POLICY COMPLIANCE TRACKING

Policy violations, exceptions and remediation are tracked manually, so drift from policy builds unseen between reviews. Compliance is a periodic snapshot, not a live state.

Actors

  • GRC Manager
  • Compliance & Risk Manager
  • Head of Security Governance

Systems / Vendors

  • GRC platform
  • SIEM
  • BI / reporting

Business Question

"Where are we drifting out of policy right now, and is remediation actually happening?"

What SPoG Does

  • Tracks policy violations, exceptions and remediation status.
  • Surfaces drift from policy as it forms.
  • Makes policy compliance a live state.

Outcome Metrics

−30%

Policy drift

1

Live compliance view

6–10 wks

To first outcomes