Managed GRC : Governance, risk, and compliance — run by a named seat-holder, not filed.
A seat on your org chart that owns the program: a board-approved policy suite, a risk register that is reviewed, a committee that meets, a board pack every quarter, readiness reviews against the frameworks you are held to, and the evidence that proves the controls work. The seat-holder answers for it.
Part of Managed GRC. The seat, the readiness reviews, GRC operations, and security assurance — one accountable owner.
All of Managed GRC →One named leader. The whole GRC mandate.
Golonex holds the seat in your company: one accountable, credentialed person — vCISO, vCTO, vCAIO, or DPO, whichever the job needs — who owns governance, security, compliance, and AI conformity, faces the assessor, and answers to your board.
vCISO
Owns the security program, the readiness reviews, the evidence, and the relationship with the assessor.
vCTO
Owns the technology estate and its vendors, and the decisions about what gets built and to what standard.
vCAIO
Owns the AI inventory, risk tiering, human-oversight controls, and EU AI Act and ISO 42001 conformity.
DPO
Owns personal-data obligations where the law requires a named officer, including the DPDP Act in India.
Readiness reviews — the deadline work, run by the seat.
Each review runs the same way: scope, assess, close the gaps, assemble the evidence, walk in prepared. Golonex prepares you; the C3PAO, the QSA, or the certification body grades you.
Six governance foundations. Delivered as a set.
Each deliverable below is a document or framework an assessor, a prime, or your board will ask to see. Golonex drafts every one — you review, brand, and adopt.
Board-approved security policy suite
The master information security policy plus the ten operational policies that define how controls are implemented — mapped to NIST 800-171, ISO 27001 Annex A, and PCI DSS requirement 12. Branded to you, ready for board adoption.
Risk register
A pre-populated register seeded with the risks a regulated mid-market firm actually carries — ransomware, vendor dependency, cloud misconfiguration, data breach, key-person loss — scored, owned, and formatted for board review and assessor inspection.
Governance committee charter
The security and risk committee: charter, membership, quorum, cadence, agenda and minute templates, and the reporting line to the board. Chaired or attended by the seat-holder.
Board reporting pack
Quarterly templates covering risk status, incident summary, patch and vulnerability posture, assessment readiness, vendor review, and upcoming spend. The same shape every quarter, so trends are visible.
Vendor-risk toolkit
Scored due-diligence questionnaire, a contract clause library, and the annual review process — the third-party risk management program assessors ask for by name.
Security budget framework
Annual budget structure and board approval template — capital, operating, assessment, and remediation categories — so the spend that readiness requires is planned, not discovered.
Ten policies. One board-approved master framework.
The information security policy is the master document, supported by ten operational policies that define how specific controls are implemented. Golonex drafts all of them as a coherent set, mapped to the frameworks you are held to — not disconnected templates.
Assessors look for evidence that policies exist and that staff know what they say. We draft each policy in plain language, structured for the team that has to follow it — not just the assessor who reads it once.
All policies are provided in editable format, branded to you, with an owner, an effective date, and a review date built in.
- 01 Information Security Policy (master document)
- 02 Acceptable Use Policy — staff, contractors, third parties
- 03 Access Control Policy — least privilege, MFA, privileged access
- 04 Incident Response Policy — classification, escalation, notification
- 05 Change Management Policy — infrastructure and configuration changes, testing, rollback
- 06 Vendor and Outsourcing Policy — onboarding, SLAs, right-to-audit, flow-down
- 07 Business Continuity and DR Policy — RTO/RPO targets, test obligations
- 08 Data Classification and Handling Policy — CUI, cardholder data, personal data
- 09 Removable Media and Device Policy — USB controls, BYOD, mobile
- 10 Patch and Vulnerability Management Policy — SLAs by criticality, exceptions
Every vendor who touches your data, assessed and evidenced.
Your MSP, your cloud, your software suppliers, your subcontractors. NIST 800-171, ISO 27001, and PCI DSS all expect a documented third-party risk program — and a DoD prime expects to see the flow-down in your subcontracts. Golonex builds the program and the toolkit, so the requirement is met from day one.
Vendors covered
Managed service providers · Cloud hosting providers · Software and SaaS suppliers · Payment processors · Subcontractors handling CUI · Security service providers, including Golonex itself
The proof that the controls work.
