Governance Risk And Compliance — professional stack.
For each requirement below, pick the option that fits your build — recommended first, then free and cheaper alternatives — or skip what your project doesn't need. Tap the info icon next to any requirement to see why it matters.
GRC Platform / Compliance Automation Hub
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsVanta Starter $1,000/mo ($12k/yr) for ≤25 employees + 5 frameworks, SOC 2/ISO 27001/GDPR/HIPAA included. Growth $2,000/mo for ≤100 employees. Drata Starter $833/mo ($10k/yr) 50 controls. OpenComply OSS free self-hosted. Free tier: demo only, no prod free. Overage: $100/mo per extra 10 employees, $150/mo per extra framework.
Policy Management & Documentation
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsConfluence Free ≤10 users, Standard $6.05/user/mo (2026) ($5.16/mo annual), Premium $11.55/user/mo. Notion Free 2 guests + 10 pages, Plus $10/user/mo ($8 annual). Drata Policy Builder free 10 policies. GitHub public/private repos free unlimited. Overage: Confluence storage $2.50/GB over 250GB.
Risk Register & Risk Assessment
Interactive assessments, quizzes, or forms that capture structured input from users.Pricing & free-tier limitsSimpleRisk Community free OSS self-hosted unlimited risks, support $2,500/yr. Jira Cloud Free ≤10 users, Standard $8.15/user/mo. LogicGate $30k/yr ($2,500/mo) base 10 users + 5 workflows, $200/user/mo over. ServiceNow GRC $50k/yr ($4,167/mo) starter, $150k/yr enterprise. Free tier: SimpleRisk fully free.
Control Framework Mapping (SOC2/ISO27001/NIST/PCI-DSS)
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsComplianceAsCode & OpenControl OSS free unlimited mappings. Tugboat Logic Essentials $15k/yr ($1,250/mo) 1 framework. Vanta $12k/yr ($1,000/mo) includes 3 frameworks auto-mapped, $200/mo per extra framework. AuditBoard CrossComply $20k/yr ($1,667/mo) includes 10 frameworks crosswalk. NIST OLIR mappings free. Free tier: OSS fully free.
Audit Management & Evidence Collection
Controls who can do what inside your admin tooling. Limits blast radius if an account is compromised.Pricing & free-tier limitsDrata $833/mo ($10k/yr) starter 50 automated tests/controls. Vanta $1,000/mo ($12k/yr) 200 automated tests + 300 integrations. AuditBoard $1,667/mo ($20k/yr) starter 10 audits, $2,917/mo pro unlimited. Free trial Vanta/Drata 14 days no free prod. Overage: $2/test/mo over quota, evidence storage S3 ~$0.023/GB/mo.
Third-Party Risk Management (TPRM) / Vendor Monitoring
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsUpGuard Free: 50 companies monitored, 5 risk assessments/mo, 20 Trust Exchange shares. Starter $500/mo ($6k/yr) 100 companies + 25 assessments. SecurityScorecard Professional $2,500/mo ($30k/yr) 150 vendors, Portfolio $7k/mo. BitSight Starter $2,083/mo ($25k/yr) 200 vendors, Enterprise $5k/mo. Overage: UpGuard $5/company/mo, SecurityScorecard $15/vendor/mo.
Secrets Management for Compliance (Audit of secrets)
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsVault OSS & OpenBao free self-hosted unlimited secrets. Infisical Free 3 projects + 10 users + 50 secrets, Starter $15/mo flat + $3/member/mo, Growth $50/mo base. HCP Vault Standard $0.03/secret version/mo + $0.121/hr cluster ~ $90/mo. Vault Enterprise $1,500/mo ($18k/yr) starter 25k secrets. Free tier: Vault OSS fully free, disk cost $20/TB/mo.
Security Awareness Training Platform
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsKnowBe4 Free Phish Alert Button + free phish test 1x 100 users. Small Business $20/user/yr min 25 seats ($500/yr), Enterprise $35/user/yr min 100 seats. Hoxhunt Express $15/user/yr min 50 seats ($750/yr), Enterprise $30/user/yr. Free tier: templated slides free. Overage: $2/user/mo for extra training.
