{"version":"0.2.0","built_at":"2026-10-10T20:58:14.188Z","license":"CC BY 4.0 © Mike Reams","canonical":"https://catalog.mikereams.com","capability":{"id":"BC-760.10","name":"Security Governance & Risk","level":2,"parent_id":"BC-760","l1_id":"BC-760","industry":"cross-industry","macro_id":"MC-70","path":["Cybersecurity","Security Governance & Risk"],"description":"Set the security policies and control framework, assess where the real risks are and prove to leadership and auditors that the controls that matter are in place and working.","aliases":["Security GRC","Security Risk Management","Security Assurance"],"in_scope":["Security policy and standards","Security risk assessment and treatment","Control testing and audit support","Security awareness and training content"],"out_of_scope":["IT policy framework beyond security (see BC-710)","Internal audit independence and planning (see BC-160)"],"csdm_note":null,"status":"active","successor_id":null,"child_ids":["BC-760.10.10","BC-760.10.20","BC-760.10.30","BC-760.10.40"]},"crosswalk":{"realized_by":[],"used_in":[],"patterns":[],"stacks":[],"books":[{"id":"BK-security-engineering","title":"Security Engineering","topic":"Security","via":null}]},"ancestors":[{"id":"BC-760","name":"Cybersecurity","level":1}],"children":[{"id":"BC-760.10.10","name":"Security Policy & Standards","level":3,"child_count":0},{"id":"BC-760.10.20","name":"Security Risk Assessment","level":3,"child_count":0},{"id":"BC-760.10.30","name":"Control Assurance","level":3,"child_count":0},{"id":"BC-760.10.40","name":"Security Awareness","level":3,"child_count":0}]}