DataGuard ISMS

The GRC Consultant

There is a real core here: structured asset register with owners, tags, dependency visualization and asset-risk linking, a risk distribution matrix, and treatment tracking through tasks with progress and remediation guidance. But I found no public information on a documented risk methodology, inherited protection needs across asset relations, or incident workflows with statutory NIS2 reporting clocks — incident handling surfaces only as a configurable workflow and a module name, which lands this at the workable-core level, not a certifier-grade risk backbone. 3 8 9 16

Report an error

The GRC Consultant

Measures live in one central place, the same measure links to multiple frameworks, implementation status carries clear responsibilities, effectiveness is assessed, and evidence is mapped to requirements automatically — that is the answer-a-control-once model that makes client twelve cheaper than client one. What holds it below the top band: the SoA material I found explains what a SoA must contain rather than showing the product generating it from live status, and I found no public information on internal audit workflows, findings management, or delegation and escalation. 8 10 11

Report an error

The GRC Consultant

ISO 27001, TISAX, NIS2, DSGVO and the EU AI Act cover the major German-market regimes, and the cross-mapping is genuine: asset management maps to measures from ISO 27001, NIS2 and TISAX, one measure serves several frameworks, a preconfigured NIS2 framework exists, and the vendor publishes an NIS2-to-ISO 27001:2022 mapping guide. I found no public information on SOC 2, DORA or BSI IT-Grundschutz, and the ready-made measures library leads with ISO 27001 with further frameworks announced as coming — five regimes with real but partial mapping, not a living multi-compliance product. 3 9 10 13

Report an error

The GRC Consultant

Automated, shareable reports in minutes, real-time dashboards for compliance gaps, evidence auto-assigned to requirements, and a customer case citing 140+ evidence artifacts for a TISAX assessment — that is the report-generator-plus-attachments level I can work with, and the customer outcomes suggest it functions. I found no public information on revision-safe change history, auditor access roles, or audit-scoped evidence packs on demand, and nothing that answers the auditor's question of state on a given date. 10 12 14 16

Report an error

The GRC Consultant

An API with its own documentation surface, preconfigured connectors for Jira, Asana, Azure asset updates and CRM consent data, real-time synchronization across integrated tools, and AI-assisted automation — a handful of native connectors around a core API. I found no public information on directory import, SSO/SCIM, webhooks, CMDB or scanner feeds, and the automation claims are headline percentages (up to 40 per cent of tasks) rather than automated evidence tests against the live estate. 1 8 16

Report an error

The GRC Consultant

A German GmbH with a proper imprint, register entry and a privacy policy that relies on SCCs for recipients outside the EU — the entity is clean, but a UK office and acquisition history sit alongside that. I found no public information on hosting location, named data centers, a subprocessor list, or a downloadable DPA and TOMs, so the subprocessor exposure behind a system holding my clients' risk registers is undocumented. 5 6 7

Report an error

The GRC Consultant

Three named tiers — Base, Pro, Enterprise — each behind a request-a-quote button, with no public numbers anywhere on the pricing page; a 'no hidden costs' slogan is not a price. The only figures anywhere are percentage claims such as up to 50 per cent cheaper than external consultants, so the real invoice is a sales conversation in every configuration. 2 4 9

Report an error