Pranit K | GRC & Cloud Security

GRC Analyst | @HCLTech-Software Engineer | GRC | AI-Security | AWS Cloud Security & AI Governance | Building in public: ISO 27001 • SOC 2 • EU AI Act

[Pranit K | GRC & Cloud Security @PranitKolamkar]

26/90:
Early on, I accepted a Slack screenshot where a manager said 'Looks good 👍' as evidence of an access review.
Auditor response: Rejected. Why? • No date on reviewed list • No review criteria • No proof of what was evaluated
If it's not verifiable, it didn't happen. #GRC

[Pranit K | GRC & Cloud Security @PranitKolamkar]

25/90:
An engineer says: 'Look, here is a screenshot of our PR branch protection.'

Auditor: 'Great. Now give me all 420 PRs merged this year so I can pick 25 random samples.'
One screenshot proves nothing about consistency. AICPA sampling: • Monthly: 5–12 • Daily: 25–40 #GRC

[Pranit K | GRC & Cloud Security @PranitKolamkar]

4/4: 3. The Remediation We redesigned CTRL-002: • Auto-generate Jira tickets directly from review approvals • 24-hour revocation SLA with escalation alerts • Mandatory ticket closure link required to sign off the review

Turn audit findings into automated workflows. #GRC

[Pranit K | GRC & Cloud Security @PranitKolamkar]

24/90:
1/4: Anatomy of an audit failure: how I structured and fixed the Privileged Access Evidence Gap in CloudDesk SaaS.

Privileged access is the #1 area auditors scrutinize in SOC 2 and ISO 27001.

Here is what went wrong and how we fixed it 👇 #GRC #Audit

[Pranit K | GRC & Cloud Security @PranitKolamkar]

3/4: 2. Evidence Reconciliation Never trust a spreadsheet alone. I cross-referenced the Q2 access sheet against AWS IAM credential reports.

Finding: 2 users marked 'Revoke' in May were active in July. Why? Reviewer marked the sheet, but no Jira ticket was sent to SysOps.

[Pranit K | GRC & Cloud Security @PranitKolamkar]

23/90:
In CloudDesk SaaS, I built a case study for control CTRL-002:

Quarterly access sheets were signed by Eng Director.

Log check: 3 contractors marked 'Revoke' in Q2 still ran AWS CLI commands in Q3!

Signing sheets isn't closing gaps. #GRC #Audit

[Pranit K | GRC & Cloud Security @PranitKolamkar]

22/90:
In CloudDesk (120 controls), I group controls by timing:

• Preventive: Blocks threat (SSO + MFA) • Detective: Finds breach (CloudTrail alert) • Corrective: Restores operations (Backups)

Never rely only on prevention. Defense needs all 3. #GRC

[Pranit K | GRC & Cloud Security @PranitKolamkar]

21/90:
The golden rule of control testing:

Design Effectiveness: Does the rule work on paper? ("Policy: Terminated users revoked in 24h.")
Operating Effectiveness: Did it work over 12 months? ("Sample: 4 of 25 exits kept GitHub access.")
Auditors test both. You must too. #GRC

[Pranit K | GRC & Cloud Security @PranitKolamkar]

20/90:
20 days in. Biggest lesson:

Risk analysis looks like math in Excel, but it's structured negotiation.

Devs say risk is tiny. Auditors say it's huge. Execs ask if launches slip.

GRC analysts bring objective data to turn arguments into decisions. #GRC

[Pranit K | GRC & Cloud Security @PranitKolamkar]

19/90:
Want to see a tech risk register in action?

I built a 5×5 Inherent vs Residual Risk Register for PayNova:

🔗 https://t.co/UwJ8vD3nF3

18 scoped risks, heatmaps, & ServiceNow mapping! #GRC

[Pranit K | GRC & Cloud Security @PranitKolamkar]

18/90:
Don't mix up Appetite and Tolerance:

• Risk Appetite: High-level risk the Board accepts ("Zero appetite for unencrypted PAN"). • Risk Tolerance: Tactical deviation ("30-day exception while migrating DB").

Appetite is strategic. Tolerance is tactical. #GRC

[Pranit K | GRC & Cloud Security @PranitKolamkar]

17/90:
Bad risk entry: 'Risk: Cloud Security. Likelihood: High.'

Helps no one. In PayNova, I use a 3-part syntax:

'Risk that [Threat] exploits [Vulnerability], resulting in [Business Impact].'

Specificity drives remediation. Vagueness produces apathy. #GRC #RiskManagement

[Pranit K | GRC & Cloud Security @PranitKolamkar]

16/90:
When residual risk is too high, 4 options:

1.Mitigate: Add safeguards (MFA)
2.Avoid: Stop the activity (decommission app)
3.Transfer: Shift financial hit (insurance/Stripe)
4.Accept: Formally sign off on the risk
GRC manages real risk, not fantasies. #GRC

[Pranit K | GRC & Cloud Security @PranitKolamkar]

4/4: 3. Residual Risk Outcome With controls operating effectively: • Likelihood drops from 4 to 2 • Impact remains high at 4 • Residual Risk: 8/25 (MEDIUM)

Residual risk now sits inside PayNova's approved risk appetite (<10). Defensible math. #GRC

[Pranit K | GRC & Cloud Security @PranitKolamkar]

15/90:
1/4: Inherent vs. Residual Risk on an API Auth Bypass in PayNova (FinTech).

Many risk registers pluck numbers out of thin air.

Here is the defensible scoring workflow I built 👇 #GRC #RiskManagement

[Pranit K | GRC & Cloud Security @PranitKolamkar]

3/4: 2. Mitigating Controls • CTRL-API-01: OAuth 2.0 + JWT at API Gateway • CTRL-API-02: Automated SAST/DAST in CI/CD • CTRL-API-03: Real-time rate limiting & alerts

Control assessment: Automated, tested quarterly. Rating: 70% risk reduction.

[Pranit K | GRC & Cloud Security @PranitKolamkar]

14/90:
Early on, if I saw a CVSS 9.8 flaw, I called it a 'Critical Business Risk.'

Junior mistake.

CVSS measures flaw severity. Risk measures likelihood & impact in YOUR setup.

A CVSS 9.8 on an isolated server with no internet isn't an existential crisis. #GRC #AppSec

[Pranit K | GRC & Cloud Security @PranitKolamkar]

13/90:
How do controls reduce risk?

Controls rarely cut inherent impact (breaches remain costly). They reduce likelihood.

Enforcing TLS 1.3 across APIs drops eavesdropping likelihood from 4 to 1.

Residual risk drops from 20 to 5. Controls do the heavy lifting. #GRC