I'll be honest, it's getting ridiculous for me now many different compliance requirements are now affecting the company I work for. Don't get me wrong I'm all for good security controls and compliance but the issue I'm finding is that almost every different customer has their own cyber security control set we have to show compliance with. Now with the added CMMC requirements coming my way its becoming unmanageable the spreadsheet and word document way, but as a small business I don't have a huge budget at my disposal for spending on software tools to help with time-saving efficiencies.
Are any of you able to recommend a reasonable product that could be used for NIST 800-171 and CMMC pre-assessment preparation - risk assessments, controls gap analysis, preparing SSP's, POAMs, self assessment and recording evidence, scoring based on risk weightings etc.? So far all the products I've researched are after an exorbitant amount of money. CMMC as a buzzword seems to have joined a list of other terms like 'Risk' where vendors immediately add zeros to the end of the price, pricing based on the risk reduction rather than the value added and time saved compared to using conventional desktop office applications.
I'm looking forward to and interested to hear your thoughts on what solutions you use and what works well for you with regard to managing your cyber GRC.
I recently watched a webinar from KnowBe4 on their GRC platform and was impressed with how customizable I could get with it. As we mature in GRC, Word and Excel docs just don't cut it anymore. Their Phishing Platform is reasonably priced, so I'd imagine this one is as well.
Thank you for the tip, I hadn't seen this product before.
Unfortunately having checked their pricing this is prohibitively expensive similar to some of the other solutions I've found - it works out approx. $10,000 per year even though I only need one user/seat (for me).