01
Certify faster
Map clauses and controls across ISO 27001, SOC 2, ISO 42001, ISO 9001, CIS, and more — with owners, status, and SOA export.
Explore frameworksGovernance that stays audit-ready without the spreadsheet chaos
One workspace for certifications, access reviews, evidence, policies, risk, and incidents — with an AI assistant scoped to your tenant.
app.grcdesk.com / dashboard
Track framework implementation progress — ready-control percentages, expiring evidence, and remediation items in one workspace view.
From noise to a register
Chaos in. A workspace you can run.
Compliance work needs an owner and a date before anyone can run it. GRCDesk gives your team a register they can track and take into an audit.
Chaos
Files, messages, and unnamed work
GRCDesk
Managed
Owner, date, and status on every record
Information security policy
12 Mar
Policies·Security lead·Published
Yearly review · valid until 12 Mar 2027
From ISP_final_v7_REAL.docx
Named administrator accounts
18 Mar
Access·IT operations·In progress
Shared login removed · 3 people named
From shared admin password
Cloud host review
2 Apr
Vendors·Procurement·Scheduled
Due diligence open · risk medium
From vendors.xlsx · tab 4
INC-103 Laptop loss
9 Apr
Incidents·On-call·Closed
Severity medium · evidence attached
From fwd: laptop is missing
Frameworks supported
- ISO 27001
- ISO/IEC 42001
- SOC 2
- ISO 9001
- GDPR
- NIST CSF
What teams use GRCDesk for
Certification programs, access reviews, evidence, risk, incidents, policies, training, vendors, and assets — one multi-tenant workspace for compliance and security operations.
02
Prove access
Run access reviews, manager sign-off, and keep an auditable record of who had access to which tools and groups.
Explore access03
Keep evidence audit-ready
Attach evidence to requirements with valid-until dates, remediation alerts, and one source of truth for auditors.
Explore evidence04
Assess and treat risk
Maintain a risk register, score scenarios, assign owners, and track mitigation alongside your control program.
Explore risk05
Respond to incidents
Intake, assign, and resolve security incidents with timelines, evidence, and root-cause documentation.
Explore incidents06
Publish policies & train people
Publish internal policies, track acknowledgements, and assign security and compliance training in one workspace.
Explore policies07
Govern vendors & assets
Inventory third parties and organizational assets — reviews, custody, and lifecycle history for ops and audit.
Explore modules08
Connect your stack
Sync directories and tools per tenant — Google Workspace, Slack, GitHub, identity providers, and more.
Explore integrations09
Upskill the workforce
Assign recurring security and compliance courses and track completion through the employee portal.
Explore trainingPlatform at a glance
Modular product areas with shared evidence, ownership, and reporting — not another spreadsheet program.
Dashboard readiness
Framework progress, expiring evidence, and open access reviews in one view.
Multi-framework
ISO 27001, 42001, SOC 2, 9001 enabled per tenant.
Evidence lifecycle
Valid-until dates and remediation alerts on every requirement.
Access reviews
Tools, email groups, and chat groups with manager sign-off.
AI assistant
Contextual guidance for controls and documentation — scoped to your workspace.
Platform
Built for multi-framework compliance and day-to-day governance
A modular workspace for compliance, security, and IT teams to manage controls, documentation, and operational work. An integrated AI assistant is included from the Plus plan.
- Multi-tenant workspaces with role-based access
- Multiple certification frameworks — ISO 27001, ISO/IEC 42001, SOC 2, ISO 9001, and more
- Integrated AI assistant to accelerate compliance and security workflows
- Modular product areas enabled per organization
- Integrations with identity, HR, dev, and AI tools for directory sync
- Single sign-on (SSO) — configure Google, Microsoft, Okta, and other providers per tenant
- Evidence with validity and remediation tracking
- Access review cycles with manager workflow
- Policy publishing, training, vendors, assets, and incidents in one place
Enterprise sign-in
Configure SSO and sign in with your corporate identity
Tenant administrators can set up single sign-on (SSO) in System Settings so users sign in with their organization's identity provider — no separate GRCDesk password required when SSO is enabled for your workspace.
- Per-tenant SSO configuration — each workspace controls its own providers
- Users sign in from the login page once their email domain is recognized
- Works alongside role-based access controls and audit logging
- Available on Enterprise plans; Professional can add SSO — see Plans for details
Supported identity providers
Configure one or more providers per tenant workspace. Your administrator enables the options your organization uses.
