| Drata | Drata Foundation includes one pre-mapped framework selected from SOC 2, ISO 27001, Cyber Essentials, HIPAA, and GDPR.[1] | Drata lists automated evidence collection in its plan features.[1] | Audit Hub centralizes communication with an auditor and stores documentation.[1] | Drata lists Policy Templates in its plan features.[1] |
|---|
| Secureframe | Secureframe lists SOC 2, ISO 27001, HIPAA, PCI DSS, CCPA, and GDPR.[2] | Secureframe lists Automated Evidence Collection and Continuous Control Monitoring.[2] | See vendor[2] | Secureframe lists Policy Management among package features.[2] |
|---|
| Sprinto | Sprinto supports SOC 2, ISO 27001, PCI DSS, CSA STAR, NIST CSF, HIPAA, GDPR, ISO 42001, and additional frameworks.[3] | Evidence is captured autonomously and kept up to date.[3] | Instant, audit-ready compliance reports are available.[3] | Policies stay updated, organized, and compliant.[3] |
|---|
| Scrut Automation | Scrut supports SOC 2, ISO 27001, GDPR, PCI DSS, HIPAA, NIST AI RMF, and 70+ frameworks.[4] | Evidence collection connects AWS, GitHub, Okta, and 150+ integrations.[4] | Continuous readiness assessments produce findings and remediation steps.[4] | See vendor[4] |
|---|
| Thoropass | Thoropass supports SOC 1, SOC 2, ISO 27001, PCI DSS, HIPAA, HITRUST, CMMC Level 1, NIST CSF 2.0, and GDPR.[5] | Evidence is centralized and validated across frameworks.[6] | In-house auditor support and expert-led audits run through Thoropass ALP.[5] | See vendor[5] |
|---|
| Vanta | Vanta lists SOC 2, ISO 27001, GDPR, HIPAA, HITRUST, USDP, NIST AI Risk Management Framework, and ISO 42001.[7] | Vanta describes automated audit preparation and evidence collection.[7] | See vendor[8] | Vanta routes policies for approval and tracks employee acceptance.[9] |
|---|
| Compyl | Compyl supports frameworks and regulations across financial services, healthcare, legal, energy, and higher education.[10] | Evidence Studio provides automated, live evidence.[11] | See vendor[10] | Policy Management keeps policies current and control-aligned.[11] |
|---|
| HyperComply | See vendor[12] | A security profile and knowledge base centralize security details and documents.[12] | Data rooms control access, expiration dates, and access records.[12] | The security knowledge base controls security documents.[12] |
|---|
| 6clicks | 6clicks maps controls across ISO 27001, NIST CSF, SOC 2, DORA, CMMC, and UK Cyber Essentials.[13] | 6clicks pulls evidence automatically from connected systems; its agents collect evidence continuously, monitor drift, and trigger remediation.[14] [14] | 6clicks provides real-time compliance dashboards and shares reports with auditors and regulators on demand.[13] | See vendor[15] |
|---|
| Scytale | Custom frameworks are supported.[16] | Evidence is pulled from connected tools to keep controls backed by live data.[17] | Audit Management is available.[17] | See vendor[17] |
|---|
| Apptega | Apptega supports more than 30 frameworks, including CMMC, NIST CSF, SOC 2, PCI DSS, HIPAA, and ISO 27001.[18] | Audit Manager shares evidence and validates controls during audit preparation.[18] | Audit Manager supports audit preparation through evidence sharing and control validation.[18] | Policy Manager creates, tracks, and approves policies.[18] |
|---|
| Anecdotes | Anecdotes supports SOC 1, SOC 2, ISO 27001, ISO 27032, ISO 42001, ISO 27701, GDPR, and FedRAMP 20x.[19] | Automatically collected data supports GRC workflows.[19] | Answers link to audit reports, certifications, or a trust center.[19] | Agentic Policy Lifecycle Management is available.[19] |
|---|
| Centraleyes | Maps shared controls across more than 180 frameworks, standards, and regulations.[20] | Preloaded smart questionnaires and automated workflows support data collection.[20] | Automated compliance workflows support data collection.[20] | See vendor[20] |
|---|
| ISMS.online | Preconfigured templates support major compliance frameworks.[21] | Maintains an inventory of information assets.[21] | Guided certification path from gap analysis to certification.[21] | Creates, manages, and distributes policies.[21] |
|---|
| LogicGate Risk Cloud | Risk Cloud maps control frameworks through Central Frameworks such as the SCF.[22] | Automated Evidence Collection gathers evidence across connected storage, HR, and ticketing sources.[23] | Automated Evidence Collection supports the Controls Compliance Solution.[23] | Risk Cloud supports policy drafting, review, approval, and employee attestations.[24] |
|---|
| Onspring Compliance Management | Onspring lists SOX, ISO 27001, HIPAA, PCI DSS, GDPR, NIST, CMMC, and SOC 2.[25] | Onspring automatically collects, stores, and categorizes compliance evidence.[25] | Onspring supports audit preparation and response with a trail of compliance activities and decisions.[25] | Onspring supports direct publishing of policies to SharePoint or an intranet.[25] |
|---|
| SAI360 | Lists COSO, CSRD, EU AI Act, EUDR, EU DORA, ISO, NIST, SEC, SOC 2, and SOX.[26] | Compliance teams manage regulatory change, policies, training, disclosures, incidents, and whistleblower cases in one workflow.[26] | Includes audit alongside risk and compliance modules on one platform.[26] | Includes a Policy Management module.[26] |
|---|
| Workiva GRC | Workiva Audit Management includes pre-built frameworks.[27] | Workiva automates evidence collection, testing, and remediation with agentic AI.[28] | Workiva Audit Management provides AI-driven workflows, pre-built frameworks, and testing automation.[27] | Workiva supports enterprise policy content, ongoing review cycles, mapping, and employee attestation.[29] [29] [29] [29] |
