Just been handed security compliance? Start with what buyers check.
A questionnaire has landed, a deal is waiting, or someone has asked you to "sort out ISO 27001". I spent years on the buyer's side deciding which suppliers passed security review. GRCMANA is where I share what actually gets checked, and what you can safely ignore.
Buyers don't read your policies. They check whether your controls ran.
Most people meet security compliance the same way. A questionnaire lands, a deal parks, and somebody buys a policy pack. The documents get written but the controls never run. Six months later the next buyer asks for the same evidence and it starts again, one questionnaire at a time.
Enterprise buyers sample whether a control ran, who owned it and what evidence it left behind. Trust is that evidence trail, not the binder. Build the trail once and every questionnaire after the first is a lookup, not a project. That's what I teach.
Free first. Go further when you need to.
Everything below is free. Start with the problem in front of you and come back when the next one lands.
The Vault
Guides, templates and free tools for ISO 27001, SOC 2, AI governance and GRC Engineering. Written around what an auditor or buyer will actually ask for.
Open the VaultThe GRC Pulse
One email a week from me: what changed, what matters, and what you can leave alone. New guides, tools and toolkits land here first.
Get the PulseThe GRC Collective
A free community for practitioners doing this work, to compare notes, ask the awkward questions and share what passed.
Join the CollectiveSix phases from exposed to trusted.
The spine of everything here. Every guide, template and toolkit maps to a phase, so you can see where you are and what comes next.
Define
Work out what your buyers, auditors and regulators will actually ask for, and where you stand today. Know the gap before you start closing it.
Build
Put in the controls and policies the standard demands, sized to your company. Eight policies that operate beat forty that don't.
Embed
Make controls run as part of normal work, with evidence collected at source rather than chased before the audit. This is where GRC Engineering starts.
Validate
Show that it works: audit-ready evidence, clean questionnaire answers and a certificate if you need one.
Scale
Add frameworks, markets and buyer requirements without starting again. One set of controls, many audiences.
Evolve
Keep trust true all year with continuous monitoring and horizon scanning, so it holds between audits as well as during them.
Already doing GRC for a living? Make it count.
The commercial side of trust and GRC Engineering, for practitioners who want to move from audit support to real influence.
The questions change
If GRC is your career rather than a side task, you're past "what does the standard say". How do you stop chasing evidence by hand? How do you engineer controls that prove themselves? How do you get into the room where the commercial decisions are made?
Where I answer them
GRC Engineering is the flagship of the Vault: automated evidence, continuous control monitoring and controls as code. I write about it and the commercial side of trust every week in GRC Pulse. The GRC Collective is where practitioners compare notes on what works.
What buyers check, every week.
One email a week from me, written for the person who has to make it happen.
Free · One email a week · Unsubscribe any time