ZenGRC

Avantages

ZenGRC brings all the tools you need to run a successful GRC program to the table in a clear, concise and minimalist package that's nimble and efficient. Our company had been utilizing the old method of email/spreadsheets and was getting lost in the weeds even on the smallest of audits and struggling to keep up each year to stay ahead. Our evaluations with other tools fell flat, didn't meet our requirements or introduced complexity. Our evaluation of ZenGRC started with skepticism, but quickly turned positive once we realized how logically organized the system was on the back-end. During our testing period, we were able to quickly create a Sarbanes-Oxley program, using both their template import and the GUI, in a matter of days. Since that time only a few short weeks ago we have now almost completed a full internal audit of our SOX program, complete with evidence collection and control evaluations. Our rough estimate has us gaining back a full week of time from previous audits last year and year prior using the old email/spreadsheet method. We are now rolling out an ISO27001, SOC2 and internal security control framework on the heels of the SOX success.

Inconvénients

As with any SaaS from a small company that is new to market (less than 5 years), there are aspects of the tool that require some creative thinking and clever workarounds. This is not necessarily a dislike in my opinion, however less technical individuals may find this aspect difficult or troublesome. ZenGRC staff do redeem themselves on this front as they're quick to respond to feature requests and have already implemented several suggestions our team has submitted. Since starting to use the product, they have continually updated the product with new features, fixes and updates to existing functionality.

Avantages

The ease of use and administration is well balanced with the functionality needed in a GRC tool. ZenGRC gets the job done without being overly complicated.

Inconvénients

To meet our Privacy and Data Governance requirements, we initially deployed on-premises. However, soon after that, we found that software upgrades required significant IT involvement. Also, the technical specifications to continue to host on-premises did not align with our internal standards. We had to re-assessing our risk in storing sensitive information off-site. After performing more stringent due diligence of ZenGRC as a vendor, we migrated to ZenGRC cloud-hosted. Our preference would have been to remain on-premises with better upgrade automation that ZenGRC Administrators could perform within the user interface.

Avantages

ease of implementation and customer service

Inconvénients

was not able to mature with the our growth

Avantages

The ZenGRC solution streamlines conducting internal audits. Auditors can easily set up control frameworks (tons of templates are provided, which is very helpful), evidence requests, assign them to auditees, and review the evidence submitted. Auditees can easily provide feedback, ask questions, and submit evidence for review. The workflows ZenGRC supports are both incredibly accessible and very powerful. ZenGRC actively listens to customers and has actually incorporated a number of suggestions I (and other customers) have made. I'm excited to see what they'll develop in the future.

Inconvénients

The ZenGRC solution is fantastic, and all the complaints I had 1.5 years ago have been resolved, and my expectations exceeded. I wish the vendor/third party management module was receiving more attention, sooner, but the roadmap for its development has been conveyed to me, and I understand the timing. I wish there was a licensing model which was not tied to user counts, which would enable us to do even more with the product.

Avantages

Simple, easy to use, despite managing complex workflows and multiple audits across ,multiple teams. Easy to import specific controls and modify existing control sets to meet our needs as necessary. Audit readiness dashboard is critical as you prepare for new compliance initiatives or are questioned on "how difficult" it would be to be to become compliant with a specific regulation or framework to close a deal.

Inconvénients

The JIRA integration is improving in significant ways, however the complexity and manner with which we implemented JIRA makes an effective integration difficult and as a result the immediate integration is not as useful as we would like to see. That being said, the two-way sync has made a dramatic improvements, and for most customers, the existing integration is likely more than sufficient.

Avantages

I have been using ZenGRC for over two years now and it has been an essential tool helping us get and stay organized when we embarked on gaining a SOC 2 attestation. We have since been through two SOC 2 audits and are using ZenGRC to help us assess and remediate our gaps against ISO 27001.

Inconvénients

There's still a some things you have to edit by exporting to CSV, editing in your favorite spreadsheet app, then re-importing, so it would be nice if some of that functionality was built into the UI. That being said, that workflow is actually ideal for some tasks.

Our last audit firm wasn't able to use the app directly for requesting and managing audit evidence so there was a bit of duplication of effort. The ZenGRC team is making some changes to make that better though.

Avantages

ZenGRC is an incredibly flexible and simple GRC tool. It has capabilities to modify it to support the companies needs. Their strong USP is their capability to map findings, reviews, etc. with predefined security frameworks. The tool is simple and easy to use and great for a company in the early stages of its GRC journey.

Inconvénients

The tool lacks a lot of features available in standards enterprise GRC systems. There is always going to be a considerable amount of development effort by the implementing team since many features are not pre-built. The UI is too cluttered and a lot of advanced vendor module functionalities are not available.