Vulnerability & Risk Prioritization (for GRC context)
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsGreenbone Community OSS free self-hosted 50k+ CVEs, unlimited scans disk ~$50/mo. Nessus Pro $4,390/yr ($366/mo) 1 scanner 32 IPs concurrent, $6,990/yr unlimited scanners. Tenable.io Enterprise $2,500/mo ($30k/yr) 1000 assets, $4k/mo 5000 assets. Rapid7 InsightVM $2,000/mo 500 assets. Overage: $0.50/asset/mo over quota.
Data Privacy & Subject Rights (DSAR) Management
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsOsano Free 1 domain ≤5k visitors/mo DSAR inbox. Starter $199/mo includes 25k visitors + 100 DSAR/yr, Growth $499/mo 100k visitors. Transcend Free 50 DSAR/mo, Plus $1,000/mo 200 DSAR. OneTrust Privacy $2,500/mo ($30k/yr) base 1 domain + 100 DSAR/yr, Enterprise $4,167/mo 500 DSAR/yr. Overage: $10/DSAR over, $0.50/1k visitors over.
Asset Inventory & Classification (GRC)
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsSnipe-IT & Open-AudIT OSS free self-hosted unlimited assets disk ~$20/mo. Lansweeper Free 100 assets, Starter $995/yr ($83/mo) 2000 assets, Pro $3,995/yr. JupiterOne Free 100 assets + 10 queries/day, Pro $1,200/mo ($14.4k/yr) 5000 assets unlimited queries. ServiceNow CMDB included in GRC $50k/yr. Overage: J1 $0.15/asset/mo, Lansweeper $0.40/asset/mo.
Business Continuity / Disaster Recovery (BCP/DR) Planning
Copies of your data so a bug, hack, or outage doesn’t become permanent loss. Cheap insurance every serious project needs.Pricing & free-tier limitsOpenBCP & CISA Tool free templates. Cutover Free trial 14 days, Starter $2,000/mo ($24k/yr) 10 runbooks, Pro $4k/mo. Fusion $36k/yr ($3k/mo) 10 continuity plans + 25 users, Enterprise $72k/yr 50 plans. ServiceNow BCM add-on $12k/yr ($1k/mo). Free tier: manual docs free. Overage: $250/plan/mo.
Vendor Security Questionnaire Automation
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsCAIQ Lite free PDF download. Conveyor Free 25 auto-answered questionnaires/yr, Lite $250/mo ($3k/yr) 100 QAs, Pro $833/mo ($10k/yr) unlimited + AI. Responsive $1,250/mo ($15k/yr) 5 users. Vanta Vendor Risk Q automation $500/mo add-on $6k/yr. Overage: $25/questionnaire over, $2/query AI auto-fill over.
Compliance Ticketing / Issue Remediation Tracking
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsJira Cloud Free ≤10 users unlimited projects, Standard $8.15/user/mo annual, Premium $16/user/mo, Enterprise $25/user/mo. Linear Free 250 issues. ServiceNow GRC Issues included in GRC $50k/yr module. JSM Premium $48/agent/mo. Free tier Jira Free fully usable. Overage: Automation $0.50/1k rule runs over 500/mo free.
Identity Governance & Access Reviews
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsOpenIAM & MidPoint OSS free self-hosted unlimited IDs. ConductorOne Free ≤50 identities + 5 apps, Growth $500/mo ($6k/yr) ≤500 IDs 50 apps, Enterprise $2,500/mo ($30k/yr) 5000 IDs. Okta Identity Governance $5/user/mo ($60/user/yr) add-on min 100 users, $7/user/mo enterprise. SailPoint $120k/yr ($10k/mo) starter 500 IDs, Enterprise $250k/yr. Overage: $0.30/identity/mo.
Log Retention & Audit Trail Storage (Compliance Logs)
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsWazuh + MinIO OSS free unlimited retention self-hosted disk $20/TB/mo electric only. S3 Standard $0.023/GB/mo, IA $0.0125/GB/mo, Glacier Instant $0.004/GB/mo, Glacier Deep $0.00099/GB/mo. CloudTrail first trail free, mgmt logs free, data events $0.10/100k events. Splunk compliance log $5k/mo base 30GB/day ret 1 yr, $10k/mo 100GB/day 7yr. Datadog Compliance $1.70/GB ingested + $0.10/GB/mo retained 1yr. Overage S3 pay as you go.
