GRC Solutions is committed to protecting client information through a structured approach to information security, privacy and risk management. Our information security program is embedded in how we operate and provides a framework for identifying, assessing and managing information security risks across every service we deliver.
GRC Solutions’ commitment to information security
Organisations in regulated sectors trust their compliance training provider with sensitive data: learner identities, training records, assessment results and, in some cases, whistleblower disclosures. A breach of that data carries real cost. The average cost of a data breach is USD 4.44 million globally, and 49% of organisations plan to increase security investments only after a breach occurs. For GRC Solutions’ clients in financial services, health, education and government across Australia and the Asia-Pacific, preventing that breach is the priority.
This page is written for customers and prospective customers conducting security due diligence on GRC Solutions’ platforms, including the Salt Compliance LMS and Adaptive authoring tools. It provides an executive-level overview of how GRC Solutions protects the information entrusted to it.
GRC Solutions operates a formal information security program aligned to ISO/IEC 27001:2022 and broader cybersecurity information security best practices. The program covers:
- Information security governance and risk management
- Access control and identity management
- Data security and privacy protection
- Cloud security and infrastructure security
- Incident response plans and business continuity
- Security awareness and training
- Supplier and third-party risk management
- Security monitoring and continuous improvement
Detailed technical and policy documentation is available through the GRC Solutions Trust Centre, which serves as the central resource for security, privacy and compliance assessments.
ISO/IEC 27001:2022 certification and Information Security Management System (ISMS)
ISO/IEC 27001 is a widely used information security management standard that specifies requirements for establishing, implementing, maintaining and continually improving an information security management system. The 2022 edition includes 93 controls across four domains: organisational, people, physical and technological. ISO 27001 covers leadership, planning, support and operation areas, making it applicable to organisations of any size handling sensitive information.
GRC Solutions is ISO/IEC 27001:2022 certified. An independently audited ISMS covers both company and client information. The certification scope includes:
- GRC Solutions
- The Salt Compliance LMS platform
- Salt Adaptive
- Salt LMS Mobile app
- Hosting environments
- Supporting business operations
An ISMS helps organisations protect sensitive data and respond to breaches through documented policies, defined roles and repeatable processes. An ISMS includes policies and processes for data security management that are reviewed and updated on a defined schedule. Organisations can achieve ISO 27001 compliance to enhance security practices, and GRC Solutions maintains its certification through annual surveillance audits conducted by an accredited certification body.
A current copy of the ISO/IEC 27001 certificate, a statement of applicability overview and a high-level control mapping document are accessible via the GRC Solutions Trust Centre.
Key principles of our information security program
The CIA triad includes confidentiality, integrity and availability. These three key principles form the foundation of GRC Solutions’ information security controls and guide how we design, implement and evaluate every security measure across our platforms.
- Confidentiality prevents unauthorised access to sensitive information. GRC Solutions enforces confidentiality through encryption (in transit and at rest), strict access controls, role-based permissions and the principle of least privilege. Only authorised users can view or process client data.
- Integrity ensures data accuracy and prevents unauthorised alterations. Controls include change management procedures, secure coding practices, audit logging and checksums that verify data integrity across storage and transfer.
- Availability ensures authorised users can access information when needed. GRC Solutions maintains availability through resilient cloud hosting, geographic redundancy, regular backups and tested business continuity arrangements.
Information security encompasses more than digital controls. Information security includes physical IT asset security and data encryption, covering physical access restrictions at data centers and secure disposal of hardware.
Nonrepudiation ensures users cannot deny their actions in transactions. GRC Solutions addresses nonrepudiation through strong authentication, tamper-evident logging and governance processes that assign accountability for every action taken on information systems. These principles guide policy design, vendor selection, cloud security architecture, incident response planning and the configuration of security systems across our technology stack.
Information security governance and risk management
GRC Solutions’ information security management is overseen by an executive security committee with defined roles spanning senior leadership, risk, technology and operations. This committee functions as the primary governance body for the organisation’s information security strategy, ensuring that security decisions are made with business context and executive accountability.
The governance structure includes:
- Policies approved by the executive and reviewed on a defined cycle
- A chief information security officer (or equivalent role) responsible for the information security management framework
- Risk owners assigned for each major platform, data repository and business process
- Alignment with governance, risk and compliance (GRC) frameworks, where GRC tools help maintain organisational risk registers and track compliance activities
- Regular reporting to the board on risk posture, incidents and control effectiveness
Information security risk assessments follow a structured risk management process: asset identification, threat and vulnerability analysis, impact and likelihood evaluation, and risk treatment plans. This process applies to platforms such as the Salt Compliance LMS and customer data repositories. Registers capture cybersecurity information security risks including cloud misconfiguration, social engineering, insider threats and third-party failures.
