Governance, risk & third-party risk : Governance, risk, and third-party risk — under the seat.
A board-approved policy suite. A risk register that is reviewed, not filed. A committee that meets and minutes. A board pack that reports the same things the same way every quarter. And a vendor-risk program that reaches every supplier who touches your data — including the ones your prime will ask about.
Under Fractional Leadership. This is one of the mandates the seat owns — delivered by Golonex or by your existing vendor, overseen either way.
Six governance foundations. Delivered as a set.
Each deliverable below is a document or framework an assessor, a prime, or your board will ask to see. Golonex drafts every one — you review, brand, and adopt.
Board-approved security policy suite
The master information security policy plus the ten operational policies that define how controls are implemented — mapped to NIST 800-171, ISO 27001 Annex A, and PCI DSS requirement 12. Branded to you, ready for board adoption.
Risk register
A pre-populated register seeded with the risks a regulated mid-market firm actually carries — ransomware, vendor dependency, cloud misconfiguration, data breach, key-person loss — scored, owned, and formatted for board review and assessor inspection.
Governance committee charter
The security and risk committee: charter, membership, quorum, cadence, agenda and minute templates, and the reporting line to the board. Chaired or attended by the seat-holder.
Board reporting pack
Quarterly templates covering risk status, incident summary, patch and vulnerability posture, assessment readiness, vendor review, and upcoming spend. The same shape every quarter, so trends are visible.
Vendor-risk toolkit
Scored due-diligence questionnaire, a contract clause library, and the annual review process — the third-party risk management program assessors ask for by name.
Security budget framework
Annual budget structure and board approval template — capital, operating, assessment, and remediation categories — so the spend that readiness requires is planned, not discovered.
Ten policies. One board-approved master framework.
The information security policy is the master document, supported by ten operational policies that define how specific controls are implemented. Golonex drafts all of them as a coherent set, mapped to the frameworks you are held to — not disconnected templates.
Assessors look for evidence that policies exist and that staff know what they say. We draft each policy in plain language, structured for the team that has to follow it — not just the assessor who reads it once.
All policies are provided in editable format, branded to you, with an owner, an effective date, and a review date built in.
- 01 Information Security Policy (master document)
- 02 Acceptable Use Policy — staff, contractors, third parties
- 03 Access Control Policy — least privilege, MFA, privileged access
- 04 Incident Response Policy — classification, escalation, notification
- 05 Change Management Policy — infrastructure and configuration changes, testing, rollback
- 06 Vendor and Outsourcing Policy — onboarding, SLAs, right-to-audit, flow-down
- 07 Business Continuity and DR Policy — RTO/RPO targets, test obligations
- 08 Data Classification and Handling Policy — CUI, cardholder data, personal data
- 09 Removable Media and Device Policy — USB controls, BYOD, mobile
- 10 Patch and Vulnerability Management Policy — SLAs by criticality, exceptions
Every vendor who touches your data, assessed and evidenced.
Your MSP, your cloud, your software suppliers, your subcontractors. NIST 800-171, ISO 27001, and PCI DSS all expect a documented third-party risk program — and a DoD prime expects to see the flow-down in your subcontracts. Golonex builds the program and the toolkit, so the requirement is met from day one.
Vendor risk assessment questionnaire
A scored questionnaire covering security controls, data handling, sub-processors, business continuity, and — where you are a DoD supplier — the vendor’s own NIST 800-171 status. Completed before onboarding, re-scored annually.
Contract clause library
Ready-to-use schedules for MSPs, cloud providers, software suppliers, and subcontractors — data residency, right-to-audit, security SLAs, incident notification, and the DFARS 252.204-7012 flow-down language a prime expects to see in your subcontracts.
Annual vendor review process
A documented review of every critical vendor: updated questionnaire, risk re-score, contract check, and the evidence that the review happened — formatted for the governance committee and the assessor.
Vendors covered
Managed service providers · Cloud hosting providers · Software and SaaS suppliers · Payment processors · Subcontractors handling CUI · Security service providers, including Golonex itself
Build it, run the vendor program, or keep it maintained through the seat.
Governance build
Policy suite, risk register, committee charter, and board pack. Fixed scope, delivered in six to eight weeks with a review session for each document.
Third-party risk program
The vendor-risk toolkit, the initial assessment of every critical vendor, and the annual review process. Often paired with a CMMC or PCI readiness review.
Maintained through the seat
Annual review and update of every governance document, board reporting support, and policy amendments as frameworks change. The seat keeps governance current and evidenced.
For India: RBI IT governance — ITSC and IT Steering Committee charters, the UCB IT framework, and IS Audit readiness — is delivered from our India branch. India — DPDP, DPO & RBI →
Frequently asked questions
What does “governance” actually produce? +
Documents with owners and dates, and a rhythm that keeps them true: a board-approved security policy suite, a risk register reviewed on a schedule, a committee that meets and minutes, and a board pack that reports the same things the same way every quarter. Assessors check for all four in the first pass — and for evidence that the rhythm is real, not just the paper.
How long does it take to produce a complete policy suite? +
Typically four to six weeks for the ten core policies: information security, acceptable use, access control, incident response, change management, vendor and outsourcing, business continuity, data classification, removable media, and patch management. We write from framework-mapped templates (NIST 800-171, ISO 27001 Annex A, PCI DSS) and customise each to your infrastructure, vendors, and processes.
Is this a one-time project or an ongoing advisory? +
Both. Most clients start with a governance build and then keep it current through the seat: annual policy review, risk register refresh, and board reporting support. Regulations change and your estate changes; governance that is not maintained stops being evidence.
Does this cover vendor risk and third-party due diligence? +
Yes. The risk register includes a vendor-risk module covering your MSP, cloud hosts, software suppliers, payment processors, and subcontractors. We produce the due-diligence questionnaire, review responses, maintain the third-party risk register as a living document, and — for DoD suppliers — evidence the NIST 800-171 flow-down to your own subcontractors.
How does this map to CMMC, ISO 27001, and PCI DSS? +
Directly. NIST 800-171 expects policies and a risk-management process (3.11, 3.12); ISO 27001 requires the ISMS governance clauses (4 through 10) and Annex A policy controls; PCI DSS requirement 12 is governance end to end. One policy suite, one risk register, and one board rhythm satisfy all three, crosswalked.
Tell us where your governance stands
Share your current policy documentation status and any upcoming assessment or customer review dates. We will assess the gaps and propose a governance build that gets you inspection-ready.