorical question. Is GRC security? Not exactly, but if you can’t demonstrate security, no one knows if you have security or not. GRC is the ability to quantify/qualify security. For true security, as in secure-by-design, etc, you need subject matter experts in that field. Since there is no security knowledge qualifying body for (most) platforms, the credentials don’t really matter much. But for GRC, they are essential. The question is also difficult to answer because there is no one thing that is security. You can manage vulnerabilities or provide incident response, both security topics but with wildly different skill requirements, for example. Security engineering, security management, security testing, security reporting, etc, etc. All very different things.