Explain the role of governance, risk, and compliance (GRC) in integrated defense and provide an example of a control.

• A. GRC aligns defense activities with legal/ethical standards and manages risk; example: access governance, least privilege.
• B. GRC focuses solely on physical security.
• C. GRC is the same as IT security.
• D. GRC only handles budgets.

Answer: (A)

In integrated defense, governance, risk, and compliance bring structure to how decisions are made, risks are identified and mitigated, and legal and policy requirements are satisfied across the whole defense enterprise. Governance sets the policies, roles, and oversight that define who makes what decisions and how those decisions are enforced. Risk management pinpoints potential threats or failures, evaluates their likelihood and impact, and puts controls in place to reduce risk to an acceptable level. Compliance ensures activities meet applicable laws, standards, and ethical obligations, and that there is verifiable evidence of that adherence. Together, GRC helps ensure operations are aligned with mission objectives, remain resilient against diverse threats, and can be audited and held accountable.

A concrete control example is access governance with least privilege. This means restricting user access to only what is necessary to perform their duties, assigning permissions by clearly defined roles, and regularly reviewing and updating those permissions. It also involves logging access and enforcing separation of duties. In defense terms, this minimizes exposure of sensitive information and critical systems, reduces insider risk, and strengthens accountability, which directly supports governance and compliance objectives.

These elements are broader than any one domain like physical security, IT security, or budgeting; they create an integrated framework that governs, protects, and sustains defense operations.