D-DP-FN-01: Data Protection and Management Foundations v2

Governance, Risk, and Compliance (GRC) coordinates governance, risk management, and compliance activities so that security controls can be planned, implemented, assessed, and tracked against organizational policies and external requirements. NIST identifies GRC as governance, risk, and compliance, and its Risk Management Framework includes security-control selection, implementation, assessment, authorization, and monitoring.