After talking to literally dozens of practitioners and vendors, what was most striking was the fact that the term ‘GRC’ is largely absent from the European security vocabulary. I watched a few US-based companies drop the term on attendees and they were met with puzzled looks. More than once, I overhead the attendees asking what the acronym stood for.
After interviewing countless attendees, we also discovered that the focus is different across the pond. Nearly every person interviewed said they were either ISO 270001 certified, were actively working on it, or it was a project being mandated by their management. When pressed, the primary reason for the certification wasn’t to “be more secure”, “reduce their controls environment”, or other such US marketing nonsense. Instead, they saw the certification process as a step toward raising the bar on their competition. Having the ISO blessing, they felt, made them more competitive. This is shift we at Brightfly have been advocating in the US for nearly 18 months, and here they have already been pursuing it in the UK and beyond. It will be interesting to see which viewpoint prevails as the marketing engine continues to churn.