Avantages

This tool is very user friendly and navigation is around. It gives us one single platform to keep our audits managed efficiently and easily accessed if needed. We now have a tracking system for our compliance issues to resolve them swiftly and avoid fines and penalties to stay compliant. This tool has been a great organizational tool with many features to save time with tedious audits.

Inconvénients

There could be more reporting features available. There seems to be a lot of editing involved to download and/or export documents. If this was a built in feature with this software that would be helpful.

Avantages

ZenGRC is great for our team since we have one contract with a lot of requirements. The software gave us the ability to customize without the added costs with other off-the-shelter software.

Inconvénients

Although this is a minor concern, I wish the software would allow for renaming the main attributes. We use different terminology from the software and is confusing for some of the users.

Inconvénients

The tool needs some enhancements and bug fix to add value to the customers and be user friendly. We are actively using the tool to manage our PCI audit. There are some features that needs to be added to save time during evidence collection and verifying process. I do not think the ZenGRC has met their SLA for customer support. I hope they work on redefining their SLA for their customer.

Avantages

The ability to customize the use of the software to meet our unique needs. The technical folks also understand our use case and suggest different ways for us to think about our data and how best to represent it. I like way the system has matured and is tying various elements together (like audit and risk). Customer service is excellent and I really, really like having the same person to deal with all the time. This eliminates having to re-explain your data set to the next help desk guy.

Inconvénients

While many of the changes to the system have been helpful, the constant changes can be hard to keep up with and difficult to plan how to expand our use of the system.

Avantages

The software is easy to use once you become familiar with how to accomplish tasks.

Inconvénients

Some features seem to have limited capability but support took my ideas on how the software could be improved.

Avantages

The team loves the flexibility of the tool, and how we can adapt the models to work that is not traditional controls development, testing and tracking.

Inconvénients

I cannot think of anything my team does not like about the product and services. We are very happy with out purchase.

Avantages

Managing multiple audits in one platform in the past we used to track our communication via email and in spreadsheet and now we can have log of each communication via this tool.

Inconvénients

Audit manager are not able to choose the request template based on the different types of audit frameworks.

Avantages

It is a good product but lack customer service

Inconvénients

It would be great to have a product that can communicate with the pos and produce the prep list per day

Avantages

Ease of use
Relationships of objects
Standards library

Avantages

Helps to map requirements and controls from multiple certification regimes over to others so you don't spend a lot of time duplicating and re-documenting work. You can do certain core things once and have it covered for everything.

Inconvénients

The various levels of concepts are bit confusing, especially as some of the frameworks have to be imported, and you have to decide which frameworks to use up front, without a lot of context about what the differences are.

Avantages

Easy to set up and begin recording and reporting on risks. All our compliance requirements in one central place and accessable by a few clicks of a button.

Inconvénients

It needs more reporting and visual features as my target audience need more graphs and items to show different risk profiles, risk appetite, thresholds etc

Avantages

It gives me everything I need in regards to dashboards, heatmaps and condensing all of my risks and regulations.
The evidence collection and workflows replaced what was an otherwise tedious and duplicative process with JIRA tickets.

Inconvénients

Needs more reporting functions and different dashboard types
A fair amount of things you have to edit by exporting to CSV, editing in your favorite spreadsheet app, then re-importing, so it would be nice if some of that functionality was built into the U

Avantages

As a non-technical founder, I evaluated this product on behalf of our customer/prospects. Its intuitive, easy to follow workflows in managing the complexity of rapidly changing and dynamic requirements in compliance, governance, and security are issues that are top of mind early in the product design and discovery phase. Having a trusted partner provides reassurances and more holistic solutions to meet these challenges and increase value.

Inconvénients

The only cons are related to having not used the product as an end user, but rather evaluated from demos, meetings, and whitepapers to enhance customer value and as a potential partner.

Avantages

ZenGRC has a nice user interface and is fairly intuitive to use. I can't tell you how many horrible GRC tools I've used. ZenGRC is refreshing.

Inconvénients

I would love to see a way to use ZenGRC as a tool to automate audit workprograms, testing, spreadsheets and reporting.

Avantages

Since implementing ZenGRC, Vision Critical has improved our ability to effectively and efficiently manage our compliance audits. ZenGRC provides a user-friendly mechanism for submitting evidence and ensuring that appropriate artifacts have been submitted. Furthermore, The ZenGRC dashboards allow Vision Critical to manage and track multiple audits and risk items, while delivering successful results.

Inconvénients

We are anxiously awaiting storage integration with AWS S3 and will continue to review other potential solutions with Reciprocity labs.

Avantages

Software has a simple user interface which is easy to use and customize. This exceeds expectations compared to its competitors.

Inconvénients

The reporting side could be better. I did like to see more metric visuals based on the target audience