# Governance, Risk, and Compliance Strategy Design

> Chapter 3 of the Courseiva SC-100 curriculum — https://courseiva.com/learn/sc-100/governance-risk-and-compliance-strategies

**Official objective:** 1.3 — Design governance, risk, and compliance strategies

## Introduction

Exam objective 1.3 asks you to design governance, risk, and compliance strategies — the rules and checks that keep a cloud environment safe and legal. For SC-100, this matters because security architects do not just build walls; they define how an organisation decides what to protect, how to measure threats, and how to prove they followed the rules.

## The Restaurant Health Inspector Analogy

A head chef runs a busy restaurant kitchen. They do more than just cook — they design the entire system for how food is prepared, stored, and served. They write the recipe book that every cook must follow (the governance framework). They identify risks like cross-contamination or undercooked chicken, and they put controls in place — colour-coded chopping boards, temperature logs, hand-washing stations — to manage those risks (the risk management strategy). They also make sure the kitchen passes health inspections, meets food safety laws, and keeps allergen information accurate for customers (compliance).

The head chef does not personally wash every dish; they design the system so every team member knows the procedures, the risks are documented, and the kitchen stays compliant with regulations like HACCP (the equivalent of compliance standards). If a health inspector arrives, the chef can prove the kitchen follows its own rules. If a customer gets ill from an undeclared allergen, the chef can trace the ingredient back to the supplier. That's governance, risk, and compliance — but in a kitchen, not a cloud.

## Core explanation

Governance, risk, and compliance (often shortened to GRC) is the framework an organisation uses to make sure its cloud systems are secure, lawful, and managed responsibly. Let us break each word down.

Governance is the set of policies, roles, and decision-making rules that control how cloud resources are used. Think of it as the constitution for your cloud — who can approve spending, who can approve adding a new service, and what data can be stored where. In Microsoft Azure, governance tools include Azure Policy, which enforces rules (for example, 'all storage accounts must use encryption'), and management groups, which let you apply rules to whole collections of subscriptions. Without governance, different teams might set up their own cloud accounts with no consistent security — a recipe for confusion and vulnerabilities.

Risk management is the process of identifying what could go wrong, estimating how likely it is, and deciding what to do about it. Not every risk needs to be eliminated; some are acceptable if the cost of fixing them is higher than the potential damage. In cloud security, common risks include data breaches, accidental exposure of sensitive information, account takeover, and compliance fines. Risk management follows a cycle: identify the risk, assess its impact and likelihood, decide on a response (avoid, reduce, transfer, or accept), and then monitor. Azure tools like Microsoft Defender for Cloud and Microsoft Purview help you discover vulnerabilities and classify sensitive data.

Compliance means following laws, regulations, and industry standards. If your company handles credit card data, you must comply with PCI DSS. If you store health data in the US, you must comply with HIPAA. If you operate in Europe, you need to meet GDPR requirements. Compliance is not optional — regulators can fine companies millions for failing to protect customer data. Azure provides compliance offerings, such as the Service Trust Portal, where you can see Microsoft's certifications, and Compliance Manager, which helps you track your compliance posture against standards.

GRC replaces the old approach where security was an afterthought. Before cloud computing, companies often had separate teams managing security, legal, and IT operations, and they rarely talked to each other. GRC forces them to work together. A security architect designs the GRC strategy so that every new cloud service is automatically subject to the same rules, risks are reviewed every time something changes, and compliance evidence is collected continuously rather than scrambled together before an audit.

For SC-100, you need to understand how these three pieces fit together. The exam expects you to know which Azure services belong to which part of GRC. For example:
- Azure Policy is a governance tool (it enforces rules).
- Microsoft Defender for Cloud is a risk management tool (it identifies vulnerabilities and threats).
- Azure Compliance Manager is a compliance tool (it tracks your adherence to standards).
- Microsoft Entra ID (formerly Azure Active Directory) is part of governance because it controls who has access to what.
- Azure Blueprints (soon to be replaced by deployment stacks) let you package governance rules into repeatable templates.

GRC is not just about tools — it is about creating a culture where security is everyone's responsibility. Policies must be written clearly and enforced automatically where possible. Risk assessments must be documented and reviewed regularly. Compliance evidence must be stored and easy to retrieve. The security architect designs this system so the organisation can innovate quickly without breaking the rules.

## Real-world context

An IT professional — specifically a security architect — does not sit in a dark room typing commands all day. They spend a significant amount of time in meetings, writing documents, and designing frameworks.

Here is a concrete scenario. Sarah is a security architect at a mid-sized retail company that is migrating its customer-facing website to Azure. The company stores credit card numbers (PCI DSS requirement), personal data of European customers (GDPR requirement), and employee health records (HIPAA requirement, because they are a self-insured employer).

