Governance Risk And Compliance — small scale stack.
For each requirement below, pick the option that fits your build — recommended first, then free and cheaper alternatives — or skip what your project doesn't need. Tap the info icon next to any requirement to see why it matters.
GRC Platform / Compliance Automation Hub
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsVanta Starter $1,000/mo ($12k/yr) for ≤25 employees + 5 frameworks, SOC 2/ISO 27001/GDPR/HIPAA included. Growth $2,000/mo for ≤100 employees. Drata Starter $833/mo ($10k/yr) 50 controls. OpenComply OSS free self-hosted. Free tier: demo only, no prod free. Overage: $100/mo per extra 10 employees, $150/mo per extra framework.
Policy Management & Documentation
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsConfluence Free ≤10 users, Standard $6.05/user/mo (2026) ($5.16/mo annual), Premium $11.55/user/mo. Notion Free 2 guests + 10 pages, Plus $10/user/mo ($8 annual). Drata Policy Builder free 10 policies. GitHub public/private repos free unlimited. Overage: Confluence storage $2.50/GB over 250GB.
Risk Register & Risk Assessment
Interactive assessments, quizzes, or forms that capture structured input from users.Pricing & free-tier limitsSimpleRisk Community free OSS self-hosted unlimited risks, support $2,500/yr. Jira Cloud Free ≤10 users, Standard $8.15/user/mo. LogicGate $30k/yr ($2,500/mo) base 10 users + 5 workflows, $200/user/mo over. ServiceNow GRC $50k/yr ($4,167/mo) starter, $150k/yr enterprise. Free tier: SimpleRisk fully free.
Control Framework Mapping (SOC2/ISO27001/NIST/PCI-DSS)
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsComplianceAsCode & OpenControl OSS free unlimited mappings. Tugboat Logic Essentials $15k/yr ($1,250/mo) 1 framework. Vanta $12k/yr ($1,000/mo) includes 3 frameworks auto-mapped, $200/mo per extra framework. AuditBoard CrossComply $20k/yr ($1,667/mo) includes 10 frameworks crosswalk. NIST OLIR mappings free. Free tier: OSS fully free.
Audit Management & Evidence Collection
Controls who can do what inside your admin tooling. Limits blast radius if an account is compromised.Pricing & free-tier limitsDrata $833/mo ($10k/yr) starter 50 automated tests/controls. Vanta $1,000/mo ($12k/yr) 200 automated tests + 300 integrations. AuditBoard $1,667/mo ($20k/yr) starter 10 audits, $2,917/mo pro unlimited. Free trial Vanta/Drata 14 days no free prod. Overage: $2/test/mo over quota, evidence storage S3 ~$0.023/GB/mo.
Third-Party Risk Management (TPRM) / Vendor Monitoring
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsUpGuard Free: 50 companies monitored, 5 risk assessments/mo, 20 Trust Exchange shares. Starter $500/mo ($6k/yr) 100 companies + 25 assessments. SecurityScorecard Professional $2,500/mo ($30k/yr) 150 vendors, Portfolio $7k/mo. BitSight Starter $2,083/mo ($25k/yr) 200 vendors, Enterprise $5k/mo. Overage: UpGuard $5/company/mo, SecurityScorecard $15/vendor/mo.
Secrets Management for Compliance (Audit of secrets)
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsVault OSS & OpenBao free self-hosted unlimited secrets. Infisical Free 3 projects + 10 users + 50 secrets, Starter $15/mo flat + $3/member/mo, Growth $50/mo base. HCP Vault Standard $0.03/secret version/mo + $0.121/hr cluster ~ $90/mo. Vault Enterprise $1,500/mo ($18k/yr) starter 25k secrets. Free tier: Vault OSS fully free, disk cost $20/TB/mo.
Security Awareness Training Platform
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsKnowBe4 Free Phish Alert Button + free phish test 1x 100 users. Small Business $20/user/yr min 25 seats ($500/yr), Enterprise $35/user/yr min 100 seats. Hoxhunt Express $15/user/yr min 50 seats ($750/yr), Enterprise $30/user/yr. Free tier: templated slides free. Overage: $2/user/mo for extra training.
Vulnerability & Risk Prioritization (for GRC context)
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsGreenbone Community OSS free self-hosted 50k+ CVEs, unlimited scans disk ~$50/mo. Nessus Pro $4,390/yr ($366/mo) 1 scanner 32 IPs concurrent, $6,990/yr unlimited scanners. Tenable.io Enterprise $2,500/mo ($30k/yr) 1000 assets, $4k/mo 5000 assets. Rapid7 InsightVM $2,000/mo 500 assets. Overage: $0.50/asset/mo over quota.
Data Privacy & Subject Rights (DSAR) Management
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsOsano Free 1 domain ≤5k visitors/mo DSAR inbox. Starter $199/mo includes 25k visitors + 100 DSAR/yr, Growth $499/mo 100k visitors. Transcend Free 50 DSAR/mo, Plus $1,000/mo 200 DSAR. OneTrust Privacy $2,500/mo ($30k/yr) base 1 domain + 100 DSAR/yr, Enterprise $4,167/mo 500 DSAR/yr. Overage: $10/DSAR over, $0.50/1k visitors over.
