ZenGRC

What do you like best?

Top of the list has to be mapping controls to multiple frameworks. We currently audit against 6 frameworks and the fact that we don't have to deal with duplicated evidence requests is a huge win. We use ZenGRC for our Vendor Security Questionnaires, Risk Assessment Questionnaires, Data Audits and so on. With the ability to create your own questionnaires with branching logic, you can really leverage this tool in a lot of different ways.

What do you dislike?

I have found that it is possible to get "lost" when drilling down into specific controls, where it is difficult to find my way back to where I started. Having said that, much of the pain we've experienced when using ZenGRC was due to us not using it properly and a quick call to our CSM is generally all that was needed to get us back on track.

What problems are you solving with the product? What benefits have you realized?

Our initial business driver was to help manage evidence collection for our ISO 27001 audits. We had been using spreadsheets for the IRL and manually sending emails to attempt to collect the evidence. Moving to ZenGRC cut the effort required to manage the evidence collection significantly and gave us better visibility into the status of each item. Over time, we have added an additional 5 frameworks to ZenGRC and this is where it really shines! Mapping common controls to multiple frameworks and applying the evidence across them is huge. Without a tool like this, managing 6 audits would be a nightmare for everyone involved.