Step one: Sarah holds a workshop with the legal team, the compliance officer, and the IT operations manager. They list all the regulations that apply. She then maps each regulation to specific Azure services. For PCI DSS, she knows they need network segmentation and logging, so she designs an Azure network architecture with firewalls and ensures Azure Monitor logs are sent to a central Log Analytics workspace.

Step two: She uses Azure Policy to create a governance baseline. She writes a policy that blocks any storage account from being created unless it has encryption enabled and logging turned on. She assigns this policy to all subscriptions at the management group level. This automates compliance — no developer can accidentally create an insecure storage account.

Step three: Sarah conducts a risk assessment. She identifies the top three risks: a misconfigured database exposing customer data, an employee sharing their password, and a ransomware attack encrypting files. She decides to reduce the database risk by requiring Azure SQL Database's Advanced Data Security feature and by setting up Microsoft Defender for Cloud alerts. For the password risk, she enforces multi-factor authentication via Conditional Access policies in Microsoft Entra ID. For ransomware, she implements Microsoft Defender for Cloud Apps alerts and backup policies.

Step four: She sets up Azure Compliance Manager. She configures it to track progress against PCI DSS and GDPR controls. Every quarter, the team reviews the Compliance Manager score and updates their status. When the external auditor arrives, Sarah exports a PDF report showing they have met 98% of controls and have remediation plans for the remaining 2%.

Step five: She writes a GRC strategy document. This includes: the governance structure (who approves new subscriptions), the risk management process (how often to assess risks, who reviews them), and the compliance monitoring schedule (monthly automated checks, quarterly manual reviews). The document is approved by the board of directors.

This is what an IT professional does with GRC. They design the system, configure the tools, write the policies, and then keep everything running with regular reviews and updates.

## Exam focus

SC-100 tests your ability to design GRC strategies, not just memorise tool names. The exam expects you to understand the relationships between concepts and to choose the right architectural approach for a given scenario.

Questions on this topic often present a scenario where a company has a compliance requirement (like GDPR or PCI DSS) and asks you what to do. Common question patterns include:
- 'Your company must comply with GDPR. Which Azure service should you use to enforce data residency?' (Answer: Azure Policy, because you can prevent resources from being created in data centres outside the EU.)
- 'Your company wants to automate compliance checks. Which tool tracks your compliance posture against industry standards?' (Answer: Azure Compliance Manager.)
- 'What is the difference between Azure Policy and Azure Role-Based Access Control (RBAC)?' (Azure Policy enforces rules on resources; RBAC controls who can access those resources.)

Traps to watch out for:
- The exam might try to confuse Azure Policy with RBAC. Remember: policy is about 'what is allowed' (like 'all storage must be encrypted'), while RBAC is about 'who can do what' (like 'only admins can create storage accounts'). They work together but are different services.
- Another trap is confusing risk assessment with vulnerability scanning. Risk assessment is a broader process that considers business impact, likelihood, and acceptable risk. Vulnerability scanning is a technical activity that finds missing patches.
- The exam may present a scenario with multiple compliance standards and ask which Azure service covers all of them. The answer is typically Azure Compliance Manager, because it can track multiple regulations against the same resource inventory.

Key concepts you must memorise for the exam:
- The three pillars of GRC: Governance (policies, roles, processes), Risk (identification, assessment, response), Compliance (laws, standards, audits).
- Azure Policy enforces governance rules at resource creation time (preventive) and can also audit existing resources (detective).
- Microsoft Defender for Cloud provides a 'Secure Score' that measures your risk posture.
- Azure Compliance Manager uses 'controls' (individual requirements) that map to regulations.
- Conditional Access policies in Microsoft Entra ID are a governance tool for access control based on conditions like location, device, or risk level.
- The Microsoft Service Trust Portal provides certifications and reports that prove Azure's own compliance.

The exam will not ask you to list all GRC tools. Instead, it will present a business problem and ask you to choose the best combination of services to solve it. You must be comfortable with scenario-based questions where the answer is 'Use Azure Policy to enforce encryption and use Azure Compliance Manager to track progress.'

