Every new framework means a new spreadsheet.
Fix: One measure counts for every framework it meets. Adopt the common measures, and Mapping shows what each new framework still needs.
See one measure libraryMid-market
GRC software for mid-sized companies
A small team, a growing list of frameworks. Keep one library for all of them.
Acuna GRC keeps one list of what you do, so each new framework reuses it. Scopes keep your sites and entities apart, connectors bring in the numbers, and Aiko and our experts extend the team.
1 · PICK YOUR FRAMEWORKS4 adopted
✓ISO/IEC 27001:2022Adopted
✓NIS2 DirectiveAdoptAdopted
✓FINMA Circular 2023/1Adopted
✓NIST CSF 2.0Adopted
2 · CLOSE THE GAPSApply selected
Orphan requirements4112Aiko proposes
✓Backup and disaster recoveryLinked
✓ICT readiness for continuityLinked
3 · FOLLOW THE ROADMAPISO 27001
SupportLeft to do: 94
✓Context and leadershipDone
✓Planning and riskDone
Does this sound like you?
Why does compliance get harder as a company grows? Each framework adds its own copy.
A second framework, a new site, a new customer requirement: each one tends to start a new spreadsheet. The same work gets done twice, by the same two people.
Our sites each do it their own way.
Fix: Assign frameworks and records to scopes for each site or entity. The scope filter follows you across modules.
See scopes and tagsTwo people can’t do it all.
Fix: Aiko prepares the mapping and drafts work for you to confirm, and our Swiss experts extend the team when you need them.
See Aiko at your paceHow Acuna GRC covers it
What should GRC software do for a mid-sized company? Reuse the work, keep it tidy.
Acuna GRC keeps one library of measures for all your frameworks, scopes for each part of the company, connectors to the tools you run, and access that fits each person.
01 · Comply
How do we add a second and third framework without doubling work?
Adopt the reference measures recommended for your frameworks in Common Measures. Each lands in your Measure Library linked to the requirements of every framework it meets, and Mapping lists the requirements still without a measure.
See Comply →02 · Scopes & Tags
How do we keep sites and business units apart?
Create scopes for your entities, sites or business units, nested under a Global scope, and assign frameworks and records to them. The global scope filter limits every table and dashboard, follows you between modules and pre-assigns new records.
See scopes in Comply →03 · Integrations
Does it connect to our tools?
Connectors pull data from your identity, device, cloud and HR tools every 4 hours and record it as KPI measurements or control executions. Tasks stay in step with Jira or ServiceNow, and daily summaries can reach Teams or Slack.
See Integrations and API →04 · Administration
Can each person see only their part?
Access profiles choose the modules, record types, scopes and tags each person sees, from full edit to read-only. Acuna seeds starter profiles such as Auditor and Control Owner to copy and adjust.
See Administration and security →Add-ons a growing company adds
Aiko at your pace
How much can AI take on for a small team? Aiko prepares. You decide.
In Mapping, Run AI suggests a measure from your library for each gap, with a confidence score and a reason. Nothing is linked until you apply it.
1Aiko proposes
Run AI · from your libraryVulnerability assessments and testingFINMA Circular 2023/1 · No measure linked✓Vulnerability scanningCovers scanning and fixing weak spots.94✓Annual penetration testCovers outside testing, not scanning.612You confirm
You tick what is rightApply selected✓Linked, with its reasonOrphan requirements41403You set the pace
How much Aiko doesSuggest only
Aiko explains. You do it.Ask me first · default
Aiko prepares. You confirm.Do it and tell me
Aiko does it and shows you.
Many gaps, one run
Ask which controls have no measure and Aiko plans the missing links in a bulk run on its own page. You tick what is right and click Apply.
Some things always ask first
Admins set the highest mode for each action.
Every step on record
Every Aiko action goes into the Activity log.
One Aikoacross Acuna GRC. Add a module and it helps there too. How Aiko works
Swiss experts
What if we don’t have a CISO? Ours works with your team.
Our CISO as a service extends a small team: experts in information security, GRC projects and data protection law work with you in Acuna GRC, as much or as little as you need.
.png&w=3840&q=75&dpl=dpl_Ba6pf7ueYcNioUvDkWkKkJsULeG7)
GRC Consulting team leader
Bénédicte Sévin
GRC project leadership
Legal and compliance expert
Laura Menetrey
GDPR, NIS2, DORA, FADP
Do it yourself
You run the program in Acuna GRC, with Aiko.
Done with youCISO as a service
Guidance, reviews and audit preparation with your team.
Done for you
Our experts run it. You review.
CISO as a service, done with you
- Set up your frameworks and scopes
- Prioritise the gaps across frameworks
- Prepare reviews and audits with your team
Integrations
Does Acuna GRC connect to the tools we already run? Yes, with 100+ connectors.
Identity, devices, cloud, HR, tickets and chat: connectors pull the data on a schedule, so a small team spends less time collecting it by hand.
Animation: a robot arm takes data from Microsoft Entra ID, Microsoft Defender, Azure, AWS, GitHub and Jira and puts it on a belt into your workspace in Acuna, where your evidence, KPIs and security alerts stay current.
Entra ID
Okta
Google Workspace
Intune
Jamf Pro
Defender
Microsoft 365
AWS
Azure
GitHub
Jira
ServiceNow
Personio
KnowBe4
Microsoft Teams
Slack- 100+ connectors in all
Your tools feed Acuna GRC
Connectors pull security data on a schedule, and API keys let your own systems push data in. Every call is logged.
Missing a connector? We build it.
We design the integration around your setup. Every native connector we have exists because a client needed it.
Fixes land where your team works
Tasks sync both ways with Jira and ServiceNow. See Integrations and API
How it connects
Which parts of Acuna GRC does a mid-sized company use? The core, then what you need.
Start with the four core workspaces, which run every framework on one library. Add modules such as TPRM or Evaluations as the company grows.
Acuna GRC core
Add-on modules
Mid-market connects to
- ComplyFrameworks, common measures and scopes
- ImplementOne measure library for all of them
- OperateRisks, tasks and policies
- AssureRecords, audits and KPIs
- Integrations and APIConnectors, task sync and the API
- Administration and securityAccess by profile, scope and tag
- AikoSuggests the links in Mapping
FAQ
What else do mid-sized companies ask about GRC software?
Is GRC software worth it for a team of two?
Yes, if it saves the same work being done twice. Measures are shared across frameworks, Aiko prepares links for you to confirm, and our experts can take on part of the work.
Can we import what we already have in spreadsheets?
Yes. The Data Import wizard brings in assets, risks, third parties, staff, documents and more from CSV or Excel, with column mapping and validation before anything is created.
Which frameworks can we run?
Adopt the frameworks you need from the library, such as ISO 27001, NIS2 or the GDPR, and import your own from a CSV file. They share one measure and control library. What is cross-framework control mapping?
How is Acuna GRC priced?
Pricing is per organization, not per seat, so adding users costs nothing extra. The price depends on the modules you add. See pricing
Where is our data hosted?
In Switzerland, the EU or the US, as you choose.
Growing past the spreadsheet? Start with one step.
Tell us your frameworks and how your company is organised. We show you how Acuna GRC keeps them in one library, and how our experts can work with your team.
Hosted in Switzerland, the EU or the US