Our compliance lives in spreadsheets and shared folders.
Fix: Each measure and control is one record with an owner, a schedule and its proof. Health rolls up from controls to measures to the requirements of every framework.
See measures and controlsGRC software
Governance, risk and compliance software
GRC software for frameworks, risks and audits on one set of data
One program instead of ten spreadsheets. With Aiko and Swiss experts, at your pace.
Acuna GRC is the GRC tool for teams replacing spreadsheets or an older system: 50+ frameworks in one library, risks, controls, suppliers and audits on the same data, 100+ connectors, and hosting in Switzerland or the EU.
1 · PICK YOUR FRAMEWORKS4 adopted
✓ISO/IEC 27001:2022Adopted
✓NIS2 DirectiveAdoptAdopted
✓FINMA Circular 2023/1Adopted
✓NIST CSF 2.0Adopted
2 · CLOSE THE GAPSApply selected
Orphan requirements4112Aiko proposes
✓Backup and disaster recoveryLinked
✓ICT readiness for continuityLinked
3 · FOLLOW THE ROADMAPISO 27001
SupportLeft to do: 94
✓Context and leadershipDone
✓Planning and riskDone
What GRC software is
What is GRC software? One place for the whole program.
GRC software keeps governance, risk and compliance in one system: the frameworks you must meet, the measures and controls that meet them, your risks, and the proof that it all works.
Governance
Policies with approval and review dates, roles and responsibilities, and the objectives management follows.
Risk
A risk register with owners, an impact by likelihood matrix, treatment plans and yearly reviews.
Compliance
The requirements of each framework or law, the measures that meet them, and the evidence, audits and KPIs behind each one.
Does this sound like you?
Why replace spreadsheets or an older GRC tool? The copies no longer agree.
A second framework, a new entity or an audit request is usually the moment: the same control lives in three files, nobody knows which one is current, and proof is rebuilt by hand.
Our last GRC project took months before anyone could use it.
Fix: You start from a library: adopt your frameworks, take the reference measures recommended for them and import what you already have from CSV or Excel. A dedicated advisor sets it up with you.
See the framework libraryRisk, suppliers and privacy each sit in a different tool.
Fix: Risks, suppliers, privacy records and AI systems link to the same assets, processes and controls, so one change shows everywhere it matters.
See what runs on the same dataWhat Acuna GRC covers
Which modules should GRC software have? A core for the program, add-ons for the rest.
Acuna GRC has four core workspaces on the same data: Comply, Implement, Operate and Assure. Add-on modules such as TPRM, Data Privacy and AI Governance switch on when you need them.
01 · Comply
Which frameworks does it cover, and what happens when we add one?
Adopt frameworks from a library of 50+, such as ISO 27001, NIS2, DORA, the GDPR and SOC 2, or import your own from a CSV file. Common Measures are mapped across frameworks, so one measure counts for every requirement it meets, and Mapping lists the requirements that still have none.
See Comply →02 · Implement
How do measures and controls get owners and proof?
Each measure in Implement has an owner, and each control that checks it has a schedule and a checklist. Every signed run is kept as proof, and health rolls up from controls to measures to requirements. Assets, processes, third parties and staff give the business context.
See Implement →03 · Operate
How does it handle risk management and day-to-day work?
Operate keeps risks and opportunities on an impact by likelihood matrix, with treatment plans and an owner for each. The business impact analysis, documents with approval and review dates, recurring tasks and the Annual Plan run in the same workspace.
See Operate →04 · Assure
How do we show an auditor that it works?
Assure keeps KPIs and their measurements, evidence, audits, issues and corrective actions, and generates reports. Exceptions record an approved, time-bound acceptance of a gap, with a warning before it expires.
See Assure →05 · TPRM
Does it cover supplier risk in the same place?
TPRM keeps one supplier register. Send questionnaires one at a time or as a campaign, score the answers, and follow a daily A to F grade of each supplier’s public security posture, linked to the same assets and processes as the core.
See TPRM →More add-on modules on the same data
- Data PrivacyProcessing activities, DPIAs, data subject requests and personal data breaches for the GDPR and the Swiss FADP.
- AI GovernanceAn inventory of AI systems with their EU AI Act classification, impact assessments and human oversight, for ISO/IEC 42001 and the EU AI Act.
- Trust CenterAnswer security questionnaires from a library of answers and publish a trust page with gated documents.
- Group managementA head office follows the compliance, KPIs and suppliers of every subsidiary in one view.
- Vulnerability managementScanner results become one issue per vulnerability, with an owner and a due date.
- EvaluationsRun a gap assessment of a framework or a site, frozen on the day it is answered.
Choosing GRC software? See it on your frameworks.
Leave your work email, company and size, and one of our experts shows you Acuna GRC on the frameworks you run.
Hosted in Switzerland, the EU or the US
Aiko at your pace
What does AI do in GRC software? Aiko proposes. You confirm.
Aiko is the assistant inside Acuna GRC. In Mapping, Run AI suggests a measure from your own library for each requirement with none, with a confidence score and a reason. Nothing is linked until you apply it.