## Step by step

1. **Identify Applicable Regulations** — Start by listing all laws and industry standards that apply to your organisation based on the data you handle (credit card data, health records, personal data of EU residents, etc.) and the geographic regions where you operate. This step determines what compliance controls you must implement.
2. **Define Governance Policies** — Write clear policies that dictate what cloud resources can be created, where they can be deployed, and who can approve changes. Use Azure Policy to encode these rules so they are enforced automatically on all new resources across management groups and subscriptions.
3. **Conduct a Risk Assessment** — Identify the top threats to your cloud environment (data breach, account compromise, misconfiguration, ransomware). Rate each by impact and likelihood. Decide on a response for each — reduce with controls, transfer with insurance, accept, or avoid by not using that service.
4. **Implement Risk Controls** — Deploy Azure services that address the identified risks. For example, enable Microsoft Defender for Cloud for threat detection, configure Conditional Access policies for stronger authentication, and use network security groups to segment traffic. Map each control to the regulation it supports.
5. **Set Up Continuous Compliance Monitoring** — Configure Azure Compliance Manager to track control status against your chosen regulations. Schedule regular reviews of the Compliance Manager score and create remediation plans for any failed controls. Enable automatic alerts for new non-compliant resources.
6. **Document and Communicate the GRC Strategy** — Write a strategy document that summarises governance roles, the risk management process, and compliance monitoring schedule. Obtain approval from senior leadership. Share the strategy with all relevant teams so they understand their responsibilities.

## Comparisons

### Azure Policy vs RBAC

**Azure Policy:**
- Enforces rules on the configuration of resources (e.g., require encryption).
- Prevents creation or modification of non-compliant resources.
- Works at the subscription, resource group, or individual resource scope.

**RBAC:**
- Controls who can perform actions on resources (e.g., who can delete a VM).
- Uses role definitions like Owner, Contributor, Reader to grant permissions.
- Works at management group, subscription, resource group, or resource scope.

### Risk Assessment vs Vulnerability Scanning

**Risk Assessment:**
- Business process that evaluates impact and likelihood of threats.
- Considers financial, legal, and operational consequences.
- Produces a risk register and prioritised list of actions.

**Vulnerability Scanning:**
- Technical activity that finds missing patches or misconfigurations.
- Produces a list of CVEs (Common Vulnerabilities and Exposures).
- Is one input into a broader risk assessment.

### GDPR vs PCI DSS

**GDPR:**
- Regulates the processing of personal data of EU citizens.
- Requires data protection impact assessments and breach notifications.
- Applies to any organisation handling EU data, regardless of location.

**PCI DSS:**
- Regulates the handling of credit card data.
- Requires network segmentation, logging, and annual audits.
- Applies to merchants and service providers that process card payments.

### Azure Compliance Manager vs Azure Service Trust Portal

**Azure Compliance Manager:**
- Tool for tracking your own compliance posture against regulations.
- Lets you create assessments and monitor control status.
- Generates reports for internal use and auditors.

**Azure Service Trust Portal:**
- Repository of Microsoft's own compliance certifications and audit reports.
- Provides evidence that Azure meets industry standards.
- Is read-only — you cannot track your own controls here.

## Diagram

_This flowchart shows how governance, risk, and compliance work together as a continuous cycle to create and maintain a secure cloud environment._

```mermaid
flowchart TD
    A[Governance: Azure Policy, RBAC, Management Groups] --> B[Define Rules and Roles]
    C[Risk: Microsoft Defender for Cloud, Risk Assessment] --> D[Identify and Prioritise Threats]
    E[Compliance: Compliance Manager, Service Trust Portal] --> F[Track, Report, Audit]
    B --> G[Enforce Controls]
    D --> G
    G --> H[Secure Cloud Environment]
    F --> H
    H --> I[Continuous Improvement]
    I --> B
    I --> C
    I --> E
```

## Common misconceptions

- **Misconception:** Governance, risk, and compliance are three separate projects handled by three separate teams that never need to talk to each other. **Reality:** GRC is an integrated system where governance defines the rules, risk management identifies what to protect against, and compliance verifies the rules are followed. These three functions must work together to be effective. (In many companies, legal handles compliance, security handles risk, and IT handles governance — separately. The exam tests the integrated view because isolation creates gaps.)
- **Misconception:** If you use Azure Policy to block non-compliant resources, you do not need to do risk assessments anymore. **Reality:** Azure Policy enforces rules but cannot identify new or emerging risks, like a new vulnerability in a software library. Risk assessments must happen proactively and continuously, regardless of automated policy enforcement. (Newcomers often think automation replaces human judgment. The exam tests that risks must be assessed even when policies are in place.)
- **Misconception:** Compliance standards like GDPR or PCI DSS are optional recommendations — you can ignore them if you think they do not apply. **Reality:** These are legally enforceable regulations. Non-compliance can result in massive fines (up to 4% of global annual turnover for GDPR). You must design your cloud architecture to meet them if your data or customers fall under their scope. (Beginners sometimes treat compliance checklists as optional. The exam treats compliance as a hard requirement.)
- **Misconception:** A zero-trust architecture automatically makes you compliant with all regulations. **Reality:** Zero-trust (never trust, always verify) improves security but does not guarantee compliance with specific legal requirements like data residency, data retention periods, or breach notification rules. Compliance requires additional controls beyond zero-trust principles. (Zero-trust is a hot topic, so beginners overestimate its scope. The exam tests that compliance and zero-trust are distinct concepts.)
- **Misconception:** Once you set up Compliance Manager and pass an audit, you are done with compliance forever. **Reality:** Compliance is a continuous process. Regulations change, new resources are created, and your compliance posture degrades over time. Compliance Manager must be reviewed and updated regularly. (People think audits are a one-time event. The exam tests the principle of continuous compliance.)
- **Misconception:** Risk assessment means you must eliminate every identified risk completely. **Reality:** Risk management involves four possible responses: avoid (stop the risky activity), reduce (add controls), transfer (buy insurance or use a third party), or accept (acknowledge and monitor). Not all risks need to be eliminated — some are acceptable if the cost of mitigation exceeds the potential loss. (Beginners think risk management equals risk elimination. The exam tests that accepting risk is a valid strategy when justified.)