Questionnaire / RFP Security Response Library
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsNotion template free. Loopio Free 5 response library entries + 2 users, Starter $500/mo ($6k/yr) 10 users 100 entries, Growth $1k/mo 500 entries. Responsive $1,250/mo ($15k/yr) 5 users 1k entries, Enterprise $2,917/mo unlimited. Vanta Trust Center $500/mo standard unlimited views, $1k/mo advanced. SafeBase Free 50 views/mo, $750/mo Growth. Overage: $1.50/entry/mo.
Pen Test & Audit Finding Tracker
Controls who can do what inside your admin tooling. Limits blast radius if an account is compromised.Pricing & free-tier limitsDefectDojo OSS free self-hosted unlimited findings + integrations (Nessus/Burp). DefectDojo Pro $12k/yr ($1k/mo) SSO+RBAC+support. PlexTrac Entry $18k/yr ($1.5k/mo) 50 reports, Pro $30k/yr ($2.5k/mo) unlimited. Drata findings tracker included $833/mo. HackerOne Pentest platform fee $30k/yr ($2.5k/mo) + $15k per pentest. Free tier: DefectDojo OSS fully free.
Data Mapping & Retention Policy Enforcement
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsDataHub & ODD OSS free self-hosted unlimited sources connectors ~$100/mo compute. Osano Discovery Free trial 30 days, Starter $299/mo 50k records 10 sources, Growth $599/mo 250k records 50 sources. OneTrust Mapping $2,500/mo ($30k/yr) base 25 sources + 1M records, Enterprise $4,167/mo 100 sources. Collibra $100k/yr ($8,333/mo) enterprise. Overage: OneTrust $100/source/mo, $0.10/1k records over.
GRC Workflow Automation (No-Code Policy Workflows)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsn8n OSS free self-hosted unlimited workflows. n8n Cloud Free 5k execs/mo, Starter $24/mo 2.5k execs, Pro $60/mo 10k execs, Enterprise $240/mo 50k. Temporal Cloud Free 5k actions/mo. LogicGate $30k/yr ($2.5k/mo) base 10k wf runs/mo + 10 users, Enterprise $90k/yr $7.5k/mo 100k runs. ServiceNow Workflow $50k/yr ($4,167/mo). Overage: $0.50/100 runs over.
Framework Crosswalk & Gap Analysis
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsNIST OLIR crosswalks SOC2↔ISO27001↔NIST800-53 free PDFs. Tugboat Logic crosswalk included in $15k/yr plan 5 frameworks mapped. Vanta Crosswalk add-on $200/mo ($2.4k/yr) unlimited maps. AuditBoard CrossComply $1,667/mo ($20k/yr) 10 frameworks, $3k/mo enterprise 25 frameworks gap analytics. Free tier: manual spreadsheet free. Overage: $100/framework/mo.
Continuous Control Monitoring
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsScoutSuite & Prowler OSS free unlimited accounts, 350+ CIS checks. Drata $10k/yr ($833/mo) 50 controls continuous, Growth $20k/yr 150 controls. Vanta $12k/yr ($1k/mo) 200 controls + 300 integrations continuous. Wiz Compliance $35k/yr ($2,917/mo) 1000 workloads. Lacework compliance now Fortinet $30k/yr. Overage: $2/control/mo, $0.20/integration/mo.
Third-Party Attestation Collection (SOC2/ISO from vendors)
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsVendorCage Free 5 vendors + evidence collection, Starter $350/mo ($4.2k/yr) 50 vendors. UpGuard Trust Exchange Free 20 attestation shares, Premium $500/mo ($6k/yr) unlimited shares + 100 vendors. Vanta Vendor Risk $600/mo ($7.2k/yr) 100 vendors auto-collect 30 attestations. OneTrust Third-Party $2,500/mo ($30k/yr) 150 vendors. Overage: $5/vendor/mo attest, $25/manual collection.
Privacy Impact Assessment (PIA/DPIA) Automation
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsICO DPIA + CNIL open-source tool free unlimited DPIAs manual. Osano DPIA Lite free ≤3 PIAs/mo, Growth $199/mo unlimited + templated. Transcend Assessment Lite $500/mo 50 assessments. OneTrust PIA/DPIA $2,500/mo ($30k/yr) base 50 PIAs/yr incl risk scoring, Enterprise $4,167/mo 200 PIAs/yr. Securiti PIA $30k/yr. Overage: OneTrust $25/PIA over, $10/assessment copy.
