<?xml version="1.0" encoding="UTF-8"?>
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9" xmlns:news="http://www.google.com/schemas/sitemap-news/0.9" xmlns:xhtml="http://www.w3.org/1999/xhtml" xmlns:mobile="http://www.google.com/schemas/sitemap-mobile/1.0" xmlns:image="http://www.google.com/schemas/sitemap-image/1.1" xmlns:video="http://www.google.com/schemas/sitemap-video/1.1">
<url><loc>https://www.grcmana.io/blog/iso-27001-vs-soc-2</loc><lastmod>2026-10-22T17:34:14.815Z</lastmod></url>
<url><loc>https://www.grcmana.io/blog/mapping-soc-2-to-iso-27001</loc><lastmod>2026-10-22T17:33:59.820Z</lastmod></url>
<url><loc>https://www.grcmana.io/blog/soc-1-vs-soc-2-which-one-do-you-need</loc><lastmod>2026-10-22T17:33:45.782Z</lastmod></url>
<url><loc>https://www.grcmana.io/blog/insider-threats</loc><lastmod>2026-10-22T12:30:04.143Z</lastmod></url>
<url><loc>https://www.grcmana.io/blog/common-threat-sources</loc><lastmod>2026-10-22T17:33:31.076Z</lastmod></url>
<url><loc>https://www.grcmana.io/blog/cloud-security-risks</loc><lastmod>2026-10-22T12:28:41.571Z</lastmod></url>
<url><loc>https://www.grcmana.io/blog/identity-threats</loc><lastmod>2026-10-22T12:28:29.207Z</lastmod></url>
<url><loc>https://www.grcmana.io/blog/ai-security-risks</loc><lastmod>2026-10-22T12:28:15.903Z</lastmod></url>
<url><loc>https://www.grcmana.io/blog/social-engineering-attacks</loc><lastmod>2026-10-22T12:28:03.870Z</lastmod></url>
<url><loc>https://www.grcmana.io/blog/ai-governance-framework</loc><lastmod>2026-10-22T11:26:51.340Z</lastmod></url>
<url><loc>https://www.grcmana.io/blog/ai-accountability</loc><lastmod>2026-10-19T14:16:47.873Z</lastmod></url>
<url><loc>https://www.grcmana.io/blog/inside-the-vault-knowledge-base</loc><lastmod>2026-10-22T11:29:12.697Z</lastmod></url>
<url><loc>https://www.grcmana.io/blog/why-we-built-grcmana</loc><lastmod>2026-10-22T11:28:02.372Z</lastmod></url>
<url><loc>https://www.grcmana.io/blog/grc-engineering-compliance-as-code</loc><lastmod>2026-10-22T11:28:59.272Z</lastmod></url>
<url><loc>https://www.grcmana.io/blog/continuous-compliance-end-audit-season</loc><lastmod>2026-10-22T11:27:20.554Z</lastmod></url>
<url><loc>https://www.grcmana.io/blog/uk-compliance-landscape</loc><lastmod>2026-10-22T11:30:08.743Z</lastmod></url>
<url><loc>https://www.grcmana.io/blog/incident-disclosure-playbook</loc><lastmod>2026-10-22T11:27:47.743Z</lastmod></url>
<url><loc>https://www.grcmana.io/blog/security-questionnaires-trust-signal</loc><lastmod>2026-10-22T11:27:07.223Z</lastmod></url>
<url><loc>https://www.grcmana.io/blog/trust-centre-new-landing-page</loc><lastmod>2026-10-22T11:27:33.953Z</lastmod></url>
<url><loc>https://www.grcmana.io/blog/shadow-ai-governance</loc><lastmod>2026-10-22T11:28:30.556Z</lastmod></url>
<url><loc>https://www.grcmana.io/blog/iso-42001-decoded</loc><lastmod>2026-10-22T11:30:22.747Z</lastmod></url>
<url><loc>https://www.grcmana.io/blog/eu-ai-act-saas-obligations</loc><lastmod>2026-10-22T11:28:16.179Z</lastmod></url>
<url><loc>https://www.grcmana.io/blog/incident-response-metrics</loc><lastmod>2026-10-22T11:29:53.409Z</lastmod></url>
<url><loc>https://www.grcmana.io/blog/third-party-risk-perimeter</loc><lastmod>2026-10-22T11:29:26.226Z</lastmod></url>
<url><loc>https://www.grcmana.io/blog/designing-for-the-breach</loc><lastmod>2026-10-22T11:28:45.196Z</lastmod></url>
<url><loc>https://www.grcmana.io/blog/compliance-automation-what-first</loc><lastmod>2026-08-24T17:46:34.128Z</lastmod></url>
<url><loc>https://www.grcmana.io/blog/risk-register-not-graveyard</loc><lastmod>2026-10-22T11:29:39.330Z</lastmod></url>
<url><loc>https://www.grcmana.io/blog/grc-program-first-90-days</loc><lastmod>2026-10-19T06:05:56.669Z</lastmod></url>
</urlset>