GRC / compliance
The GRC / compliance module shows where you stand against the frameworks you are held to, such as ISO 27001, NIST CSF, SOC 2 and Essential Eight, proves it with evidence, and reports it.
Who it is for
- Teams facing an audit, a certification or a customer questionnaire, who need a defensible answer to "how compliant are we?".
- Teams tracking several frameworks, or several clients, who want one place that shows the gaps.
- Security leads who want the remediation work a review produces tracked to closure, not lost in a document.
What you get
| Capability | Where in the app | Guide |
|---|---|---|
| Frameworks from the catalogue, or your own standard as a custom framework | Compliance › Frameworks | Choose your frameworks |
| Assessments that score each requirement | Compliance › Assessments | Score an assessment |
| Gap reviews that propose remediation work | Compliance › Assessments | Gap reviews |
| Controls with a status and effectiveness, mapped to requirements | Compliance › Controls | Controls |
| Evidence on each requirement: files, links, and a connected service's failing checks | Assurance › Evidence | Gather evidence |
| A risk register scored by likelihood and impact, linked to controls | Risk › Register | Risk |
| Policies from a starter set, with versions and approval | Governance › Policies | Governance |
| Remediation actions to assign and track | Tasks › Actions | Actions |
| Compliance and executive reports, reviewed, approved and exported | Assurance › Reports | Reports |
From setup to result
- Enable frameworksCompliance › Frameworks
- Score and attach evidenceCompliance › Assessments
- Run a gap reviewCompliance › Assessments
- Decide and track fixesTasks › Inbox · Tasks › Actions
- Report where you standAssurance › Reports
Good to know
Do I need to run a scan first?
No. Compliance work starts from a framework; a connected service such as Microsoft 365 adds its failing configuration checks as evidence.
Plans
The number of frameworks you can have enabled depends on your plan; see pricing.
Did this answer your question?
Your modules
A module is a part of the platform you turn on for one job: one of four content modules, GRC / compliance, Attack surface (CTEM), Identity exposure & dark-web monitoring or Cloud posture (CSPM), or Pentest as a Service.
Attack surface (CTEM)
The Attack surface (CTEM) module scans your domain from outside to show what an outsider can see of your organisation, and which exposure findings to triage and fix first.