1Aiko proposes
Run AI · from your libraryVulnerability assessments and testingFINMA Circular 2023/1 · No measure linked✓Vulnerability scanningCovers scanning and fixing weak spots.94✓Annual penetration testCovers outside testing, not scanning.612You confirm
You tick what is rightApply selected✓Linked, with its reasonOrphan requirements41403You set the pace
How much Aiko doesSuggest only
Aiko explains. You do it.Ask me first · default
Aiko prepares. You confirm.Do it and tell me
Aiko does it and shows you.
Ask your own program
Ask Aiko which controls have no measure or what to work on first, and create a task or a KPI from the conversation.
Some things always ask first
Admins set the highest mode for each action.
Every step on record
Every Aiko action goes into the Activity log.
One Aikoacross Acuna GRC. Add a module and it helps there too. How Aiko works
Swiss experts
Who helps us set it up? A dedicated advisor, from day one.
Each core subscription includes a dedicated advisor and one month of hypercare. Our experts in information security, GRC projects and data protection law work with your team in Acuna GRC, as much or as little as you need.
.png&w=3840&q=75&dpl=dpl_3X9AFTw2uy2qKV12Ru211HSxMAqk)
GRC Consulting team leader
Bénédicte Sévin
GRC project leadership
Legal and compliance expert
Laura Menetrey
GDPR, NIS2, DORA, FADP
Do it yourself
You run the program in Acuna GRC, with Aiko.
Done with youSetup with an advisor
Guidance, reviews and audit preparation with your team.
Done for you
Our experts run it. You review.
Setup, done with you
- Adopt your frameworks and set your scopes
- Import what you already have in spreadsheets
- Prepare your first review or audit with your team
Integrations
Does it connect to the tools we already run? Yes, with 100+ connectors.
Identity, devices, cloud, HR, code and tickets: connectors pull the data on a schedule and record it as KPI measurements or control executions, so evidence stays current without a manual step.
Animation: a robot arm takes data from Microsoft Entra ID, Microsoft Defender, Azure, AWS, GitHub and Jira and puts it on a belt into your workspace in Acuna, where your evidence, KPIs and security alerts stay current.
Entra ID
Okta
Google Workspace
Intune
Jamf Pro
Defender
CrowdStrike
Microsoft 365
AWS
Azure
GitHub
Jira
ServiceNow
Personio
KnowBe4
Microsoft Teams
Slack- 100+ connectors in all
Your tools feed Acuna GRC
Connectors pull security data on a schedule, and API keys let your own systems push data in. Every call is logged.
Missing a connector? We build it.
We design the integration around your setup. Every native connector we have exists because a client needed it.
Fixes land where your team works
Tasks sync both ways with Jira and ServiceNow. See Integrations and API
How it connects
How do the parts of Acuna GRC fit together? One data model, every module.
The four core workspaces come with every subscription. Aiko, Integrations and API, and Administration and security work across all of them, and each add-on module uses the same records.
Acuna GRC core
Add-on modules
GRC software connects to
- ComplyFrameworks, common measures and scopes
- ImplementMeasures and controls with owners
- OperateRisks, documents and tasks
- AssureKPIs, audits and corrective actions
- TPRM (Supplier Shield)Supplier register and assessments
- Data PrivacyGDPR and Swiss FADP records
- AI GovernanceAI systems and impact assessments
- Trust CenterQuestionnaires and a trust page
- Group managementEvery subsidiary in one view
- Integrations and APIConnectors, task sync and the API
- Administration and securityAccess by profile, scope and tag
- AikoSuggests, you confirm
FAQ
What else do buyers ask about GRC software?
What is the difference between GRC software and compliance automation?
Compliance automation tools collect evidence from IT systems to prepare the audit of a given framework. GRC software runs the whole program: frameworks, risks, policies, suppliers, audits and corrective actions. Acuna GRC does both: connectors collect the evidence, and the program runs on the same data.
How long does GRC software take to implement?
It depends mostly on how many frameworks and entities you cover. Acuna GRC does not start from a blank page: you adopt frameworks from the library, take the reference measures recommended for them, and import existing assets, risks and documents from CSV or Excel. A dedicated advisor and one month of hypercare are included. Set it up with our experts
How much does GRC software cost?
Acuna GRC is priced per organisation: Core GRC and all 50+ frameworks are included, and adding users does not change the price. Add-on modules and expert days are quoted in your offer. See pricing
Can we choose where our data is hosted, or run it on-premises?
Yes. Your data is hosted in Switzerland or the EU, as you choose. Acuna GRC can also be deployed in a private cloud or on-premises.
Is it a fit for a company of 50 to 250 people?
Yes. Pricing is per organisation, measures are shared across frameworks, and Aiko and our experts extend a small team. GRC software for mid-sized companies
We are a group with several entities. How does that work?
Inside one organisation, scopes keep entities, sites and business units apart, and a global scope filter follows you across modules. When subsidiaries run their own Acuna GRC, the Group management add-on gives the head office one view of them. Enterprise GRC software
Can we bring our own framework or internal policy set?
Yes. Import a framework from a CSV file and it uses the same measure and control library as the frameworks from the catalogue.
Ready to see it on your own scope?
One of our Swiss experts gets back to you.