Product & Engineering department
Security and GRC work, run as a department
Security questionnaires, policy reviews and audit evidence tend to land on whoever happens to be free, usually an engineer with other work. Nexoryl runs the governance, risk and compliance workload as a managed department: policies, risk registers, control evidence, vendor reviews and security operations support, delivered remotely in your own tools.
The first button opens an email to info@nexoryl.com.
You bring
- Your systems, policies and obligations
- The frameworks or customers you answer to
- Access to where evidence lives
Nexoryl runs
- Policies
- Risk register
- Control evidence
- Vendor reviews
- Security ops support
You get
- Evidence ready before auditors ask
- Questionnaires answered consistently
- A risk register people actually review
- Operating model
- A managed GRC function with a control map, an evidence calendar and a quarterly risk review.
- Delivery model
- Remote. Work happens in your GRC platform or documentation tools, with read-only access to evidence sources where possible.
- Usual starting scope
- A gap assessment against one framework or a set of customer requirements.
- Typical roles
- A GRC lead, a compliance analyst and a security operations analyst.
- Runs inside
- Vanta, Drata or Secureframe if you use one; otherwise Jira, Confluence and structured registers.
- Engagement
- A gap assessment, then a readiness programme or monthly retainer.
Overview
What is GRC?
GRC, short for governance, risk and compliance, is the work of setting security and data policies, identifying and tracking risks, and showing evidence that controls are in place for frameworks, regulators or customers.
Common frameworks include ISO/IEC 27001, SOC 2 and the UK government's Cyber Essentials scheme, alongside data protection obligations such as UK GDPR. Most of the work is ongoing: evidence goes stale, policies need review, and every new supplier needs checking.
Nexoryl model
What does Nexoryl's Security & GRC department do?
It runs your compliance workload: writing and maintaining policies, keeping the risk register current, mapping controls to frameworks, collecting evidence, reviewing vendors, answering security questionnaires and supporting security operations.
Certification decisions are made by independent auditors or certification bodies, not by Nexoryl. The department prepares you for them and keeps you ready afterwards, working with IT Service Desk and DevOps & Cloud on the controls themselves.
- Responsible for
- Policies, risk registers, control mapping, evidence collection, audit request management, vendor reviews, security questionnaires and security operations support.
- Not included
- Issuing certifications or audit opinions, penetration testing, legal advice, and physical security.
- Connects to
- IT Service Desk, DevOps & Cloud, Legal & Compliance and Software Engineering.
The compliance cycle
How a compliance programme runs, year after year.
Compliance isn't a project with an end date. These six stages repeat, with the last feeding the next year's first.
- 01
Scope
Which frameworks, systems and obligations apply.
- 02
Assess
Current controls compared with requirements, and gaps identified.
- 03
Remediate
Policies written and control owners assigned to close the gaps.
- 04
Evidence
Evidence collected and organised against each control.
- 05
Audit support
Auditor requests answered with evidence already in place.
- 06
Maintain
Reviews, re-testing and evidence refreshed on a schedule.
Where compliance hurts
Four signs GRC work needs an owner.
Most companies have the controls. What they lack is the evidence, the upkeep and someone accountable for both.
Questionnaires answered from scratch
- Shows up as
- Every customer security questionnaire takes a week of engineering time.
- We look at
- Past answers and where the supporting evidence lives.
- What changes
- An answer library and evidence repository, kept current.
Policies written once
- Shows up as
- Policies that don't match how systems actually work today.
- We look at
- Policy content compared with real practice.
- What changes
- Policies rewritten to match practice, with owners and review dates.
An evidence scramble before audits
- Shows up as
- Screenshots gathered in the final fortnight.
- We look at
- How each control maps to evidence.
- What changes
- Evidence collected continuously against a control map.
A risk register nobody reads
- Shows up as
- A spreadsheet updated once a year, if at all.
- We look at
- Risk ownership and review cadence.
- What changes
- Risks with owners, treatments and a quarterly review.
What the department covers
Security and GRC services.
The governance work around your controls, done continuously rather than in a rush before each audit.
Governance and policy
Policies that match how you actually work.
- Information security policies
- Acceptable use and access policies
- Policy review cycles
- Policy acknowledgement tracking
Risk management
Risks identified, owned and reviewed.
- Risk register setup
- Risk assessments
- Treatment plans
- Quarterly risk reviews
Compliance readiness
Preparation for the frameworks you need.
- ISO/IEC 27001 readiness support
- SOC 2 readiness support
- Cyber Essentials preparation
- Control mapping across frameworks
Evidence and audit support
Evidence in place before anyone asks.
- Evidence collection
- Control testing support
- Auditor request management
- Remediation tracking
Third-party risk
Suppliers checked before they get your data.
- Vendor security questionnaires
- Supplier risk reviews
- Vendor inventory
- Contract security clause checks with your legal team
Security operations support
The recurring work that keeps controls alive.
- Access review coordination
- Alert triage support in your tools
- Incident logs and post-incident documentation
- Security awareness programme administration
How remote delivery works
How a GRC engagement runs.
