Framework readiness
Review your current controls against a selected framework and plan proportionate improvements.
- ISO 27001 and NIST readiness
- Control and evidence gap reviews
- Risk register and policy support
Governance, Risk & Compliance Clearer governance.
Clearer governance.
More manageable risk.
Understand your obligations, identify priority risks, and build controls that work in day-to-day operations. Bastion helps organisations bring governance, risk, and compliance work into a clearer plan.
Common GRC challenges
Make obligations easier to act on.
Teams need clear owners, useful records, and controls that reflect how the organisation actually works.
Priority
Changing obligations
Teams may need help understanding which legal, contractual, or sector requirements apply to their work.
Priority
Unclear control ownership
Policies and controls are harder to maintain when responsibilities are not assigned and reviewed.
Priority
Third-party risk
Suppliers and service providers can introduce risks that need to be identified and managed.
Priority
Policies that miss the work
Generic or outdated policies may not reflect how staff use systems and handle information.
Priority
Limited assurance
Without a review process, gaps in evidence or control operation can go unnoticed.
Priority
Continuity planning
Teams need clear priorities and roles to prepare for interruptions to important services.
Priority
Privacy responsibilities
Ownership of personal data, records, and staff guidance may need clarification.
Areas of support
Practical support for GRC work.
The right starting point depends on your organisation’s risks, obligations, and current processes. We can help scope the work around those needs.
Data Privacy Compliance
Review data handling, impact assessments, and privacy processes against relevant obligations.
- Data privacy mapping
- Data protection impact assessments
- Breach response workflows
Data Protection Support
Explore scoped privacy and data protection support, including whether a designated Data Protection Officer is appropriate.
- Privacy programme reviews
- Data protection impact assessments
- Support aligned to agreed responsibilities
How we work
From obligations to everyday practice.
A useful GRC programme connects requirements with people, decisions, and repeatable processes.
Understand your context
Review your objectives, obligations, operating environment, and current controls.
Set priorities and owners
Identify the most important gaps and agree who is responsible for addressing them.
Make controls workable
Document, communicate, and review processes so they fit day-to-day operations.
Our GRC services
Support shaped around your context.
We can discuss these areas individually or as part of a broader governance and risk improvement plan.
Compliance FrameworksStandards
- ISO 27001 readiness and gap reviews
- NIST Cybersecurity Framework
- CIS Critical Security Controls
- PCI DSS readiness support
Privacy & LawsLegislation
- Uganda Data Protection Act 2019
- GDPR readiness support
- Data Privacy Impact Assessments
- Data mapping and records of processing
Governance & RiskStrategy
- Business Continuity (BCP) plans
- Third-party Vendor Risk reviews
- Internal access & security audits
- Executive risk dashboard models
Different operating contexts
GRC priorities vary by sector.
Requirements depend on your services, information, partners, and jurisdiction. These examples show areas teams may need to consider.
Healthcare
Consider patient information, clinical workflows, and continuity when reviewing governance priorities.
Key Focus: Privacy & continuityFinancial Services
Review customer data, transaction processes, third-party relationships, and control evidence.
Key Focus: Risk & control oversightGovernment
Review governance, procurement, and information handling requirements relevant to the agency.
Key Focus: Public Data ClassificationsNGOs
Consider donor and partner obligations, cross-border data, and distributed operations.
Key Focus: Partner & privacy obligationsGRC questions
What to expect.
A few common questions about GRC support and how to begin.
Let’s talk
Bring more clarity to risk and compliance.
Tell us about your governance or compliance priorities. We can help you review the work involved and identify a sensible next step.