GRC Solutions aligns its information security strategy with national baselines and international standards. The ACSC Information Security Manual provides a cybersecurity framework for Australian Government systems. The NIST Cybersecurity Framework is a voluntary risk management framework organised around six core functions: Govern, Identify, Protect, Detect, Respond, Recover. APRA CPS 234 is a mandatory prudential standard for APRA-regulated institutions in Australia. ISO 31000 provides principles and guidance for risk management. The Essential Eight is a prioritised baseline of eight mitigation strategies against cyber attacks.
Organisations should establish one core security management system and map additional requirements against it. GRC Solutions follows this principle: our ISO/IEC 27001 ISMS serves as the central framework, and compliance strategies use a “map once, comply many” approach by cross-mapping controls to fulfil multiple mandates. Companies should evaluate their industry and data types to choose appropriate cybersecurity frameworks, and a gap assessment helps organisations evaluate existing security policies against selected frameworks. GRC Solutions conducts these assessments periodically to confirm that controls remain aligned with evolving regulatory expectations.
Data security and privacy protection
GRC Solutions protects client and learner data across its entire lifecycle, from collection and processing through storage, retention and secure deletion. Data security protects sensitive information from unauthorised access, and our controls are designed to prevent data loss, unauthorised disclosure and unintended retention.
Concrete data security measures include:
- Encryption in transit (TLS 1.2+) and at rest (AES-256 or equivalent)
- Strict access controls enforcing least privilege and need-to-know
- Data minimisation: collecting only the personal and financial data required for the stated purpose
- Role-based permissions tied to job function, with periodic review
- Configurable retention periods, so clients control how long learner records are stored
- Secure data disposal procedures, including destruction and de-identification options
- Audit trails that log access to learner data and confidential information
- Data loss prevention controls to protect sensitive data from exfiltration
For Australian clients, privacy obligations under the Privacy Act 1988 (Cth) and the Australian Privacy Principles require reasonable steps to protect personal information from misuse, interference and loss. APP 11 sets the standard. Where clients operate across the Asia-Pacific, GRC Solutions supports compliance with relevant regimes such as New Zealand’s Privacy Act and Singapore’s PDPA. Organisations handling personal data in the EU must comply with GDPR, focusing on data privacy and user rights; GRC Solutions offers a GDPR eLearning course for organisations with EU obligations.
Healthcare had the highest average data breach cost of any sector, exceeding $9 million. In the eLearning context, personally identifiable information includes learner names, job roles, training completion records and assessment responses. GRC Solutions provides pseudonymisation options for reporting, configurable retention periods and audit trails that record every access event. Detailed information on data flows, data residency options and privacy impact considerations is available in the Trust Centre.
Cloud security and infrastructure protection
Cloud security secures data and applications hosted in the cloud. GRC Solutions’ Salt Compliance LMS and Adaptive platforms are hosted on reputable cloud infrastructure providers with hardened configurations, network segmentation and automated baseline enforcement.
Security controls for infrastructure security include:
- Firewalls and network access control lists restricting traffic to authorised paths
- Intrusion detection and intrusion prevention systems monitoring for malicious code and anomalous traffic
- DDoS protection at the network edge
- Endpoint detection on servers, with endpoint detection and response tooling for production workloads
- Secure configuration baselines, reviewed against vendor benchmarks and updated as cloud services evolve
- Virtual private networks for administrative access to production environments
- Network security controls that prevent unauthorised access to computer networks and internal segments
Thirty percent of web application risks are attributable to security misconfiguration. GRC Solutions mitigates this through automated configuration checks, infrastructure-as-code templates and change management processes that require approval before any modification to production environments.
Responsibilities are divided between GRC Solutions and its cloud hosting partners under the shared responsibility model. The cloud provider secures physical infrastructure, hypervisors and data centers. GRC Solutions retains responsibility for data classification, identity configuration, application security, encryption key management and monitoring. This division is documented and reviewed periodically.
Infrastructure diagrams, network security summaries and environment hardening standards are available to customers under NDA via the Trust Centre.
