Demystifying Cyber GRC