Start with an honest gap assessment. Everything after it is planned against those gaps.
Step 1: Scope
Frameworks, customer requirements, systems and audit dates agreed.
Step 2: Gap assessment
Current controls and evidence compared with requirements.
Step 3: Remediation plan
Gaps prioritised, owners assigned and deadlines set.
Step 4: Run the programme
Policies, evidence, vendor reviews and questionnaires handled on a calendar.
Step 5: Audit support and review
Auditor requests managed, then the programme reviewed for next year.
Nexoryl prepares and organises evidence. Certification decisions are made by independent auditors or certification bodies, and legal interpretation stays with your advisers.
Scope and boundaries
What's included, and what stays with you.
Nexoryl does the governance work. Independent auditors certify; your leadership accepts risk.
Included
- Policy writing and maintenance
- Risk register and quarterly reviews
- Control mapping and evidence collection
- Audit request management
- Vendor reviews and security questionnaires
- Access review and incident documentation support
Not included
- Issuing certificates or audit opinions
- Penetration testing or red-team exercises
- Legal advice on regulations or contracts
- Physical security, guarding or site access control
- Guaranteeing an audit outcome
What you provide
- Read-only access to evidence sources where possible
- Named owners for each control
- Framework scope and audit dates
- A decision-maker for accepting risk
Tools and platforms
Where the work happens.
A GRC platform helps but isn't required. Structured registers in tools you already use work for smaller programmes.
- GRC platforms
- VantaDrataSecureframeStructured registers if you have none
- Identity and cloud
- Microsoft Entra IDOktaAWSGoogle CloudAzure
- Tickets and documents
- JiraConfluenceNotionSharePoint
- Security tooling
- Your SIEM or EDR console, read access
Named as examples of tools we work in. They don't imply a partnership or certification.
Measurement
How a GRC department is measured.
The aim is a programme that's always ready, not one that peaks before each audit.
Readiness
- Controls with current evidence
- Gaps closed against plan
- Audit requests met on time
Risk
- Risks with owners and treatments
- Overdue risk reviews
- Accepted risks documented
Third parties
- Vendors reviewed before onboarding
- Questionnaire turnaround
- High-risk vendors with action plans
Operations
- Access reviews completed
- Incidents documented on time
- Policy acknowledgement rate
These are measurement categories, not promised figures.
Who does the work
The people running your compliance programme.
Three roles cover most programmes. Multi-framework programmes add analysts rather than management.
GRC Lead
Owns the programme, the control map and the relationship with your auditors.
Compliance Analyst
Collects evidence, maintains policies and handles questionnaires and vendor reviews.
Security Operations Analyst
Supports access reviews, alert triage and incident documentation in your tools.
A good fit when
- Customer security questionnaires keep pulling engineers off product work
- You're preparing for ISO/IEC 27001, SOC 2 or Cyber Essentials
- Audit evidence is gathered in a rush every year
- Supplier reviews happen inconsistently or not at all
Probably not the right fit when
- You need a certification body or auditor
- You need a penetration test
- You need physical security or guarding
Ways to start
Three ways to begin.
A gap assessment tells you how far you are from where you need to be, and what to fix first.
Gap assessment
Controls and evidence reviewed against one framework or set of customer requirements, with a remediation plan.
Readiness programme
Policies, controls and evidence brought up to audit-ready as a scoped project.
Managed GRC department
Ongoing policies, evidence, vendor reviews and questionnaires on a monthly retainer.
Fees depend on frameworks, systems in scope and audit timelines, and are agreed after the gap assessment.
Questions
Questions about security and GRC.
If your question isn't here, email us. The answer usually depends on your frameworks and customers.
What does GRC stand for?
Governance, risk and compliance: setting security policies, managing risks, and showing evidence that controls meet frameworks, regulations or customer requirements.
Is Nexoryl an auditor or certification body?
No. Nexoryl prepares you for audits and keeps you ready afterwards. Certification and audit opinions come from independent, accredited auditors or certification bodies.
Can you help us get ISO/IEC 27001 or SOC 2?
We can run the readiness work: gap assessment, policies, control mapping, evidence collection and auditor request management. The certificate or report itself is issued by an independent auditor.
Do you do penetration testing?
No. Penetration testing needs a specialist security firm. We can help track remediation and record the evidence afterwards.
Can GRC work be done remotely?
Yes. Policies, registers, evidence collection, questionnaires and vendor reviews are all digital work, done in your GRC platform or documentation tools.
Can you answer customer security questionnaires?
Yes. We build an answer library and evidence repository, then complete questionnaires consistently, with technical questions confirmed by your engineers where needed.
What access do you need?
Read-only access to evidence sources wherever possible, plus your GRC platform or documentation tools. Access is scoped per role and removable at any time.
What do you need from us to start?
The frameworks or customer requirements you need to meet, any audit dates, named control owners and a decision-maker for risk acceptance.
Next step
Make audits and questionnaires routine.
Tell us which frameworks or customers you answer to. We'll start with a gap assessment and an honest view of what's missing.