HiScout GRC Suite

The Skeptic

The Grundschutz pages show a real, documented risk methodology — BSI-Standard 200-3 and 100-3 with measure suggestions drawn from the Kompendium cross-reference tables — and Grundschutz and BCM risk analyses converging in one tool down to IT implementation. But we found no public information on incident workflows, statutory reporting clocks, or risk acceptance with named ownership, and protection-needs inheritance across asset relations is never spelled out. 2 7 8

Report an error

The Skeptic

Requirement ratings are genuinely versioned across Kompendium editions — parallel editions per scope, a filter showing only requirements needing re-assessment after an update, carried-over ratings, and reports that name their underlying edition — and measures from stored catalogs link to processing activities and reach their recipients automatically. We found no public information on a generated statement of applicability, measure ownership with due dates, or delegation and escalation. 10 11 3

Report an error

The Skeptic

Coverage is deep where the German market counts — full support for BSI-Standard 200-1/2/3, parallel Kompendium editions, active Grundschutz++ preparation with OSCAL and Blaupausen, plus ISO 27001/22301 certification support and Datenschutz catalogs including the Standard-Datenschutz-Modell. But we found no public information on NIS2, TISAX, DORA or SOC 2 content, nor on one-control-many-frameworks mapping; credit to the vendor for stating plainly that Grundschutz++ is implementable only once the BSI publishes a stable version rather than selling it as shipped. 2 9 4 3

Report an error

The Skeptic

The audit module is unusually concrete: ISO 19011 audit programmes with an annual plan, customer, supplier and internal audits, mobile on-site evidence capture with real-time observations, photos and notes, findings routed as measures to the right recipients, and central revision-safe documentation plus ad-hoc reporting. We found no public information on auditor access roles or audit-scoped evidence packs, and revision safety is asserted on the module page rather than shown in mechanism. 11 12 10

Report an error

The Skeptic

Beyond flat file import there is a dynamic XML interface, GSTOOL and CMDB import, a DataExchange extension for database connections, and decentralized questionnaires feeding validated answers directly into the database. We found no public information on a documented REST API, directory or single-sign-on connectors, ticketing integration, or automated evidence testing, so what is shown is import and workflow plumbing rather than feeding from the live estate. 2 3 11

Report an error

The Skeptic

The chain is visibly German — a Berlin GmbH under German parent HiSolutions AG, development and support 100% in Germany, SaaS data in data centers within Germany, an on-premises option with equal features, and a federal SaaS variant via ITZBund. But the published subprocessor list covers only website and customer-portal processing rather than the GRC product itself, the data centers are not named, and the captured pages both state that no third-country transfer is foreseen and invoke GoTo's EU-US Data Privacy Framework certification for webinar processing. 4 2 6 5

Report an error

The Skeptic

We found no public price information on any captured page — no edition, module, user or scale figures, and even the audit module's product factsheet is available only on request. Every configuration begins with a conversation at the sales address. 11 3

Report an error