Security. Compliance. Confidence.

GOVERNANCE, RISK & COMPLIANCE

Practical guidance for complex security and compliance challenges.

Today's organizations face growing expectations around data protection, regulatory compliance, vendor oversight and cybersecurity risk. Meeting those expectations requires more than policies on paper. It requires clear ownership, practical controls and informed decisions.

Grisham Services LLC helps organizations strengthen their governance and compliance programs, prepare for audits, assess risk and develop sustainable information security practices.

With extensive experience in information security leadership, IT governance and regulatory compliance, I bring a practical, business-focused perspective to the challenges organizations face.

Our GRC services

Governance, Risk & Compliance as a Service (GRCaaS)

Build a more organized, sustainable approach to governance and compliance.

Services can help organizations identify requirements, evaluate their current posture, organize documentation and establish a structured approach to managing risk.

GRC program development and improvement.
Compliance gap assessments.
Control inventories and documentation.
Risk registers and remediation tracking.
Policy and procedure development.
Management reporting and governance support.

Engagements are scoped to your organization's needs and applicable requirements.

Virtual CISO (vCISO) Advisory

Access experienced security leadership without necessarily hiring a full-time CISO.

vCISO advisory can help organizations define priorities, communicate risk, establish governance and make informed decisions about security investments.

Security program strategy and roadmaps.
Executive-level risk reporting.
Security policies and standards.
Security metrics and program oversight.
Vendor and security initiative evaluation.
Governance and decision-making support.

Audit Readiness & Compliance Support

Prepare for audits with a clearer understanding of requirements, documentation and control expectations.

Grisham Services can support organizations preparing for applicable compliance assessments, third-party reviews and independent audits.

PCI DSS.
HITRUST CSF.
HIPAA Security Rule and applicable privacy requirements.
SOC 2 readiness.
NIST Cybersecurity Framework.
Other applicable contractual or regulatory requirements.

Services may include readiness reviews, evidence organization, control mapping, policy review and remediation planning.

Engagements focus on preparation and advisory support. Formal certification, attestation and independent audit opinions remain the responsibility of appropriately authorized assessors and auditors.

Third-Party Risk Management

Understand and manage the risks introduced by vendors, suppliers and service providers.

A structured third-party risk management program can help organizations assess suppliers consistently, document findings and support informed decisions.

Third-party risk management program design.
Vendor assessment questionnaires and workflows.
Risk classification and assessment criteria.
Due diligence and evidence review.
Remediation tracking.
Risk reporting and governance processes.

Policies, Procedures & Security Documentation

Turn requirements into documentation your organization can actually use.

We can help develop or improve security policies, standards, procedures and supporting documentation aligned to your operating model and applicable requirements.

Potential deliverables include information security policies, access management procedures, incident response documentation, vendor risk procedures and control evidence guidance.

Our approach

Practical guidance. Clear priorities. Better decisions.

01. Understand

We learn about your organization, business objectives, applicable requirements and current challenges.

02. Assess

We evaluate the defined scope, available documentation and current processes to identify gaps and areas for improvement.

03. Prioritize

We help organize findings into practical recommendations based on risk, requirements and business priorities.

04. Improve

We support agreed remediation, documentation, program development and preparation activities.

05. Communicate

We help stakeholders understand progress, outstanding decisions and the next steps required to strengthen the program.

The scope, methodology and deliverables are defined for each engagement.

Why Grisham Services?

Experience that connects security, compliance and business decisions.

Amy Grisham brings more than two decades of management experience, including leadership in technology, information security, IT governance and regulatory compliance.

Her professional experience includes cybersecurity program development, security operations, vendor oversight, data protection and audit preparation across complex operating environments.

The focus is not simply on identifying compliance gaps. It is on helping organizations understand their risks, establish clear responsibilities and develop practical approaches to managing their obligations.

Find out more

Who we help

Grisham Services may be a fit for organizations that:

Need experienced security leadership or advisory support.
Are preparing for a compliance assessment or third-party audit.
Need to organize policies, controls and evidence.
Want to formalize a third-party risk management program.
Need support translating regulatory requirements into practical processes.
Want to improve communication between technical teams and business leadership.

The suitability of an engagement depends on the organization's requirements, scope and available resources.