Acuna GRC core
ComplyFrameworks, scopes and cross-mapping.ImplementRequirements, measures and controls.OperateRisks, tasks, annual plan, documents.AssureKPIs, audits and corrective actions.
Platform overview
Add-on modules
TPRM (Supplier Shield)Supplier assessments and a daily grade.Data PrivacyProcessing activities, DPIAs and requests.Cookie ManagerCookie banner and consent records.Trust CenterAnswer questionnaires, share a trust page.AI GovernanceRegister and assess your AI systems.EvaluationsSpot checks and gap assessments.Group managementSubsidiaries in one Group Compliance view.Staff PortalPolicies staff read and acknowledge.Vulnerability managementScanner results turned into issues.
All modules
Across the platform
AikoThe AI assistant, at your pace.Integrations and APIConnectors, task sync, webhooks, API.Administration and securityUsers, access profiles, audit log.100+ connectors
By size
StartupGet ready for your first audit.Mid-marketKeep the library clean as you grow.EnterpriseControl at scale.Consultants and MSSPsAll your clients in one view.
By framework
ISO 27001ISO 42001NIS2EU AI ActDORASOC 2GDPRNIST CSFSwiss FADPFINMA
See all frameworks
By need
Prepare for a certification auditAnswer a client questionnaireRun compliance across a groupAssess your suppliersGovern your AI systems
All solutions
Acuna GRC Services
Do it yourselfYou run the program in Acuna GRC, with Aiko.Done with you (Co-managed)Guidance, reviews and audit preparation with your team.Done for you (Fully managed)Our experts run it. You review.
What we take on
CISO as a serviceDPO as a serviceAudit preparationGap assessmentsProgram setup in Acuna GRC
Meet the experts
Alexis HirschhornCertified Lead AuditorLaura MenetreyLegal and privacy expertBénédicte SévinISO 27001 Lead Implementer
Meet the full team
MSSPs and consultants
Acuna GRC for MSSPsWhite label and tenant managementBecome a partner expert
Learn
BlogWebinarsAnswersGlossary
See all resources
Framework guides
ISO 27001NIS2DORAEU AI ActCyber Resilience Act
All frameworks
Featured
WebinarFrom AI hype to AI reality: governing the AI your company already usesView the webinarGuideHigh-risk AI systems: how the EU AI Act classifies yoursRead the guide
Company
About AcunaTeamPricingOur Trust CenterContact us
Legal
PrivacyTermsData Processing AgreementAcuna GRC AI information
Our own standard
ISO/IEC 27001:2022 certifiedThe standard you ask of your own suppliers.Built and run from SwitzerlandHosted in Switzerland, the EU or the US.
Platform

What is GRC software?

By the Acuna GRC teamLast updated 19 October 20262 min read

Direct answer

GRC software is a platform for governance, risk and compliance: it keeps an organisation’s frameworks and requirements, the measures and controls that meet them, its risks, policies and tasks, and the evidence, KPIs and audits that show it all works, in one place. It replaces spreadsheets and shared folders with linked records, owners, deadlines and an audit trail.

What GRC software does

  • Governance: frameworks, policies, roles and the management reviews that show leadership oversight.
  • Risk: a risk register with owners, scores, treatment plans and reviews.
  • Compliance: the requirements of each framework or law, the measures that meet them and the status of each.
  • Assurance: evidence, KPIs, internal audits, issues and corrective actions.

The value is in the links: one control can serve several frameworks, a risk points to the controls that reduce it, and an auditor can follow a requirement down to the evidence.

Features to look for

  • Cross-framework mapping, so a measure counts once for every requirement it meets.
  • Recurring tasks and health scores that show what ran and what is overdue.
  • Document management with approval and review dates.
  • Third-party risk, privacy and AI governance in the same data, not in separate tools.
  • Connectors that pull evidence from your security and IT tools.
  • Access control by role and scope, an audit log and a clear choice of hosting location.

When spreadsheets stop being enough

Usually when a second framework arrives, when several people own controls, or when an auditor or customer asks for evidence you have to rebuild by hand. At that point the cost of keeping copies in step is higher than the cost of a platform.

How Acuna GRC is organised

Core GRC in Acuna GRC has four workspaces on the same data. Comply defines the programme: frameworks, scopes and the mapping of measures across frameworks. Implement builds the management system: requirements, measures, controls and the business context. Operate runs it day to day: risks, treatment plans, business impact analysis, tasks and documents. Assure shows that it works: KPIs, records, audits, issues and corrective actions. Add-on modules such as TPRM, Data Privacy, Trust Center and AI Governance plug into the same model, 100+ connectors bring in evidence, and data is hosted in Switzerland, the EU or the US. See the Acuna GRC platform.

How Acuna GRC handles it

Acuna GRC is an AI-native GRC platform with 50+ frameworks, an AI assistant called Aiko, Swiss experts and add-on modules such as TPRM and Data Privacy.

Frequently asked

Is GRC software the same as an ISMS?

Not quite. An ISMS is the information security management system ISO 27001 asks for. GRC software is the tool you run it in, often alongside other frameworks such as NIS2, DORA or the GDPR.

Who uses GRC software?

Compliance leaders, CISOs, risk managers, DPOs and the control owners across the business, plus auditors who read the evidence.

For: Compliance Leader

See how Acuna GRC runs this.

Tell us your frameworks and your team. We show you how Acuna GRC runs the program.

Hosted in Switzerland, the EU or the US