## Key takeaways

- Governance defines who makes decisions and what rules apply to cloud resources; risk management identifies and evaluates threats; compliance verifies adherence to laws and standards.
- Azure Policy enforces rules preventively and detects non-compliance — it is the primary governance tool in Azure.
- Microsoft Defender for Cloud provides a Secure Score that quantifies your risk posture and recommends actions to reduce it.
- Azure Compliance Manager maps your resources to multiple regulations (GDPR, PCI DSS, HIPAA) and tracks your compliance progress over time.
- Conditional Access policies in Microsoft Entra ID are a governance tool that control access based on user risk, device health, and location.
- Compliance is a continuous process, not a one-time audit — you must monitor and update controls regularly.
- Risk management includes four response options: avoid, reduce, transfer, and accept — you do not have to eliminate all risks.
- The Service Trust Portal provides Microsoft's own compliance certifications and audit reports for independent verification.

## FAQ

**What is the difference between Azure Policy and RBAC (Role-Based Access Control)?**

Azure Policy enforces rules on the configuration of resources (e.g., all storage must be encrypted). RBAC controls who can perform actions on those resources (e.g., only admins can create storage accounts). Policy focuses on 'what is allowed'; RBAC focuses on 'who is allowed'.

**How do I know which regulations apply to my company?**

Review the types of data you collect and store (credit cards, health data, personal data of EU citizens), the locations of your customers (GDPR applies to anyone in the EU), and your industry (healthcare must follow HIPAA, retail follows PCI DSS). Consult your legal and compliance teams for a definitive list.

**Do I need to be compliant with every regulation mentioned in Azure Compliance Manager?**

No. Azure Compliance Manager lists many regulations, but you should only track those that apply to your organisation. Select the ones relevant to your data and industry. Tracking irrelevant ones wastes effort and can create confusion during audits.

**What happens if an Azure Policy blocks a resource my team needs?**

The policy will deny the creation of the resource if it violates the rule. Your team should request an exception or change the policy through the governance approval process. Policies are not meant to block productivity — they are meant to enforce security baselines.

**Can I use a single Azure Compliance Manager dashboard for multiple customers or departments?**

Yes. Compliance Manager can organise assessments by group, so you can track compliance separately for different departments or customer environments. You create separate assessments within the same Compliance Manager workspace.

**What is the Service Trust Portal and when would I use it?**

The Service Trust Portal is a Microsoft website that publishes audit reports, compliance certifications, and data protection documentation for Azure, Microsoft 365, and other cloud services. You use it to prove to auditors that the underlying cloud platform meets industry standards (like ISO 27001).

**Is risk assessment only for security threats like hackers?**

No. Risk assessment covers any threat to achieving business objectives, including operational risks (system downtime), financial risks (cost overruns), legal risks (non-compliance fines), and compliance risks (failing an audit). You should assess all relevant categories.

## Check your understanding

1. **Which Azure service enforces rules that prevent non-compliant resources from being created in a subscription?**

   Answer: Azure Policy enforces rules on resource configurations, such as requiring encryption on all storage accounts.

2. **What is the difference between risk reduction and risk acceptance in a GRC strategy?**

   Answer: Risk reduction involves adding controls (like multi-factor authentication) to lower the impact or likelihood of a threat. Risk acceptance means acknowledging the risk exists but deciding not to mitigate it because the cost of mitigation outweighs the potential loss.

3. **Name two compliance regulations that Azure Compliance Manager can help track for a company that handles credit card data and EU citizen data.**

   Answer: PCI DSS (for credit card data) and GDPR (for EU citizen data).

4. **What role does Microsoft Entra ID play in governance?**

   Answer: Microsoft Entra ID provides identity and access management, including Conditional Access policies that enforce access rules based on user risk, device health, and location — this is a governance function.

5. **Why is compliance considered a continuous process rather than a one-time event?**

   Answer: Because regulations change, new resources are added, and existing controls may degrade over time. Continuous monitoring and regular reviews are needed to maintain compliance.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/sc-100/governance-risk-and-compliance-strategies