Governance Risk And Compliance — hobby stack.
For each requirement below, pick the option that fits your build — recommended first, then free and cheaper alternatives — or skip what your project doesn't need. Tap the info icon next to any requirement to see why it matters.
GRC Platform / Compliance Automation Hub
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsVanta Starter $1,000/mo ($12k/yr) for ≤25 employees + 5 frameworks, SOC 2/ISO 27001/GDPR/HIPAA included. Growth $2,000/mo for ≤100 employees. Drata Starter $833/mo ($10k/yr) 50 controls. OpenComply OSS free self-hosted. Free tier: demo only, no prod free. Overage: $100/mo per extra 10 employees, $150/mo per extra framework.
Policy Management & Documentation
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsConfluence Free ≤10 users, Standard $6.05/user/mo (2026) ($5.16/mo annual), Premium $11.55/user/mo. Notion Free 2 guests + 10 pages, Plus $10/user/mo ($8 annual). Drata Policy Builder free 10 policies. GitHub public/private repos free unlimited. Overage: Confluence storage $2.50/GB over 250GB.
Risk Register & Risk Assessment
Interactive assessments, quizzes, or forms that capture structured input from users.Pricing & free-tier limitsSimpleRisk Community free OSS self-hosted unlimited risks, support $2,500/yr. Jira Cloud Free ≤10 users, Standard $8.15/user/mo. LogicGate $30k/yr ($2,500/mo) base 10 users + 5 workflows, $200/user/mo over. ServiceNow GRC $50k/yr ($4,167/mo) starter, $150k/yr enterprise. Free tier: SimpleRisk fully free.
Control Framework Mapping (SOC2/ISO27001/NIST/PCI-DSS)
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsComplianceAsCode & OpenControl OSS free unlimited mappings. Tugboat Logic Essentials $15k/yr ($1,250/mo) 1 framework. Vanta $12k/yr ($1,000/mo) includes 3 frameworks auto-mapped, $200/mo per extra framework. AuditBoard CrossComply $20k/yr ($1,667/mo) includes 10 frameworks crosswalk. NIST OLIR mappings free. Free tier: OSS fully free.
Audit Management & Evidence Collection
Controls who can do what inside your admin tooling. Limits blast radius if an account is compromised.Pricing & free-tier limitsDrata $833/mo ($10k/yr) starter 50 automated tests/controls. Vanta $1,000/mo ($12k/yr) 200 automated tests + 300 integrations. AuditBoard $1,667/mo ($20k/yr) starter 10 audits, $2,917/mo pro unlimited. Free trial Vanta/Drata 14 days no free prod. Overage: $2/test/mo over quota, evidence storage S3 ~$0.023/GB/mo.
Third-Party Risk Management (TPRM) / Vendor Monitoring
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsUpGuard Free: 50 companies monitored, 5 risk assessments/mo, 20 Trust Exchange shares. Starter $500/mo ($6k/yr) 100 companies + 25 assessments. SecurityScorecard Professional $2,500/mo ($30k/yr) 150 vendors, Portfolio $7k/mo. BitSight Starter $2,083/mo ($25k/yr) 200 vendors, Enterprise $5k/mo. Overage: UpGuard $5/company/mo, SecurityScorecard $15/vendor/mo.
Secrets Management for Compliance (Audit of secrets)
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsVault OSS & OpenBao free self-hosted unlimited secrets. Infisical Free 3 projects + 10 users + 50 secrets, Starter $15/mo flat + $3/member/mo, Growth $50/mo base. HCP Vault Standard $0.03/secret version/mo + $0.121/hr cluster ~ $90/mo. Vault Enterprise $1,500/mo ($18k/yr) starter 25k secrets. Free tier: Vault OSS fully free, disk cost $20/TB/mo.
Security Awareness Training Platform
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsKnowBe4 Free Phish Alert Button + free phish test 1x 100 users. Small Business $20/user/yr min 25 seats ($500/yr), Enterprise $35/user/yr min 100 seats. Hoxhunt Express $15/user/yr min 50 seats ($750/yr), Enterprise $30/user/yr. Free tier: templated slides free. Overage: $2/user/mo for extra training.
Vulnerability & Risk Prioritization (for GRC context)
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsGreenbone Community OSS free self-hosted 50k+ CVEs, unlimited scans disk ~$50/mo. Nessus Pro $4,390/yr ($366/mo) 1 scanner 32 IPs concurrent, $6,990/yr unlimited scanners. Tenable.io Enterprise $2,500/mo ($30k/yr) 1000 assets, $4k/mo 5000 assets. Rapid7 InsightVM $2,000/mo 500 assets. Overage: $0.50/asset/mo over quota.
Data Privacy & Subject Rights (DSAR) Management
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsOsano Free 1 domain ≤5k visitors/mo DSAR inbox. Starter $199/mo includes 25k visitors + 100 DSAR/yr, Growth $499/mo 100k visitors. Transcend Free 50 DSAR/mo, Plus $1,000/mo 200 DSAR. OneTrust Privacy $2,500/mo ($30k/yr) base 1 domain + 100 DSAR/yr, Enterprise $4,167/mo 500 DSAR/yr. Overage: $10/DSAR over, $0.50/1k visitors over.
Asset Inventory & Classification (GRC)
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsSnipe-IT & Open-AudIT OSS free self-hosted unlimited assets disk ~$20/mo. Lansweeper Free 100 assets, Starter $995/yr ($83/mo) 2000 assets, Pro $3,995/yr. JupiterOne Free 100 assets + 10 queries/day, Pro $1,200/mo ($14.4k/yr) 5000 assets unlimited queries. ServiceNow CMDB included in GRC $50k/yr. Overage: J1 $0.15/asset/mo, Lansweeper $0.40/asset/mo.
How this hobby governance risk and compliance checklist works.
Each requirement below is something a hobby governance risk and compliance build typically needs. Pick one of the four researched options — recommended, free, cheaper or paid — add your own with "Other", or skip the requirement if your project doesn't need it. Nothing is mandatory; the plan on the right tracks what you've decided so nothing gets forgotten.
Your picks are saved in this browser automatically, so you can come back anytime. Options are researched per build level and refreshed as vendors change their plans — always verify details on the provider's page before committing.