Access control, identity management and strong authentication
GRC Solutions applies a need-to-know, role-based access control model. Permissions are assigned based on job function and reviewed on a scheduled basis for both internal staff and administrators. This model ensures that only authorised users can gain access to the organisation’s data and computer systems.
For client users of the Salt Compliance LMS:
- SAML-based single sign-on (SSO) integration with enterprise identity providers
- Multifactor authentication (MFA) support; implementing multi-factor authentication reduces unauthorised access risks
- Configurable password policies (length, complexity, expiry)
- Session management controls and automatic timeout
Account lifecycle management covers onboarding, role changes, deprovisioning and periodic access recertification. These processes support non-repudiation and audit requirements by ensuring that access rights are current and traceable.
Privileged access for system administrators and database administrators is restricted to the minimum number of accounts necessary, protected by MFA, and logged. All privileged actions are monitored for unusual activity. Insider threats can involve misuse of access privileges by employees; these controls are designed to detect and prevent such scenarios. Application security protects software applications from unauthorised access, and access controls form a core layer of that protection.
Security monitoring, intrusion detection and Security Operations
GRC Solutions operates continuous monitoring across production systems. Capabilities include:
- Log collection, correlation and alerting via security information and event management (SIEM) tooling
- Intrusion detection and anomaly detection applied to hosting environments, APIs and critical application components
- Endpoint security and endpoint detection and response agents on servers, reporting to centralised dashboards
- Vulnerability management solutions identifying weaknesses in systems and applications through regular scanning (infrastructure and application layers)
- Patch management processes that prioritise remediation based on risk severity
Security operations processes are aligned to the information security management system. Security teams review alerts, investigate potential threats and escalate confirmed security incidents through documented procedures.
GRC Solutions does not operate a traditional 24/7 physical security operations center (SOC). Equivalent functions are delivered through a combination of in-house information security professionals and trusted security service providers who supply out-of-hours monitoring, alerting and initial triage. Information security analysts play a central role in these operations; employment for information security analysts is projected to grow 32% by 2032, reflecting the increasing demand for these skills across all sectors.
More detailed information about monitoring scope, alerting thresholds and SOC-equivalent arrangements is available in the Trust Centre.
Incident response, business continuity and disaster recovery
GRC Solutions maintains a documented incident response plan covering defined roles, escalation paths and communication procedures for handling security incidents. The plan is reviewed and tested periodically.
High-level incident response steps:
- Detection: automated alerting from security tools and manual reporting channels
- Triage: initial assessment of scope, severity and affected systems or data
- Containment: isolating affected systems to prevent further impact
- Eradication: removing the root cause (e.g. malicious code, compromised credentials)
- Recovery: restoring services from verified backups and confirming integrity
- Post-incident review: documenting lessons learned and updating controls
These steps align with ISO/IEC 27001 Annex A controls on incident response and draw on the NIST SP 800-61 incident handling lifecycle. Ransomware attacks can block access to files until a ransom is paid; regular data backups help recover from ransomware attacks. GRC Solutions maintains geographically separated backups with defined Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO).
Business continuity arrangements for core services include:
- Automated failover for critical infrastructure components
- Periodic disaster recovery testing with documented results
- Defined communication protocols for notifying affected clients during an incident
Incident metrics, sample playbooks and summary results of continuity and disaster recovery tests are described in the Trust Centre.
Secure development, change management and application security
GRC Solutions follows secure software development lifecycle (SSDLC) practices for its learning platforms and custom eLearning solutions. This means security is considered from requirements through deployment, not bolted on afterward.
Controls include:
- Mandatory code review for all production changes
- Third-party dependency management, including review of open-source components for known vulnerabilities
- Security testing: static analysis, dynamic analysis, and periodic external penetration testing
- Segregation of development, test and production environments, preventing untested code from reaching live systems
- Secure coding practices enforced through developer guidelines and automated linting
Change management for application and infrastructure changes requires documented change requests, risk assessment, approval, scheduling to minimise client impact, rollback planning and post-change validation. Configuration management helps avoid misconfigurations; as noted earlier, misconfiguration accounts for 30% of web application security risks.
ISO 27001 and CIS Controls are recommended foundational frameworks for small or medium businesses building an information security program. GRC Solutions uses these as reference points alongside its ISO/IEC 27001 ISMS. SOC 2 is an auditing standard for service and technology providers focusing on security and privacy controls; GRC Solutions can provide information on its SOC 2 alignment upon request. ISO 22301 and ISO 27701 complement information security programs but focus on different management objectives (business continuity management and privacy information management, respectively). GRC Solutions tracks these standards to ensure its controls address overlapping requirements.
