Part of Practice Engine
Practices
The work your organization actually performs.
A Practice is the real activity behind a control — a quarterly access review, a backup verification, a vendor assessment — with an owner, a cadence and a definition. It's the object everything else in GRAC hangs off.
What it does
How Practices works in GRAC
Define once
name, objective, criticality, frequency and owner in one place.
Map to many
link a practice to every requirement and framework it satisfies.
Operate and prove
completing a practice updates compliance everywhere it's mapped.
What you get
Outcomes
- One definition of what's actually done, not just what's documented.
- No parallel control sets per framework.
- A living operational record, not a static binder.