BIC GRC

The Drafted IT Officer

Enterprise Risk shows a real risk engine — risk matrix scaling up to Monte Carlo simulation, treatment choices covering avoidance through acceptance, interdependency analysis, and automated action tracking with reminders — and Technology Risk Management ties applications to business processes with business-criticality ratings. What I found no public information on: incident workflows with statutory reporting clocks such as NIS2's 24/72-hour deadlines, protection-needs inheritance across asset relations, or a named risk methodology. The risk half looks genuinely operable for a one-person security office; the incident half is a question mark I'd have to raise in the demo. 2 3 5

Report an error

The Drafted IT Officer

Controls are linked to risks with a risk-control matrix at the push of a button, centralized and decentralized control selection, adequacy and effectiveness assessments, and measures assignable to multiple risks with reminders to those in charge; Internal Control ships with what the vendor calls all common control standards. I found no public information on statement-of-applicability generation or catalog versioning, so an SoA looks like manual assembly. The control fabric is more than a checklist, but the SoA question — the one my auditor asks first — goes unanswered on these pages. 3 4 5

Report an error

The Drafted IT Officer

The captured pages name COSO II ERM as a reference and describe workflows supported by common norms and standards, with risks classifiable across compliance, security, ESG and ICS. Beyond that I found no public information naming ISO 27001, NIS2, TISAX, DORA or BSI IT-Grundschutz, and no evidence that one control answer maps across several frameworks. "All common control standards" is a claim I cannot check against a list, and for someone buying content rather than software, that is the whole ballgame. 5 6

Report an error

The Drafted IT Officer

Internal audit is the strongest showing: multi-year audit program planning, guided execution, per-activity result documentation, findings turned into suggested results automatically, one-click reports, dashboards, and automated notification of critical results to management, with explicit support for external auditors. I found no public information on revision-safe change history, audit-scoped evidence packs or auditor access roles — the pieces that answer "show me the state on date X". Running audits day to day looks genuinely workable; the defensible-proof side is what the pages do not show. 6 7

Report an error

The Drafted IT Officer

A REST API billed as plug-and-play plus bidirectional exchange with ERP, CRM, EAM and RPA systems, with SAP, LeanIX, UiPath and Microsoft named, is a real connector story. It is process-estate shaped rather than security-estate shaped: I found no public information on directory import from AD or Entra, SSO, Jira- or ServiceNow-class ticketing, CMDB feeds or automated evidence collection. Automation here means reminders, approval workflows and RPA — my re-typing goes away, my evidence gathering does not. 3 9

Report an error

The Drafted IT Officer

The vendor presents as German (GBTEC Software AG, German and Austrian contact numbers), which is a reasonable start. But I found no public information on hosting locations or named data centers, a published DPA, or a subprocessor list — and the risk register itself is exactly the data I need jurisdictional answers for before it goes anywhere. Until those pages exist, I am asking in the sales call rather than reading it up front. 1 7

Report an error

The Drafted IT Officer

The pages show a demo call and a cost-free trial, and on prices I found no public information at all: no edition figures, no module prices, no user or entity boundaries. The real invoice is computable only through a sales conversation. 3 4

Report an error