GRC as a Service

GRC as a Service provides consulting and engineering services for compliance, IT security, virtual CISO, and security engineering. In practice that means assessing, monitoring and responding to security threats on your behalf.

Who is it for? Mostly companies without a full security team. Alongside the main category they mention Compliance, Consulting, Security and Usability Testing. As a very small company team themselves (1 to 10 people), they tend to serve customers of a similar scale best. You will probably talk to the people who build it, which is great until you need 24/7 support.

GRC as a Service is based in Wilmington, Delaware. Their site is grc-as-a-service.com.

Our checklist for this category: response times, what is included in monitoring, and reporting. Get the renewal terms in writing before the first invoice.

If you have worked with GRC as a Service, tell the next buyer what you paid and what surprised you. That is the part of this page we cannot write.