Software · GRC
GRC stands for governance, risk and compliance. GRC software brings requirements, risks, evidence and measures together in one place, even when several standards and laws apply at the same time. This page shows what a GRC tool must do, what to look for when choosing one and how Sightadel puts it into practice.
Starting point
Governance means steering by management: objectives, policies, roles and decisions. Risk means risk management: identifying, assessing, treating and reviewing risks. Compliance means meeting standards, laws and customer requirements and proving it. The three areas interlock. A risk assessment without a management decision is as impossible to audit as a policy without evidence that it is followed.
In many companies, this sits in separate files today. One spreadsheet for the Statement of Applicability under ISO 27001, one for the measures under NIS2, a vendor list in purchasing, records in folders and mailboxes. With every additional framework the effort grows, because the same topics are documented several times: backup, access rights, training, vendors, internal audit.
GRC software replaces this collection with a shared data model. Requirements come from the frameworks; evidence and measures are created once and linked to every requirement they cover. Decisions stay where the standards require them: with management. Your company sets objectives, risk acceptance and responsibilities, not the software.
Why now
You have ISO 9001 or ISO 27001 and now fall under NIS2 or DORA, or a major customer demands its own security annex. By now at the latest, a system in which one piece of evidence counts for several requirements pays off.
The certification body, statutory auditor or supervisory authority wants to see dated records. If you only start collecting before the appointment, you search from scratch every year.
NIS2 and DORA explicitly make management or the management body responsible. Management needs a status it can read and decisions that are filed in a traceable way.
The officer knows all the spreadsheets, nobody else does. If they are absent or leave, the system stands still. A GRC tool makes responsibilities and deadlines visible to everyone.
Every customer asks about the same topics in a different format. A well-maintained status and a Trust Center answer the usual questions once for everyone.
Relevant frameworks
Summarised in our own words, not legal advice. The original text in its current version is authoritative.
The most widely used framework for information security. Clauses 4 to 10 govern the management system, Annex A contains 93 controls. Much of the evidence from ISO 27001 carries over into NIS2, DORA and the technical measures of the GDPR.
View framework →Mandatory for important and essential entities under the German BSI Act (BSIG). Ten areas of measures under section 30 BSIG, reporting obligations under section 32, registration under section 33 and management responsibility under section 38.
View framework →Binding for financial entities in the EU since January 2025 and taking precedence over NIS2 there. ICT risk management and incident reporting are joined by resilience testing and the register of information on ICT service providers.
View framework →Quality management with the same basic structure of clauses 4 to 10 as ISO 27001. Document control, internal audit, management review and corrective actions can be managed together.
View framework →Applies to every organisation that processes personal data. The technical and organisational measures under Art. 32 can be proven with the same evidence as many controls from ISO 27001.
View framework →Recommended order
Clarify which standards and laws apply to you and what customers additionally require. That determines which frameworks you set up in Sightadel.
Existing spreadsheets on requirements, risks and vendors come in via Excel import, policies via Word import. You upload records to the evidence archive and map them.
Work through the framework with the nearest deadline step by step, control by control. You set up further frameworks alongside it. What is already evidenced shows up there as evidenced.
Gaps become action plans with an owner and a deadline. Colleagues from IT, HR and purchasing work on their part with the Contributor role, and management follows along as Viewer.
Internal audit, management review, vendor assessments and expiring evidence run as dates with reminders. That keeps the system up to date between audits.
Selection
Most GRC tools look similar in the demo. The differences show in the second year: in maintenance, with the second framework and in the audit.
Check whether a record can be stored once and linked to requirements from several frameworks. Copies per framework lead to diverging versions.
A restore test or a training list goes out of date. The tool should know version, validity and reminders before expiry, not just file storage.
A list of standard texts is of little help to business units. Look for control questions with explanations that colleagues without knowledge of the standard can answer too.
AI can provide drafts. Management must set objectives, risk acceptance and responsibilities, and the tool should flag these points instead of pre-filling them.
A separate auditor role without deletion rights saves sending files. External consultants should be able to work with their own role, traceable in the log.
Ask where the data is stored, who operates it and how you get it back out. Export to Excel and Word is part of the basic equipment.
How Sightadel helps
Every requirement as a question with an explanation, control by control, with industry templates from many years of consulting and certification practice. Answer, justification and evidence sit in the same place.
Learn more →Records with version, validity date and a reminder before expiry. One piece of evidence is linked to controls from several frameworks, for example a backup concept to ISO 27001, NIS2 and DORA at once.
Learn more →Gaps from assessments, internal audits and external findings become measures with an owner and a deadline. Overdue items are visible to everyone involved.
Learn more →Service providers with criticality, questionnaires and evidence in one list, with a reminder of the next assessment. This covers the supply chain requirements of several frameworks.
Learn more →You set up group policies or customers' security annexes as a custom framework. It uses the same evidence and measures as the standards.
Learn more →Regular synchronisation with Jira, Confluence, Zendesk, Microsoft Azure, SAP, Microsoft Dynamics and Salesforce. Assets, evidence and tasks come from the systems in which they are created anyway.
Learn more →Effort and duration
The ranges are based on experience, not a commitment. The biggest factors are your starting point, the size of the scope and the time you have alongside day-to-day business. The software shortens searching, maintenance and follow-up, not the decisions.
What you license · typically Professional
Licences are per framework and edition. A company with an ISMS, NIS2 obligations and data protection typically takes ISO 27001, NIS2 and the GDPR in the Professional edition. Because ISO 27001 is included, NIS2 and the GDPR permanently cost less. With many subsidiaries or vendors, Enterprise is the right fit.
Licence per framework, minimum term one year, payable monthly or annually. You will find all prices, discounts and a calculator on the pricing page. Fees of a certification or audit body are charged separately.
A system in which governance, risk management and compliance come together: requirements from standards and laws, risks, evidence, measures and management decisions. The core is that one piece of evidence counts for several frameworks and deadlines do not depend on one person.
For one framework and one responsible person, Excel can be enough. With several frameworks, many people involved and evidence that expires, it becomes tedious: versions diverge, deadlines are only noticed in the audit. Existing spreadsheets can be imported into Sightadel, so you do not start from scratch.
Sightadel is licensed per framework and edition. If ISO 27001 or ISO 9001 is licensed, every other framework permanently costs less. The current amounts are on the pricing page. You can try it free for 14 days, without payment details.
Among others ISO 27001, NIS2, DORA, ISO 9001 and the GDPR. What software must do for each framework is described on the pages on ISO 27001 software, NIS2 software, DORA software and ISO 9001 software. You set up your own requirements, such as group policies or customer requirements, as a custom framework.
No. Sightadel guides you through the requirements and records the status. You choose consultants from the partner network in the app or bring your own. Audits are carried out by independent, accredited auditors. Sightadel does not certify and receives no commission, and neither do the partners.
Nothing. It makes suggestions from data you have already entered or imported. You accept, change or add to them. You set objectives, risk acceptance and responsibilities yourself.
Yes, through integrations with Jira, Confluence, Zendesk, Microsoft Azure, SAP, Microsoft Dynamics and Salesforce with regular synchronisation. Assets, evidence and tasks are taken over. You create users manually or via CSV. There is no public customer API; further systems on request.
Sightadel is developed in Germany and operated in Germany. We conclude a data processing agreement (DPA) under Art. 28 GDPR with every customer.
14 days, full access, no payment details. Everything you set up carries over into the paid plan.
