Each entity reports differently.
Fix: Group Compliance reads every subsidiary’s live data in one read-only view, and Export CSV gives one row per organization.
See Group ComplianceEnterprise
Enterprise GRC software
Many entities, many teams, one program. Keep control as it grows.
Acuna GRC lets a head office see every subsidiary in one view, decide who sees what down to the scope and tag, and connect the program to the systems you already run.
1 · WATCH YOUR KPIS6 of 8 on target
✓Controls run on time94%On target
✓Records with a file97%On target
✓Audits held as planned2 of 2On target
!Overdue corrective actions3Warning
2 · FILL THE GAPRecords
Records without a file54File attached
✓EVD-014 · Firewall rule reviewNo file yetFiled
✓EVD-012 · Access review Q3Filed
3 · GENERATE THE REPORTGenerate Report
✓Management review · Q3GeneratingPDF · snapshot saved
✓KPI section · Controls run on timeIncluded
✓List section · Open issuesIncluded
Does this sound like you?
Why is GRC harder in a large organization? More entities, more people, more systems.
Each entity reports its own way, IT has to approve every new tool, and the GRC data sits apart from the systems the business runs on.
Our IT security review takes months.
Fix: Set the MFA policy, session limits and allowed email domains, and show the audit log and the backups.
See the sign-in rulesOur tools don’t talk to the GRC tool.
Fix: API v1, signed webhooks and two-way task sync with Jira or ServiceNow keep Acuna GRC in step with your stack.
See the APIHow Acuna GRC covers it
What should enterprise GRC software do? One view, clear access, open to your stack.
Acuna GRC gives a head office one view of its subsidiaries, access set by profile, scope and tag, the sign-in rules and audit trail IT asks for, and an API to connect it all.
01 · Group management
Can it run many entities?
Yes. With the Group management add-on, each subsidiary is a full Acuna GRC organization linked to your head office. Group Compliance in Assure ranks them by compliance, risks, suppliers and KPIs, and you share people, access profiles, suppliers and KPIs across the group.
See Group management →02 · Access profiles
Can we decide who sees what?
Access profiles choose the modules, record types, scopes and tags each person sees, from full edit to read-only. A head office can mark a profile Managed for the group and push it to its subsidiaries.
03 · Sign-in and sessions
Will IT accept the sign-in and access rules?
Set the MFA policy up to Required, sign in with Microsoft for invited users, limit invitations to your email domains, and set the session lifetime, idle timeout and trusted-device window.
See Administration and security →04 · Audit log and backups
Can we prove who changed what?
The audit log captures every creation, update, deletion and link with the old and new values, plus invitations, role and security changes. Automatic backups run on a schedule and can be downloaded or restored.
See the audit log →05 · Integrations and API
Can we integrate it with our stack?
API v1 reads and writes your records under scoped keys, and every change it makes is in the audit log. Webhooks post a signed message when a record changes, and tasks stay in step with Jira, ServiceNow and other ticketing tools.
See Integrations and API →Aiko at your pace
How does AI stay under control at scale? Your admins set the limits.
For each Aiko action, an administrator sets the highest mode anyone may use. Changing a risk score never goes beyond Ask me first: Aiko shows the evidence, and the score changes only when someone clicks Change Score.
1Aiko proposes
Risk analysis · with sourcesRISK-004 · Ransomware on file serversScored Medium × Possible = 4 · evidence says higherBackup restore testLast two runs lateControl · 12 SepPatch level71% against a 95% targetKPI · 30 SepProposed: High × Probable = 92You confirm
You check, one risk at a timeChange Score✓Score changed and loggedRISK-004 risk value493You set the pace
How much Aiko doesSuggest only
Aiko explains. You do it.Ask me first · default
Aiko prepares. You confirm.Do it and tell me
Aiko does it and shows you.
Questions about the group
As a head office administrator, ask which subsidiary has the most open work. Aiko reports on the subsidiaries you administer.
Some things always ask first
Admins set the highest mode for each action.
Every step on record
Every Aiko action goes into the Activity log.
One Aikoacross Acuna GRC. Add a module and it helps there too. How Aiko works
Swiss experts
Can experts support our subsidiaries? Yes, as your CISO as a service.
Our CISO as a service takes on the security program for you, in Acuna GRC, across the entities you choose.
.png&w=3840&q=75&dpl=dpl_Ba6pf7ueYcNioUvDkWkKkJsULeG7)
.png&w=3840&q=75&dpl=dpl_Ba6pf7ueYcNioUvDkWkKkJsULeG7)
CEO of Abilene Group
Henri Haenni
Business continuity and risk management
GRC Consulting team leader
Bénédicte Sévin
GRC project leadership
Do it yourself
You run the program in Acuna GRC, with Aiko.
Done with you
Guidance, reviews and audit preparation with your team.
Done for youCISO as a service
Our experts run it. You review.
CISO as a service, done for you
- Run the security program across entities
- Follow the subsidiaries that slip
- Prepare reviews and audits
Integrations
Does Acuna GRC connect to an enterprise stack? Yes, with 100+ connectors.
Identity, endpoint, cloud, backup and ticketing: connectors pull the data on a schedule and record it as KPI measurements or control executions. Microsoft connectors can run as the Acuna app, approved once and read-only.
Animation: a robot arm takes data from Microsoft Entra ID, Microsoft Defender, Azure, AWS, GitHub and Jira and puts it on a belt into your workspace in Acuna, where your evidence, KPIs and security alerts stay current.
Entra ID
Entra Access Reviews
Entra Directory
Okta
Defender
CrowdStrike
Intune
Microsoft 365
Azure
AWS
Google Cloud
GitHub
ServiceNow
Jira
Acronis
KnowBe4
Microsoft Teams
Slack- 100+ connectors in all
Your tools feed Acuna GRC
Connectors pull security data on a schedule, and API keys let your own systems push data in. Every call is logged.
Missing a connector? We build it.
We design the integration around your setup. Every native connector we have exists because a client needed it.
Fixes land where your team works
Tasks sync both ways with Jira and ServiceNow. See Integrations and API
How it connects
Which parts of Acuna GRC does an enterprise use? The core, the controls IT needs, and the group.
The four core workspaces run the program, with Administration and security and Integrations and API in the core. Group management is the add-on that links the subsidiaries.
Acuna GRC core
Add-on modules
Enterprise connects to
- ComplyFrameworks and scopes per entity
- AssureGroup Compliance lives here
- Group managementHead office and subsidiaries
- Administration and securityMFA, sessions, audit log, backups
- Integrations and APIAPI, webhooks and task sync
- AikoWithin the modes your admins set
FAQ
What else do enterprises ask about GRC software?
Is Acuna GRC ISO 27001 certified itself?
Yes. Acuna GRC is ISO 27001 certified. Our own Trust Center lists what we hold. The Acuna GRC Trust Center
Do subsidiaries see each other’s data?
No. Each subsidiary is its own organization and sees only what the head office sends it, such as a group KPI or a shared supplier. Being in the group grants no access by itself. See Group management
We run client programs as a consultancy. Is this the right page?
Consultants and MSSPs have their own page. Acuna GRC for consultants and MSSPs
How is Acuna GRC priced?
Pricing is per organization, not per seat; the price depends on the modules you add. See pricing
Where is our data hosted?
In Switzerland, the EU or the US, as you choose.
Bringing a group onto one program? Start with one view.
Tell us how your group is organized and what your IT review asks for. We show you Group Compliance, access profiles and the API on a sample group.
Hosted in Switzerland, the EU or the US