Asset Inventory & Classification (GRC)
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsSnipe-IT & Open-AudIT OSS free self-hosted unlimited assets disk ~$20/mo. Lansweeper Free 100 assets, Starter $995/yr ($83/mo) 2000 assets, Pro $3,995/yr. JupiterOne Free 100 assets + 10 queries/day, Pro $1,200/mo ($14.4k/yr) 5000 assets unlimited queries. ServiceNow CMDB included in GRC $50k/yr. Overage: J1 $0.15/asset/mo, Lansweeper $0.40/asset/mo.
Business Continuity / Disaster Recovery (BCP/DR) Planning
Copies of your data so a bug, hack, or outage doesn’t become permanent loss. Cheap insurance every serious project needs.Pricing & free-tier limitsOpenBCP & CISA Tool free templates. Cutover Free trial 14 days, Starter $2,000/mo ($24k/yr) 10 runbooks, Pro $4k/mo. Fusion $36k/yr ($3k/mo) 10 continuity plans + 25 users, Enterprise $72k/yr 50 plans. ServiceNow BCM add-on $12k/yr ($1k/mo). Free tier: manual docs free. Overage: $250/plan/mo.
Vendor Security Questionnaire Automation
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsCAIQ Lite free PDF download. Conveyor Free 25 auto-answered questionnaires/yr, Lite $250/mo ($3k/yr) 100 QAs, Pro $833/mo ($10k/yr) unlimited + AI. Responsive $1,250/mo ($15k/yr) 5 users. Vanta Vendor Risk Q automation $500/mo add-on $6k/yr. Overage: $25/questionnaire over, $2/query AI auto-fill over.
Compliance Ticketing / Issue Remediation Tracking
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsJira Cloud Free ≤10 users unlimited projects, Standard $8.15/user/mo annual, Premium $16/user/mo, Enterprise $25/user/mo. Linear Free 250 issues. ServiceNow GRC Issues included in GRC $50k/yr module. JSM Premium $48/agent/mo. Free tier Jira Free fully usable. Overage: Automation $0.50/1k rule runs over 500/mo free.
Identity Governance & Access Reviews
How users sign up, log in, and are authorized. Getting roles and access control right early prevents painful rewrites.Pricing & free-tier limitsOpenIAM & MidPoint OSS free self-hosted unlimited IDs. ConductorOne Free ≤50 identities + 5 apps, Growth $500/mo ($6k/yr) ≤500 IDs 50 apps, Enterprise $2,500/mo ($30k/yr) 5000 IDs. Okta Identity Governance $5/user/mo ($60/user/yr) add-on min 100 users, $7/user/mo enterprise. SailPoint $120k/yr ($10k/mo) starter 500 IDs, Enterprise $250k/yr. Overage: $0.30/identity/mo.
Log Retention & Audit Trail Storage (Compliance Logs)
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsWazuh + MinIO OSS free unlimited retention self-hosted disk $20/TB/mo electric only. S3 Standard $0.023/GB/mo, IA $0.0125/GB/mo, Glacier Instant $0.004/GB/mo, Glacier Deep $0.00099/GB/mo. CloudTrail first trail free, mgmt logs free, data events $0.10/100k events. Splunk compliance log $5k/mo base 30GB/day ret 1 yr, $10k/mo 100GB/day 7yr. Datadog Compliance $1.70/GB ingested + $0.10/GB/mo retained 1yr. Overage S3 pay as you go.
Questionnaire / RFP Security Response Library
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsNotion template free. Loopio Free 5 response library entries + 2 users, Starter $500/mo ($6k/yr) 10 users 100 entries, Growth $1k/mo 500 entries. Responsive $1,250/mo ($15k/yr) 5 users 1k entries, Enterprise $2,917/mo unlimited. Vanta Trust Center $500/mo standard unlimited views, $1k/mo advanced. SafeBase Free 50 views/mo, $750/mo Growth. Overage: $1.50/entry/mo.
Pen Test & Audit Finding Tracker
Controls who can do what inside your admin tooling. Limits blast radius if an account is compromised.Pricing & free-tier limitsDefectDojo OSS free self-hosted unlimited findings + integrations (Nessus/Burp). DefectDojo Pro $12k/yr ($1k/mo) SSO+RBAC+support. PlexTrac Entry $18k/yr ($1.5k/mo) 50 reports, Pro $30k/yr ($2.5k/mo) unlimited. Drata findings tracker included $833/mo. HackerOne Pentest platform fee $30k/yr ($2.5k/mo) + $15k per pentest. Free tier: DefectDojo OSS fully free.
Data Mapping & Retention Policy Enforcement
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsDataHub & ODD OSS free self-hosted unlimited sources connectors ~$100/mo compute. Osano Discovery Free trial 30 days, Starter $299/mo 50k records 10 sources, Growth $599/mo 250k records 50 sources. OneTrust Mapping $2,500/mo ($30k/yr) base 25 sources + 1M records, Enterprise $4,167/mo 100 sources. Collibra $100k/yr ($8,333/mo) enterprise. Overage: OneTrust $100/source/mo, $0.10/1k records over.
How this small scale governance risk and compliance checklist works.
Each requirement below is something a small scale governance risk and compliance build typically needs. Pick one of the four researched options — recommended, free, cheaper or paid — add your own with "Other", or skip the requirement if your project doesn't need it. Nothing is mandatory; the plan on the right tracks what you've decided so nothing gets forgotten.
Your picks are saved in this browser automatically, so you can come back anytime. Options are researched per build level and refreshed as vendors change their plans — always verify details on the provider's page before committing.