GRC
Building a GRC Program From Zero: The First 90 Days
A practical 90-day sequence for standing up governance, risk, and compliance in a startup that has none.
Key Takeaways
A first GRC program needs three things in ninety days: a risk register the leadership team actually reviews, a minimal policy baseline, and named control owners.
- First artefact
- A living risk register, reviewed monthly
- Policy baseline
- 8–12 policies, not forty
Most startups meet GRC the hard way: an enterprise prospect sends a security questionnaire and suddenly "we should write some policies" becomes a board topic. The good news is that a credible first program takes a quarter to stand up — if you sequence it deliberately instead of buying a forty-policy template pack.
The sequencing matters more than the artefacts. Teams that start by downloading policy templates end up with documents describing a company that does not exist, and the gap shows the moment a reviewer asks a follow-up question. Teams that start with risk, then write only the policies their risks demand, then wire ownership into real calendars, end the quarter with something smaller but true — and true is what survives scrutiny.
Days 1–30: Make Risk Visible
Start with a risk register, not policies. Interview the founders and engineering leads, write down the fifteen things most likely to hurt the company, and score them roughly for likelihood and impact. Precision does not matter yet; shared visibility does.
Put the register in front of leadership before the month ends and agree the top five. Everything else in the program hangs off this list — controls exist to treat risks, not to decorate audits.
Days 31–60: The Minimal Policy Baseline
Write the eight to twelve policies your risks and your buyers actually demand: information security, access control, incident response, change management, vendor management, data handling, business continuity, and acceptable use cover most questionnaires.
Keep each policy short enough that the team it governs will genuinely read it. A two-page policy people follow beats a twenty-page policy nobody opens, and auditors can tell the difference within minutes.
Days 61–90: Name Owners and Start Cadences
Every control needs a named human — not a team — who owns its operation and its evidence. Assign owners, put the recurring cadences on real calendars, and run the first cycle of each: one access review, one vendor check, one incident tabletop.
By day ninety you have something rare: a small program that actually operates. Scaling it for a framework like ISO 27001 or SOC 2 is then an expansion, not a rebuild.
