GRC & The Min & Max of Multi-Framework Optimization
summary
Explains a repeatable method that turns NIST artifacts and a simple spreadsheet into an audit-ready control map that collapses duplicate controls across NIST CSF 2.0 and SP 800-53 Rev.5 and aligns to RMF outputs; produces a sample mapping table (built with AI assistance) and reports it takes about four hours for an experienced practitioner to produce a first-pass table. Claims the map reduces evidence duplication and shows cause–effect of framework choices, but warns the table must be validated—documentation doesn’t equal implemented controls.
AI-written summary · about
chapters (15)
- 0:00Introduction and welcome
- 1:30GRC overview and objectives
- 3:00NIST and framework definitions
- 8:16NIST CSF 2.0 core and profiles
- 13:21NIST SP 800-37 risk management
- 15:30NIST SP 800-53 controls overview
- 16:52Framework alignment for compliance
- 27:36Risk management strategy deep dive
- 30:06Compliance lens and policies
- 33:15Optimizing for multi-framework compliance
- 36:10AI role in GRC and limitations
- 41:16Human expertise vs automation
- 45:08Reality perception and information science
- 50:16Compliance verification and evidence
- 56:45Q&A and closing discussion
related talks
40mThree’s Company: Unpacking and Settling in with Three NIST Frameworks
44mImprove Likelihood Calculation by Mapping MITRE ATT&CK to Existing Controls
40mCompliance Made Easy—Simplify Your Approach to Privacy
29mMeasuring Cybersecurity Maturity with the NIST CSF
31m📗 Rehearsal is Over: Moving GRC Engineering from Theory into Practice ⚖️
24mSecurity Compliance as Code
35mRevolutionizing Cyber Defense: The NIST CSF 2.0 Advantage
30mFireproof Your Castle with Risk-First GRC