Abstract
The technological solutions offered today evolve at a rapid pace, as this happens, risk management and security practices are becoming more relevant and in fact, now a necessity for most growing organisation. Governance, Risk management and compliance (GRC) are established and well-adhered functions in a business which have individually always been very important in business management. As individual topics, the application of all concepts have been fundamental for businesses in order to manage risks. However, over the years, the term GRC was developed and applied to describe the integration between the various areas due to the reason that a monolithic approach between the functions was no longer feasible in successful management of business risk. However IT GRC has been dealt with an isolated manner from IT Security. In this paper we explore IT GRC and Security and propose an integrated context adaptive framework that addresses the problems of monolithic approaches.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
IBM: SAP Security and GRC Services (2015). https://www-01.ibm.com/common/ssi/cgi-bin/ssialias?htmlfid=SES03016USEN
ISACA: The Risk IT Framework – Excerpt (2009). http://www.isaca.org/knowledge-center/research/documents/risk-it-framework-excerpt_fmk_eng_0109.pdf
De Smet, D., Mayer, N.: Integration of IT governance and security risk management : a systematic literature review, no. 1, pp. 143–148 (2016)
Racz, N., Seufert, A., Weippl, E.: A process model for integrated IT governance, risk, and compliance management. In: Proceedings of the Ninth Baltic Conference on Databases and Information Systems (DB&IS 2010), p. 155 (2010)
Kuppinger, M.: IT GRC and IT Security - Where is the link? (2010). https://www.kuppingercole.com/blog/kuppinger/grc_it_security_link180210
Vicente, P., Da Silva, M.M.: A business viewpoint for integrated IT governance, risk and compliance. In: 2011 IEEE World Congress on Services, pp. 422–428 (2011)
Racz, N., Weippl, E., Seufert, A.: A frame of reference for research of integrated governance, risk and compliance (GRC). In: De Decker, B., Schaumüller-Bichl, I. (eds.) CMS 2010. LNCS, vol. 6109, pp. 106–117. Springer, Heidelberg (2010). https://doi.org/10.1007/978-3-642-13241-4_11
Recor, J., Xu, H.: GRC technology introduction. In: Tian, W. (ed.) Commercial Banking Risk Management, pp. 305–331. Palgrave Macmillan US, New York (2017). https://doi.org/10.1057/978-1-137-59442-6_14
Racz, N., Weippl, E., Seufert, A.: Governance, risk & compliance (GRC) software – an exploratory study of software vendor and market research perspectives, pp. 1–10 (2011)
Smith, R.: Seven things you need to know about IT controls. SOX Committee Integration Consortium (2004). www.integrationconsortium.org
COSO (2004). https://www.coso.org/documents/COSOBoardsERM4pager-FINALRELEASEVERSION82409_001.pdf
Fowler-Rians, K.: Determinants of federal regulation compliance: a study of the employee trip reduction program. Unpublished Doctoral Dissertation, University of Houston (1997)
Frigo, M.L., Anderson, R.J.: A strategic framework for governance, risk, and compliance. Strateg. Financ. 90(8), 20–61 (2009)
Rasmussen, M.: Value of a Common Architecture for GRC Platforms Business Burdened by Varying Risk & Value of a Common, pp. 1–8 (2010)
Asnar, Y., Massacci, F.: A method for security governance, risk, and compliance (GRC): a goal-process approach. In: Aldini, A., Gorrieri, R. (eds.) FOSAD 2011. LNCS, vol. 6858, pp. 152–184. Springer, Heidelberg (2011). https://doi.org/10.1007/978-3-642-23082-0_6
Rashid, F.: How to Leverage GRC for Security (2013). http://www.bankinfosecurity.com/how-to-leverage-grc-for-security-a-6164
Anand, S.: Technology and the Integration of Governance, pp. 57–59, December 2010
AMR Research: November 2009 GRC in 2010 : $ 29.8B in Spending Sparked by Risk, Visibility, and Efficiency (2010)
Linkous, J.: Put the “i” in IT compliance. Commun. News 45(12), 26 (2008)
Ekelhart, A., Fenz, S., Klemen, M., Weippl, E.: Security ontologies: improving quantitative risk analysis. In: Proceedings of the Annual Hawaii International Conference on System Sciences, pp. 1–7 (2007)
Damianides, M.: Sarbanes-Oxley and it governance: new guidance on it control and compliance. Inf. Syst. Manag. 22(1), 77–85 (2005)
Grob, H.L., Strauch, G., Buddendick, C.: Applications for IT-risk management – requirements and practical evaluation, pp. 758–764 (2008)
Kraemer, S., Carayon, P.: Human errors and violations in computer and information security: the viewpoint of network administrators and security specialists. Appl. Ergon. 38, 143–154 (2007)
Chang, S.E., Ho, C.B.: Organizational factors to the effectiveness of implementing Information security management. Ind. Manag. Data Syst. 106(3), 345–361 (2006)
Kankanhalli, A., Teo, H.-H., Tan, B.C., Wei, K.-K.: An integrative study of information systems security effectiveness. Int. J. Inf. Manag. 23, 139–154 (2003)
Werlinger, R., Hawkey, K., Beznosov, K.: An integrated view of human, organizational, and technological challenges of IT security management. Inf. Manag. Comput. Secur. 17(1), 4–19 (2009)
Da Veiga, A., Eloff, J.: An information security governance framework. Inf. Syst. Manag. 24(4), 361–372 (2007)
Parent, M., Reich, B.: Governing information technology risk. Calif. Manag. Rev. 51(3), 134–152 (2009)
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2018 ICST Institute for Computer Sciences, Social Informatics and Telecommunications Engineering
About this paper
Cite this paper
Govindji, S., Peko, G., Sundaram, D. (2018). A Context Adaptive Framework for IT Governance, Risk, Compliance and Security. In: Cong Vinh, P., Ha Huy Cuong, N., Vassev, E. (eds) Context-Aware Systems and Applications, and Nature of Computation and Communication. ICTCC ICCASA 2017 2017. Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering, vol 217. Springer, Cham. https://doi.org/10.1007/978-3-319-77818-1_2
Download citation
DOI: https://doi.org/10.1007/978-3-319-77818-1_2
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-319-77817-4
Online ISBN: 978-3-319-77818-1
eBook Packages: Computer ScienceComputer Science (R0)