Golonex does not run security products. It tests the controls your vendors run, keeps the evidence, and maps it to CMMC / NIST 800-171, ISO 27001, SOC 2, and PCI DSS.
Every security capability, one owner.
Organised the way assessors organise it. The seat owns each line; it does not matter who builds or who supplies talent — Golonex, your MSP, your cloud provider, your engineers. Golonex is not an MSP or MSSP and does not resell security products.
Virtual CISO & cybersecurity consulting
The seat itself: scoping, strategy, vendor selection, board briefings, and the judgement calls between assessments.
The seat →Security program development
Building the ISMS: risk assessment, Statement of Applicability, control design, the policy set, and the operating rhythm.
ISO 27001 readiness →Assessment services
Gap assessments scored against the framework, with the SSP, POA&M, and evidence pack that follow. Golonex prepares; the assessor grades.
Readiness reviews →Penetration testing & phishing
Vulnerability and patch assurance with named testers; penetration testing scoped on discussion; monthly phishing simulation with evidence.
Vulnerability & patch assurance →Monitoring, SOC, MDR, forensics
Run by your vendors, never by Golonex. The seat verifies coverage, holds the vendor to the framework, and makes sure a retained specialist and the notification clocks are in place.
Vendor oversight →Managed IT security services
Identity, endpoints, email, backup, cloud, and configuration — run by your vendors or Golonex teams, and proven to work by security assurance.
Security assurance →Security products
Golonex does not resell security products. Where a product you run does not meet the framework, we say so in writing and recommend a replacement with the reason.
Vendor oversight →Security awareness & training
Phishing baseline, monthly simulation, role-based modules, AI-literacy for EU AI Act Article 4, with completion records for the evidence pack. Training delivered via Genbay.
Security awareness →Prepared by us, assessed by someone else. Registered Practitioner (RP) registration with the Cyber AB in process. The assessment itself is always performed by an independent C3PAO.
Build it, run the vendor program, or keep it maintained through the seat.
Governance build
Policy suite, risk register, committee charter, and board pack. Fixed scope, delivered in six to eight weeks with a review session for each document.
Third-party risk program
The vendor-risk toolkit, the initial assessment of every critical vendor, and the annual review process. Often paired with a CMMC or PCI readiness review.
Maintained through the seat
Annual review and update of every governance document, board reporting support, and policy amendments as frameworks change. The seat keeps governance current and evidenced.
For India: RBI IT governance — ITSC and IT Steering Committee charters, the UCB IT framework, and IS Audit readiness — is delivered from our India branch. India — DPDP, DPO & RBI →
Frequently asked questions
What does “governance” actually produce? +
Documents with owners and dates, and a rhythm that keeps them true: a board-approved security policy suite, a risk register reviewed on a schedule, a committee that meets and minutes, and a board pack that reports the same things the same way every quarter. Assessors check for all four in the first pass — and for evidence that the rhythm is real, not just the paper.
How long does it take to produce a complete policy suite? +
Typically four to six weeks for the suite alone — the ten core policies: information security, acceptable use, access control, incident response, change management, vendor and outsourcing, business continuity, data classification, removable media, and patch management. We write from framework-mapped templates (NIST 800-171, ISO 27001 Annex A, PCI DSS) and customise each to your infrastructure, vendors, and processes.
Is this a one-time project or an ongoing advisory? +
Both. Most clients start with a governance build and then keep it current through the seat: annual policy review, risk register refresh, and board reporting support. Regulations change and your estate changes; governance that is not maintained stops being evidence.
Does this cover vendor risk and third-party due diligence? +
Yes. The risk register includes a vendor-risk module covering your MSP, cloud hosts, software suppliers, payment processors, and subcontractors. We produce the due-diligence questionnaire, review responses, maintain the third-party risk register as a living document, and — for DoD suppliers — evidence the NIST 800-171 flow-down to your own subcontractors.
How does this map to CMMC, ISO 27001, and PCI DSS? +
Directly. NIST 800-171 expects policies and a risk-management process (3.11, 3.12); ISO 27001 requires the ISMS governance clauses (4 through 10) and Annex A policy controls; PCI DSS requirement 12 is governance end to end. One policy suite, one risk register, and one board rhythm satisfy all three, crosswalked.
Tell us where your governance stands.
Thirty minutes with the person who would hold the seat. You leave with a scope, a first gap list, and a name — and no obligation to continue.
Managed GRC · All of Managed GRC →
The other two services