Greg ShineContact Me

Governance, risk and compliance, run for you

The Fractional GRC Office

A standing security and governance function for small and medium-sized enterprises. One office runs the obligations, controls and evidence, and senior CISO or DPO leadership attaches only where the business needs it.

A standing function rather than a project with an end date, so the operating rhythm, ownership and records keep working between audits, assessments and board cycles.

  • Obligations mapped
  • Controls owned
  • Evidence kept

Frameworks and regulations

  • DORA
  • NIS2
  • EU AI Act
  • ISO/IEC 27001
  • NIST SP 800-53
  • GDPR

Attach when a specific accountability needs an owner

Fractional CISO

Security direction, risk decisions and board-ready reporting.

Fractional DPO

Independent data protection with accountability evidence.

The office runs on Unified GRC, the partner platform that keeps frameworks, controls, suppliers and evidence in one working system. Read the platform story

Contact Me Watch the 60-second overview

The offer in one minute

Leadership, controls and evidence.

A concise view of the pressure facing SMEs and how a fractional model closes the gap.

The shape of the offer

One office at the centre, two mandates alongside.

Most businesses need the office first. The named mandates attach to it when a specific accountability needs an owner.

The core engagement

Fractional GRC Office

A standing governance function rather than a project with an end date. The operating rhythm, ownership and evidence that keep controls working between audits, assessments and board cycles.

  • Obligation mapping across DORA, NIS2, EU AI Act and GDPR
  • Control ownership, cadence and evidence management
  • Third-party risk and continuous monitoring
  • Audit preparation and customer assurance support

Attach when security leadership is the gap

Fractional CISO

A senior security leader who can set direction, make risk decisions and translate technical reality for the board, without the delay or cost of a full-time executive hire.

  • Security strategy and prioritised roadmap
  • Incident readiness and executive reporting
  • Certification and customer assurance leadership

Attach when data protection needs an owner

Fractional DPO

Independent, proportionate data protection leadership that turns GDPR obligations into working practices and clear evidence.

  • DPIAs, records and policy governance
  • DSAR and breach response oversight
  • Accountability evidence and regulator readiness

The business case

Senior ownership, matched to the need.

Fractional leadership is not the same job at a discount. It is a deliberate choice to secure experienced direction at the level and pace the business needs now.

Buy the leadership you need

A fractional engagement scales senior judgement to the work in front of the business. You gain direction and accountability without carrying a permanent executive role before the demand justifies it.

Move while the risk is live

Recruitment, notice periods and onboarding can leave important risks without an owner. Fractional support can begin sooner, giving regulatory, customer and audit priorities active leadership while the business decides what it needs for the longer term.

Reduce the wider hiring commitment

The business case is broader than salary. It includes recruitment, benefits, management time, vacancy risk and the cost of committing to a role that may be larger than the current workload requires.

An honest fit test

Fractional first, permanent when the role demands it.

A fractional GRC Office works best when a business needs experienced security or GRC leadership, but does not yet need that executive capacity every working day. It is particularly useful during regulatory change, certification, customer assurance, transformation or a period of rapid growth.

When the workload becomes consistently full-time, the organisation needs daily executive presence, or the internal team is large enough to require continuous management, a permanent hire may be the better choice. A fractional engagement can prepare for that transition by defining the mandate, operating model and priorities before recruitment begins.

A systematic approach

From risk to evidence.

The work starts with business context, not a generic checklist. Each stage leaves a clear decision, owner or artefact behind.

  1. 01

    Assess

    Understand the business, its obligations, current controls and material risks.

  2. 02

    Prioritise

    Create a risk-led roadmap that puts urgent decisions and foundational controls first.

  3. 03

    Operationalise

    Assign owners, establish routines and embed governance into day-to-day delivery.

  4. 04

    Evidence

    Make progress visible and maintain the records that customers, auditors and regulators expect.

Unified GRC

A platform for work that has to stay worked.

Developed in partnership with Greg Shine, Unified GRC gives the engagement a working system for mapped frameworks, policies, controls, suppliers, plans and evidence.

It supports a systematic approach to achieving and maintaining security standards, so progress remains visible after the first assessment or audit.

Read about Unified GRC
Unified GRC live compliance posture metrics
Unified GRC implementation project planUnified GRC mapped controls register

Connected, not parallel

One control system for overlapping obligations.

The goal is not a separate programme for every regulation. Common controls are designed once, mapped across obligations and supported by evidence that can be reused.

DORANIS2EU AI ActISO/IEC 27001NIST SP 800-53GDPR

The same principle applies to cloud, AI and third-party risk. Each is governed as part of the operating model, not treated as a disconnected annual exercise.

Start with a focused conversation

Make your governance defensible.

A first conversation can define the immediate pressure, the likely gaps and the right shape of engagement.

Contact Me Return to Greg's profile