Topics:
Let’s be honest: traditional governance, risk, and compliance (GRC) isn’t aging well.
What started as a useful governance model has become a checkbox bureaucracy in too many organizations. It reports risk but doesn’t drive it down. It tracks compliance but doesn’t improve resilience. And in today’s high-stakes threat landscape, that’s not just ineffective — it’s dangerous.
At Providence, one of the country’s largest not-for-profit healthcare systems, we’ve reached a point where the legacy GRC structure is holding back the impact of some incredibly capable people. So we’re doing what needs to be done: we’re retiring the structure—not the people—and rebuilding it into something that works.
To pull this off, I needed a partner who shared the vision and had the capability to lead. Manan Kakkar stepped up to take the helm and is driving this idea into reality. (btw, check out his app, I've made it part of my morning routine).
What we are building is GRAC — Governance, Risk, Attack Surface Management, and Compliance — a risk-centric, threat-aligned function built for outcomes, not optics.
So why did we decide on this rebuild of the legacy GRC model?
It prioritized documentation over detection
It reported risk without reducing it
It isolated key functions instead of integrating them
It limited technical talent to governance process support rather than risk action
Most importantly, it trapped skilled team members in a framework that didn’t reflect modern threats — or modern security work.
This shift to GRAC isn’t about criticism — it’s about unlocking potential. Our former GRC team had the skills and commitment, but they were boxed in by a structure focused on reporting, not results. Now that they’re unbound, expectations are higher. I challenge them to use this empowerment to engage in deeper, more technical, and more strategic work. Here are some outcomes from this effort:
They now lead internal risk assessments that test real security posture, not just policy adherence
With support from the Office of the CISO, they work alongside Cyber Threat Intelligence (CTI), SecOps, Data Security, and Identity and Access Management teams to map threats to exposure
They are building skills in artificial intelligence, automation, analytics, and threat modeling — not just audit prep.
We’re not displacing them. We’re giving them room to grow.
We believe GRAC will improve our overall program in five areas:
Governance That Enables Action: We’re integrating governance into real decision-making processes, not just policy writing. It now reinforces engineering standards, drives exception management with teeth, and ensures accountability for enterprise security at a higher level.
Risk Is Now Quantified and Prioritized: Using a custom Risk Priority Numbering (RPN) system injected with AI, we’re shifting from theoretical risk registers to real-time prioritization informed by threat intelligence, ITDR, and business impact. Risks are no longer debated in the abstract — they’re ranked, visualized, tracked, and owned.
Attack Surface Management— Operational Core, Not Add-On: We’re fully integrating ASM into the program. It drives asset discovery and threat modeling, informs triage for vulnerabilities in systems, applications, and code, and surfaces real exposure across internal, external, and third-party ecosystems.
Compliance as a Result, not a Goal: We treat compliance as a natural outcome of doing the right security work — not the primary objective. Controls are designed around threats and business needs, not audit checklists.
Cyber Architecture Now Tied to Execution: No more “design ivory towers.” Architecture is embedded in the program and directly supports secure-by-design, SSDLC, and modernization efforts. It’s hands-on, risk-informed, and aligned with real deployment timelines.
The Result: A Program That Works — and a Team That Can Grow
This restructure isn’t about gutting legacy teams — it’s about enabling them to do what they’ve always been capable of: real, high-impact security work. GRAC elevates their mission, deepens their influence, and opens up new career paths grounded in technical acumen and operational relevance.
We didn’t rebrand GRC. We replaced it. And in doing so, we’re creating a program — and a team — that’s ready for what’s next.
Mike Ratliff is the Chief Information Security Officer at Providence, one of the country's largest not-for-profit healthcare delivery organizations.