Google WorkspaceMicrosoft Entra IDOktaAuth0JumpCloudCustom OIDC
How setup works
Your IT or security team adds provider credentials in System Settings → SSO. After setup, users enter their work email on the sign-in page and continue with their configured provider.
AI assistant
Intelligent support for compliance and security teams
GRCDesk includes an integrated AI assistant that helps practitioners work more efficiently within their workspace — reducing time spent on research, documentation, and routine governance tasks while maintaining the rigor your program requires.
- Contextual guidance aligned with your enabled frameworks, modules, and workspace data
- Faster navigation of controls, policies, evidence, and operational records
- Assistance with documentation drafting and structured compliance responses
- Available to authorized users in each tenant workspace after sign-in
Workspace AI assistant
Available after sign-in to your tenant
Ask questions about controls, policies, evidence, and operational workflows in context — and receive structured guidance to help your team act sooner.
The assistant supports compliance and security practitioners; it does not replace formal approvals, audit evidence, or policy ownership.
Integrations
Connect the tools your teams already use
Sync directories from Google Workspace, Slack, GitHub, HiBob, Jira, Atlassian, OpenAI, Cursor, Notion, and more — then use that data in access reviews and compliance workflows.
Explore integrationsDirectory sync
Pull active users from connected systems on a schedule. Compare roster data against GRCDesk access records to spot drift before reviews.
Access review support
Feed integrations into Access Management — tools, groups, and manager review cycles — so certifiers work from current membership, not stale exports.
Tenant-scoped & secure
Each workspace configures its own connectors. Credentials are stored per organization; sync jobs run in the context of your tenant.
Growing connector catalog
Identity, HR, project management, AI, design, CRM, and productivity tools — with more connectors added as customer programs expand.
Product modules
Modular product areas for your program
Enable the modules your organization needs — organized around certification, governance, and day-to-day security operations.
Certification & compliance
Framework mapping, control tracking, evidence deadlines, and audit-ready evidence.
Frameworks & Certification
Work with multiple certification and control frameworks in one workspace — including ISO 27001, ISO/IEC 42001 (AI management), SOC 2, ISO 9001, and others enabled for your organization.
- Configurable framework catalogs per tenant
- Clauses, domains, controls, and requirements
- Compliance status tracking per requirement
Evidence Management
Collect and maintain audit evidence with validity dates and remediation visibility.
- Upload evidence linked to controls and requirements
- View, download, and manage evidence files
- Valid-until date tracking
Compliance Calendar
See evidence renewals, deadlines, and scheduled compliance work on one calendar, and add reminders that also become tasks.
- Evidence renewals and upcoming deadlines in week and month views
- Custom reminders that create a follow-up task
- Filter by framework, status, and your own renewals
Governance & workforce
Access reviews, policy publishing, and employee training.
Access Management
Track tools, groups, and organizational access with structured review cycles for managers. Connect SaaS and identity integrations to sync directory rosters for compare and certification.
- Tools, email groups, and chat groups
- Departments and team managers
- Access review cycles with manager workflow
Policy Management
Publish internal policies and documentation with employee portal access for acknowledgement.
- Internal policy publishing
- Policy templates and documents
- Employee portal for assigned policies
Employee Training
Assign and track security and compliance training for employees with portal visibility.
- Training modules and assignments
- Recurrence and completion tracking
- Employee portal access
Risk & operations
Risk scenarios, incidents, vendors, and asset lifecycle.
Risk Management
Manage control ownership, implementation status, and risk scenarios with structured applicability reasons.
- Risk library and assessment matrix
- Control ownership and status
- Applicability: Legal, Contractual, Business/Risk, Best Practice
Incident Management
Report, assign, and resolve security incidents with evidence and timeline tracking.
- Structured incident intake and classification
- Assignment and status workflow
- Evidence attachments and timeline
Vendor Management
Maintain third-party vendor records, reviews, and risk assessments alongside your compliance program.
- Vendor inventory and contact details
- Review cycles and risk assessment fields
- Document attachments
Asset Management
Track organizational assets, assignments, custody, and lifecycle events for audit and operations teams.
- Asset inventory with types and locations
- Assignment and offboarding return tracking
- Custody and exception reporting
Get started
Request a tailored demo
See the modules, AI assistant, and frameworks relevant to your organization. We will confirm your preferred date and time for a walkthrough.
Already have an account? Sign in — including SSO for configured workspaces.