Compliance and GRC

What this shelf is for

Software that keeps track of security and privacy obligations: the controls you claim to operate, the evidence that they run, the policies people have to read, and the questionnaires customers send before they will sign.

Buyers arrive here for one of two reasons. A deal is blocked on a certificate, or a regulator has become interested. The first is common and has a deadline attached, which is why this category sells so hard on speed.

Tools that actually enforce access and secrets sit in security. Contract signing and approval flows belong in e-signature and contracts.

What these products really do

Nobody here issues a certificate. Software collects evidence, maps it to a framework and keeps it current between audits. An accredited auditor still examines your practice and forms an opinion.

Understanding that boundary prevents the expensive disappointment in this category. A platform can cut months of screenshot gathering. It cannot shorten the window during which an auditor needs to see your controls operating, and it cannot pass an audit on behalf of a company that does not do the things it claims.

The work splits into four parts: writing policies, implementing controls, proving they run, and answering questions about all three. Products differ in how much of each they cover.

Frameworks, and how much overlap there is

Start from the frameworks customers actually ask for, not the longest list on a website.

• Security attestations requested in enterprise sales, with an observation window before the report exists.
• Certifiable standards with a formal audit cycle and surveillance visits between them.
• Privacy regulation, where the obligations are legal rather than certified.
• Sector rules for health, payment card data, public sector or finance, which override general advice.
• Customer questionnaires, unstandardised, endless, and the reason answer libraries exist.

Most controls repeat across frameworks. Good platforms map one piece of evidence to every framework it satisfies, which is what makes the second standard far cheaper than the first. Check that mapping for your specific combination.

Continuous monitoring is the part worth paying for

Evidence gathered once a year is a photograph. Controls drift the day after it is taken.

Connect the platform to your identity provider, cloud accounts, code repositories and endpoint tooling, and it can check continuously that access reviews happened, that machines are encrypted, that leavers were removed and that production changes were reviewed.

Ask three questions about that. Which integrations exist for the systems you actually run. What happens when a check fails, since an alert nobody owns is decoration. And whether findings can be assigned, tracked and closed inside the tool rather than copied into a spreadsheet.

People, policies and training

Policies that nobody reads are a finding waiting to happen.

Look for distribution with acknowledgement, versioning that survives an auditor asking what the policy said in March, and reminders that go to the person rather than to a shared inbox. Security awareness training is bundled by some vendors and sold separately by others, and the bundled version is often adequate.

Onboarding and offboarding checklists tie the whole thing together, because access left behind after someone leaves is the single most common finding in a first audit.

What the year actually costs

The platform subscription is one line of three. The auditor is a second, frequently larger. Penetration testing, if the framework or a customer expects it, is a third.

Platform pricing usually scales by employee count, by framework and by connected systems, with the automated evidence collection sometimes parked above the entry plan. Ask for the full first-year figure including any onboarding fee, then ask what renewal looks like once implementation is done. The habits behind those numbers are unpacked in what pricing pages hide.

Sequencing a first certification

The order of work matters more than the platform, because most of the delay comes from things software cannot accelerate.

Start with scope. Which systems, which locations and which parts of the business are covered decides how much evidence exists to collect, and an over-broad scope is the most common self-inflicted cost.

Then fix the controls that will obviously fail: access reviews nobody runs, leavers with live accounts, machines without encryption, and policies written years ago and never read. Those take weeks and cannot be shortened by tooling.

Bring the platform in once those are underway, so it collects evidence of practices that already exist rather than documenting their absence.

Book the auditor early. Availability, not readiness, is frequently what sets the date.