Managed GRC
An outsourced GRC function for growing software companies
A named advisor runs your security governance, risk, and compliance program on an ongoing basis: policies, risk decisions, recurring reviews, evidence, vendor assessments, customer security requests, and audit work.
Your company keeps authority over the program. Management approves policies and risk decisions, and your engineers or providers make technical changes.
$5,000/month · standard initial term of 12 months, subject to the signed agreement
What we run
The statement of work sets which of these activities apply to your company.
- Develop, maintain, and review security policies and procedures.
- Maintain the control set and governance calendar, with monthly reporting to management.
- Run the risk register, document exceptions, and track remediation.
- Coordinate access, vendor, governance, and other recurring reviews, and keep the evidence organized.
- Assess vendors and record review decisions and follow-up.
- Coordinate employee security awareness training using the client's chosen training provider or materials.
- Prepare responses to customer security questionnaires and support agreed customer security calls.
- Manage the compliance program, including preparation for and coordination of audits.
- Coordinate scheduled incident-response tabletop exercises where included.
- Govern the client's own AI systems and implementations, where included in scope.
Where an engagement starts
No program yet
We establish the program: scope, policies, control ownership, a risk register, a review calendar, and evidence practices. If a SOC 2 examination is planned, the work is organized around it; if not, the program is built around your customer and contractual obligations.
A program without an owner
Policies, a compliance platform, or a SOC 2 report exist, but no one is running the work. We review what is current, assign owners, and restart the recurring activities.
An established program
We run the recurring reviews, keep records current between audits and customer reviews, and adjust controls as your systems and obligations change.
How the work runs
Monthly
A written program brief covering completed work, open risks and exceptions, customer requests, capacity used, and decisions needed from management.
Quarterly
Access, vendor, governance, and other reviews included in the agreement, with records of decisions and follow-up.
Annually
Policy and risk reviews, refresh of the control set, and planning for audits or customer assurance cycles where relevant.
Who does what
GetComply
Maintains the GRC plan and calendar, drafts and updates documents, coordinates reviews, examines evidence, tracks remediation, prepares questionnaire responses and audit materials, and reports status.
Your company
Management approves scope, policies, and risk decisions. Your staff supply system information and records, perform control activities, and make technical changes, directly or through authorized providers.
Any SOC 2 or other examination is performed by an independent CPA firm or assessor that you engage.
Allowances and boundaries
-
Vendor reviews
- Standard allowance
- Up to 12 per year
- Period limit
- No more than 4 per quarter
-
Standard questionnaire units
- Standard allowance
- Up to 24 per year
- Period limit
- No more than 4 per month
-
Customer security calls
- Standard allowance
- Up to 6 per year
- Period limit
- No more than 1 per month
-
Minor program improvements
- Standard allowance
- Up to 4 per year
- Period limit
- No more than 1 per quarter
A standard questionnaire unit refers to a typical customer security questionnaire. Larger or highly customized requests may consume more capacity, as defined in the agreement.
Legal advice, penetration testing, specialist engineering, and CPA examinations are not part of the service. Additional systems, frameworks, or audits are included only when the agreement says so; larger engagements use Scale.
Pricing
$5,000/ month
The standard initial term is 12 months. The proposal and signed agreement confirm the scope, allowances, and term for your company.
You can start Managed GRC directly. A Readiness Assessment or Launch Readiness engagement is not required first.
How to begin
-
Step 1: Introductory call
We discuss what prompted the inquiry, your systems, existing security work, and who handles it today.
-
Step 2: Scoping and proposal
We agree on the scope, responsibilities, and allowances, and send a written proposal.
-
Step 3: Onboarding
We collect existing records, confirm owners and decision-makers, and set the review calendar.
-
Step 4: Ongoing operation
Your advisor runs the agreed work and reports to management each month.