Regulatory Change Tracking
Rates, labels, and tracking for physical goods. Needed once you actually ship products.Pricing & free-tier limitsPublic NIST/CISA/SEC/PCI SSC feeds free unlimited RSS. 6clicks Starter $1,000/mo ($12k/yr) 500 regulations tracked + alerts, Enterprise $2,500/mo ($30k/yr) 2000 regs AI summarization. Ascent $50k/yr ($4,167/mo) 1000 financial regs, Enterprise $120k/yr. OneTrust Regulatory $30k/yr ($2.5k/mo). Free tier: manual RSS free. Overage: $2/regulation/mo tracked.
Incident Response & Breach Notification Management
Reaches users on their phone via SMS or push. Useful for verification codes and re-engagement; watch the per-message cost.Pricing & free-tier limitsTheHive OSS + Cortex free self-hosted unlimited cases + analyzers disk $40/mo. PagerDuty Team $32/user/mo (2026 $32) 2025 was $29, Business $51/user/mo, Enterprise $69/user/mo. Incident.io Starter $30/user/mo. ServiceNow SIR $30k/yr ($2.5k/mo) 10 responders, Enterprise $72k/yr. OneTrust Incident Response $2,500/mo ($30k/yr) 100 incidents/yr. Free tier TheHive fully free. Overage: PagerDuty $5/incident over 1000/mo.
Customer Trust Portal / Compliance Docs Sharing
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsConveyor Free 1 trust center 20 views/mo + 5 docs + NDA e-sign. Starter $500/mo ($6k/yr) unlimited views + 50 docs, Pro $1,200/mo ($14.4k/yr) advanced analytics + Salesforce. Vanta Trust Center $500/mo standard custom domain, $1,000/mo advanced 2026. SafeBase Free 50 views/mo, Growth $750/mo ($9k/yr) 200 views, Enterprise $2,500/mo ($30k/yr) unlimited + integrations. Overage: $5/view, $10/NDA over.
Internal Audit Collaboration
Controls who can do what inside your admin tooling. Limits blast radius if an account is compromised.Pricing & free-tier limitsConfluence Free ≤10 users, Standard $6.05/user/mo. OpenAudit OSS free. AuditBoard Starter $20k/yr ($1,667/mo) 10 users 5 audits, Pro $35k/yr ($2,917/mo) 25 users unlimited audits, Enterprise $60k/yr ($5k/mo). Diligent HighBond $40k/yr ($3,333/mo) starter, $100k/yr enterprise. Teams/SharePoint free 5GB. Free tier Confluence free viable. Overage: $150/user/mo audit.
eDiscovery & Legal Hold for Compliance
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsOpenEDiscovery OSS free self-hosted. Purview eDiscovery included in M365 E3 $23/user/mo (2026 $24.50) 100GB mailbox, Premium add-on $5/user/mo $60/yr advanced hold. Logikcull Starter $250/mo ($3k/yr) per project 10GB included, Growth $750/mo 50GB, Enterprise $1,500/mo 200GB, $25/GB over. Exterro Starter $60k/yr ($5k/mo) 100GB, Enterprise $150k/yr. Onna $30k/yr. Free tier Purview basic case free holding 500 mailboxes.
Risk Quantification (FAIR Model)
Powers AI features — model access, embeddings, and inference. Costs scale with usage, so watch the meter.Pricing & free-tier limitsFAIR-U Tool free 1 scenario at a time, OpenFAIR spreadsheet free. RiskLens Community Free 5 quantifications/mo. Starter $15k/yr ($1,250/mo) 50 quant/year + 3 users, Pro $30k/yr ($2,500/mo) 200 quant, Enterprise $60k/yr ($5k/mo) unlimited + API. Safe Security Starter $2k/mo ($24k/yr) 100 assets quantified. Archer Risk Quant $80k/yr ($6,667/mo). Free tier spreadsheet fully free. Overage: $100/quant over, $0.50/asset/mo.
How this professional governance risk and compliance checklist works.
Each requirement below is something a professional governance risk and compliance build typically needs. Pick one of the four researched options — recommended, free, cheaper or paid — add your own with "Other", or skip the requirement if your project doesn't need it. Nothing is mandatory; the plan on the right tracks what you've decided so nothing gets forgotten.
Your picks are saved in this browser automatically, so you can come back anytime. Options are researched per build level and refreshed as vendors change their plans — always verify details on the provider's page before committing.