Trust is market access. Engineer it to hold.
I'm Harry West, Trust Architect: twenty years in cybersecurity, including Global CISO roles. GRCMANA is where I teach GRC Engineering. That means building security and governance that run all year and leave their own evidence, so you can prove trust whenever a buyer, auditor or regulator asks, not just in audit week.
Most compliance work produces documents. Buyers and regulators are looking for evidence.
I call the distance between what a company can prove and what its buyer, auditor or regulator needs to see the Enterprise Trust Gap.
Most companies close it by hand. Before each audit, evidence gets chased, screenshots get collected and policies get refreshed. Then it all decays until the next one. An evidence trail built by hand doesn't hold.
GRC Engineering closes the gap for good: controls that run, evidence collected at source, and monitoring that flags drift as it happens rather than at the next audit. That's what I teach, whether you've just been handed compliance or it's your career.
Security leadership across financial services, cloud services and the UK public sector.
Testing whether technology suppliers' controls actually ran, in financial services.
Mapped in the Vault's free Framework Navigator, so you can see which ones your buyers will ask about.
The questionnaire looks different from the other side from the other side.
Harry West | Trust Architect.
Former Global CISO at Pepper Advantage and at Rackspace Technology. Former Head of Information Security at the UK National Audit Office.
I've spent around 20 years in cybersecurity and GRC. For four of them, my job was deciding whether suppliers passed or failed security review.
The pattern rarely changed. Good companies with real products stalled because nobody could show that their controls actually ran. They had the documents but not the evidence trail.
That's why I teach GRC Engineering rather than paperwork. GRCMANA exists so the person who's been handed this work can build controls that prove themselves.
Six rules, everything I publish.
Compliance as an engineered system, not an annual scramble. Every guide, template and toolkit is held to these.
Only what matters
Every guide starts from what a buyer or auditor will actually sample and says what you can leave out.
ProportionateEvidence over documents
A policy is a promise. I show the evidence each control should leave behind, and where in your existing tools it comes from.
EvidenceBuilt to run
Controls that operate and evidence that collects itself, so the next audit draws on what already happened, not a scramble the week before.
EngineeredPeople make the judgements
Automation collects and monitors. Scoping, risk and what an auditor will accept stay with people. I teach both halves.
JudgementYou keep everything
Tools, templates and toolkits are editable files you own. Use them in whatever tools you already run; no platform required.
OwnershipHonest about fit
If a different framework, a tool or a hire is the better answer, I'll say so, including when it isn't something I make.
CandourGRC, plus mana.
Mana is a Māori and Polynesian concept: authority, standing and the power to act, earned through what you do. I came across it while living in New Zealand, and it stayed with me.
It describes what well-engineered governance gives a company: the standing to perform when it matters, whatever happens around it. Not a certificate on the wall, but trust that holds when someone tests it. That's the brief.
Built for the people doing the work. Deliberately.
Who this is for
- Anyone who has just been handed security compliance on top of their real job
- Engineers, ops leads and CTOs facing a first security questionnaire, ISO 27001 or SOC 2
- GRC analysts, security leads and compliance managers who want to engineer compliance instead of chasing it
- Practitioners in UK and international B2B companies of 20 to 250 people that sell to enterprise and regulated customers
Who this is not for
- Anyone looking to hire a consultant. I don't take on client work
- Anyone after a certificate with no plan to run the controls afterwards
- Anyone who wants a binder that looks good rather than controls that run
- Anyone hoping a tool will do the thinking for them. Automation collects; people decide
Follow along. One email a week.
Zero-fluff frameworks, tactical playbooks, and automation blueprints to turn governance from a corporate blocker into a growth accelerator.