Supplier, third-party and integration security
GRC Solutions manages supplier and third-party risk through structured due diligence, contractual safeguards and periodic reassessment. This applies to hosting providers, subcontractors, content partners and key integration partners.
Due diligence activities include:
- Security questionnaires and review of vendor certifications (ISO/IEC 27001, SOC 2 or equivalent)
- Review of penetration test summaries and vulnerability assessment results
- Contractual clauses covering data protection, breach notification, confidentiality, right to audit and liability
- Technical controls for integrations (e.g. with HR systems, identity providers or student information systems): least privilege API permissions, secure token handling, input validation, rate limiting and logging
Suppliers are reassessed on a defined schedule and whenever a material change in their risk posture is identified. Any changes are managed through the information risk management framework. Security protocols for data exchange with third parties are documented and enforced.
Third-party penetration testing reports, security attestations and standardised questionnaire responses (such as Cloud Security Alliance CAIQ responses) are available through the Trust Centre.
Security awareness, training and our role as a compliance education provider
GRC Solutions delivers compliance training to organisations across Australia and the Asia-Pacific. That same discipline applies internally. Every GRC Solutions employee completes security awareness training at onboarding, with periodic refreshers and role-specific modules for technical and operational staff.
Training employees on security awareness reduces social engineering risks. Phishing was the top type of cybercrime reported in 2023, and GRC Solutions’ internal training program covers phishing recognition, credential protection, data handling and reporting procedures. The security professional responsible for the program updates content as potential threats evolve.
GRC Solutions uses its own learning technology to deliver internal training. The Salt Compliance LMS and Adaptive authoring platform host the organisation’s cybersecurity awareness modules, providing the same experience internally that clients receive externally.
For clients looking to strengthen their own information security programs and reduce human-related security risks, GRC Solutions offers:
- Ready-made cybersecurity eLearning courses covering topics such as privacy, data protection, social engineering, phishing and common information security threats
- Cyber Security Awareness Training for global audiences
- Bespoke training modules tailored to an organisation’s policies, risk profile and regulatory environment
- Courses addressing privacy and data protection in Australia and specific regimes such as Singapore’s PDPA
Security awareness is both an internal practice and a core client-facing service.
Security assurance, testing and independent validation
GRC Solutions conducts assurance activities beyond its annual ISO/IEC 27001 surveillance audits. These activities test whether security controls are operating as intended and identify areas for improvement.
Assurance mechanisms include:
- External penetration testing conducted by independent security firms, covering infrastructure and application layers
- Regular vulnerability assessments across production environments, APIs and endpoints
- Targeted configuration reviews for cloud environments and critical data stores
- Internal audits of security policies, processes and control effectiveness
- Remediation tracking, with findings fed into the information security management system improvement cycle
Results from these activities inform the organisation’s risk treatment plans and drive updates to security tools, configurations and procedures. The information security management framework requires that identified gaps are addressed within defined timeframes, with progress reported to the executive security committee.
Certain assurance artifacts are available to clients on request via the Trust Centre: penetration testing summaries, high-level remediation status and risk treatment approaches. These resources support security teams and information security professionals conducting vendor due diligence and help protect data and protect sensitive information throughout the supply chain.
GRC Solutions Trust Centre: detailed security, privacy and risk information
The GRC Solutions Trust Centre is the central location for in-depth security, privacy, risk and compliance information. It is designed to support structured security assurance and due diligence, giving security, procurement and compliance teams the documentation they need to complete assessments.
Topics covered in the Trust Centre include:
- ISO/IEC 27001 compliance documentation
- Product security and application security details
- Infrastructure and network security architecture
- Data security and data privacy policies
- Access controls and identity management
- Business continuity and disaster recovery arrangements
- Incident response procedures and metrics
- Risk management framework and registers
- Asset management and classification
- Supplier and third-party management practices
- Change management and secure development processes
- Continuous security monitoring and vulnerability management
- Security awareness and training program details
- CAIQ responses, penetration testing summaries and vulnerability assessment results
Some resources, such as detailed architecture diagrams, penetration test reports and intellectual property documentation, require an NDA or authenticated access. Clients can contact GRC Solutions to request Trust Centre access.
For detailed security, privacy and compliance information, supporting documentation and materials to complete your due diligence, visit the GRC Solutions Trust Centre.