|---|
| ZenGRC | ZenGRC cross-maps compliance frameworks.[30] | ZenGRC automates evidence collection for compliance initiatives.[30] | ZenGRC lets teams upload, manage, and complete audits for auditors.[30] | See vendor[30] |
|---|
| IBM OpenPages | CUBE; UCF Common Controls Hub[31] | OpenPages uses pre-built connectors and APIs to ingest internal and external data for compliance, third-party risk, and operational risk.[31] | OpenPages automates internal audit planning and execution with visibility and collaboration.[32] | Creation; review; approval; attestation[33] |
|---|
| Archer Evolv for Compliance | Archer Evolv monitors regulatory sources across 99 jurisdictions and 27 languages.[34] | Archer captures evidence, produces attestations, and maintains audit trails.[35] | Archer Evolv supports recurring control evaluations against requirements.[34] | Archer Evolv categorizes, parses, and versions policy content in a centralized obligations library.[34] |
|---|
| MetricStream Policy and Compliance Management | MetricStream maps policies to regulations, risks, and controls.[36] | MetricStream supports evidence collection with attestations.[37] | MetricStream provides automated control assessments and testing.[37] | MetricStream GRC includes document and policy management.[38] |
|---|
| Ncontracts | Compliance management covers regulatory requirements, industry standards, and internal policies.[39] | Exam-ready reporting tracks regulatory changes, policy updates, and complaint management.[39] | Generates detailed reports for stakeholders, management, and examiners to demonstrate compliance.[39] | Policy version control, automated reminders, board approval tracking, and a central library.[39] |
|---|
| Optro GRC Intelligence Platform | Optro CrossComply supports frameworks including ISO 27001, SOC 2, and NIST CSF.[40] | Optro CrossComply uses AI-powered gap assessments, control mapping, and evidence collection.[40] | See vendor[41] | See vendor[41] |
|---|
| TrustCloud TrustOps | TrustOps supports security, privacy, financial, and manufacturing standards.[42] | TrustOps automates control verification and testing.[42] | TrustOps control automation accelerates compliance audits.[43] | TrustOps generates policies from its Common Control Framework and maps them to controls.[42] |
|---|
| SureCloud | SureCloud lists ISO 27001, ISO 42001, ISO 27002, DORA, SOC 2, GDPR, NIS-2, PCI-DSS, and SCF.[44] | SureCloud automatically collects evidence from preferred tools.[45] | See vendor[44] | See vendor[44] |
|---|
| Strike Graph | Strike Graph supports SOC 2, HIPAA, GDPR, ISO 27701, CMMC, DORA, ISO 27001, ISO 42001, and additional frameworks.[46] | Integrations automate compliance evidence collection.[47] | See vendor[47] | See vendor[47] |
|---|
| Knowally | See vendor[48] | Knowally processes uploaded documents into a private, searchable knowledge base tied to the account.[48] | See vendor[48] | See vendor[48] |
|---|
| Loopio | Supports security questionnaire responses for SIG, CAIQ, and HECVAT.[49] | Centralizes expert-approved answers and security artifacts in an audit-ready library.[49] | Automated SME assignments, nudges, and deadlines coordinate expert reviews.[49] | See vendor[49] |
|---|
| Conveyor | See vendor[50] | Conveyor syncs drives, wikis, support sites, documents, and past questionnaires into an AI-managed knowledge library.[50] | Conveyor routes answers to tagged reviewers and flags outdated data for review.[50] | See vendor[50] |
|---|
| Responsive | Supports SIG, VSAQ, CAIQ, VSA, NIST 800-171, and CIS Controls.[51] | Centralizes security questionnaire content with access controls and AI safeguards.[51] | See vendor[51] | See vendor[51] |
|---|
| SecurityPal AI | See vendor[52] | SecurityPal grounds questionnaire responses in validated documentation, previous answers, policies, controls, and security artifacts, with analyst review.[53] [53] | SecurityPal provides vendor-assessment reports with risk scoring and remediation guidance.[52] | See vendor[52] |
|---|
| Whistic | Whistic lists 50+ standardized frameworks.[54] | Whistic Compliance helps teams define controls, automate tests, and build evidence that shows controls are actually working.[55] | See vendor[55] | See vendor[55] |
|---|
| PowerDMS Policy | PowerDMS Policy maps written directives and evidence to accreditation standards.[56] | See vendor[57] | PowerDMS records routing changes for historical records and audits.[57] | Policy provides version control, acknowledgments, review and approval workflows, and audit trails.[57] |
|---|
| Mitratech PolicyHub | See vendor[58] | See vendor[58] | PolicyHub provides policy reporting to auditors, regulators, and boards.[58] | PolicyHub automates policy distribution, attestation, tracking, reporting, approval, and knowledge assessments.[58] |
|---|
| ConvergePoint Policy Management | See vendor[59] | See vendor[59] | ConvergePoint provides version history and audit trails for internal and regulatory audits.[59] | Drafts; reviews; approvals; acknowledgments[60] [61] |
|---|
| Cyberday | Built-in frameworks include ISO 27001, NIS2, DORA, and more.[62] | AI agents update evidence and the platform documents systems, data, and infrastructure.[62] | Supports internal audit workflows to run and track audits.[62] | AI agents draft policies and map controls.[62] |
|---|
| NAVEX One Policy & Procedure Management | See vendor[63] | See vendor[63] | NAVEX PolicyTech distributes policies, tracks attestations, and provides audit-trail reporting.[64] | NAVEX One Policy & Procedure Management automates policy lifecycle, distribution, attestations and tracking.[63] |
|---|
