Overview:
Our company got ISO 27001 certified in 2019 and our ISMS was managed through Google docs, spreadsheets, and some of it in Atlassian products. This worked fine but was not much scalable nor did we have a single source of truth to refer to. In addition, we started to prepare for a SOC 2 certification in 2021 and now wanted to map our controls against multiple compliance frameworks. We reviewed several tools mentioned in the 2020 Gartner report for GRC products and narrowed down to ZenGRC for several reasons: It's nimble and faster to adopt than products, and yet strikes a good balance between simplicity and feature coverage. As a SaaS platform, we see ZenGRC growing with us as we progress our compliance programs.
Onboarding experience:
This process was a very pleasant experience with a set of scheduled video calls and hands-on training on the product. There was plenty of time for open questions and in some sessions, a Reciprocity GRC expert joined to answer specific questions on frameworks and how to apply them in the tool. This added a lot of value.
In addition to the onboarding sessions, we got access to the Zen University, an e-learning platform with video courses covering all areas of the product. The course modules are easy to follow tutorials that encourage to use the product while watching to get the most out of it. These courses were a great way to prepare each onboarding video call and note questions.
We also have access to ZenGRC's online documentation which covered all our needs so far. There are tutorials on features and also tips and tricks on how to utilise the product most effectively.
Access to GRC experts:
As mentioned above in the onboarding experience, having access to GRC experts when we are stuck with a certain question adds a lot of value to the services provided. We not only have access to a platform to manage our compliance programs but can also resolve roadblocks through expert advice as.
Data import:
As with all GRC products, data import is an important aspect and the CSV import functionality ZenGRC offers works really well. I was able to pick it up within a very short time and important most of our data already during our onboarding phase. The importer supports copy & paste from a spreadsheet, import of a spreadsheet directly and has useful validation to avoid importing incorrect data.
Ideas portal:
After onboarding, we have been pointed to an ideas portal where Reciprocity customers can vote on existing product ideas submitted by other customers or submit their own. It's really useful to see what features other customers requested and upvote what's of most value for our organization. Reseña recopilada por y alojada en G2.com.
If you come from a very mature Google world, then ZenGRC's interfaces look a little basic in some areas. However, this doesn't really affect functionality or effectivity of the product.
The dashboard functionality served us well for now but could add a little more customizability. That being said, there have been improvements since we have adopted ZenGRC and there are more improvements on the roadmap. Also, we use Tableau and the native integration would solve all our needs for reporting should we ever need more.
The list view navigation and search sometimes require more clicks than necessary depending on what you are looking for. This has been raised in the ideas portal already and improvements are in the works. Reseña recopilada por y alojada en G2.com.
Zen is very user friendly when conducting ISO 27001 audits for internal reviews. Reseña recopilada por y alojada en G2.com.
There is not already an established integration with Service Now. Reseña recopilada por y alojada en G2.com.
Siendo nuevo en el uso de una herramienta GRC, lo que más me atrajo de ZenGRC fue la funcionalidad y la manejabilidad en comparación con los otros actores en ese espacio. "Botón fácil" Reseña recopilada por y alojada en G2.com.
No hay desventajas en ZenGRC desde mi perspectiva, sin embargo, tuvimos dificultades para saber por dónde empezar en el uso de la herramienta. Simplemente aprovechamos a un experto externo para ayudar. Reseña recopilada por y alojada en G2.com.
Me gusta lo siguiente:
1. Carga masiva de auditorías
2. Cambio de propiedad para las tareas en masa
3. Capacidad de filtrar de muchas maneras para rastrear la auditoría exacta
4. Seguimiento de auditoría de principio a fin Reseña recopilada por y alojada en G2.com.
No diría que me gusta lo siguiente:
1. No hay opción que muestre la fecha de vencimiento para las tareas.
2. Además, cada vez que cambio el propietario/asignado para la tarea principal, no se refleja lo mismo para las subtareas, y necesito actualizar manualmente cada vez.
3. Todas las tareas futuras se muestran bajo la lista de acciones por hacer.
4. Las tareas principales no deberían mostrarse bajo la lista de acciones por hacer ya que son la tarea principal para la creación automática de subtareas.
5. La vista del tablero no es buena.
6. Los sistemas del sistema se están borrando cada vez que inicio sesión de nuevo.
7. Incluso si comparto el acceso de lectura, el usuario puede editar las tareas.
8. El asignado puede cambiar con el tiempo, y aunque la solicitud principal se actualice, no se refleja en las solicitudes recurrentes que se derivan de ella.
9. A veces, la recurrencia se omite. En otras palabras, a veces se omite un mes.
10. No podemos duplicar una solicitud automáticamente sin recurrencia y un proceso manual. Reseña recopilada por y alojada en G2.com.
The tool is easy to navigate in and has a lot of flexibility to add custom attributes to each of the data types, particularly when using it as a system of record for compliance-related activities. The company is also really receptive to feedback as far as its features - they've incorporated a lot of the feedback provided. Reseña recopilada por y alojada en G2.com.
There are some features that aren't super robust - like role-based access controls, uploading multiple files to a record in bulk, and the general setup of the Jira integration. Reseña recopilada por y alojada en G2.com.
ZenGRC is a great tool to manage our complete audit cycle end to end, from automating a request to collect evidence on a defined frequency and closing them with the validation. It can be integrated with many audit frameworks. It creates an easy job in tracking and aligning the collected data in a structured way. It reduces a lot of manual work on tracking things. The tool is very much user-friendly. The support team's response to add features or resolve issues is applauded. Reseña recopilada por y alojada en G2.com.
It would have been wonderful if the licensing is related to the number of users, as we face these issues as our Organization is on tremendous growth now, and we have to onboard several users to the tool. We may also need some more features added to the iterations of the created tasks. Also it would be good if the tools allows some more ways of customization that can be allowed on the taks that are being created. It would be good to have a free trail initially to have a feel on the tool before having user subscriptions Reseña recopilada por y alojada en G2.com.
Encuentro muy útil cómo reduce los esfuerzos manuales y crea un proceso más fácil para las personas que utilizan esta herramienta para trabajos relacionados con negocios. Reseña recopilada por y alojada en G2.com.
No me gusta cómo integra aplicaciones de terceros. Esto hace que el software sea más lento y no siempre es preciso. Reseña recopilada por y alojada en G2.com.
ZenGRC's training and educational content under the knowledge base make it easy to stand up the platform yourself with minimal support. ZenGRC allows for a common approach to risk management across the enterprise and can be used by all business units. ZenGRC also enables a holistic view of how compliance status, program maturity, audit results, and vendors affect the overall risk score of the organization. This solution is easy to use, easy to stand up, and scalable as your organization grows. ZenGRC also offers excellent support. Reseña recopilada por y alojada en G2.com.
A more robust API integration with Jira would be beneficial. Vendor review requests submitted through Jira contain information that needs to be then re-entered into the GRC tool. I would prefer that this information already required for the ticket would be able to feed into the GRC tool without manual re-entry by the risk analyst. Reseña recopilada por y alojada en G2.com.
Fairly easy to navigate with sidebar menu.
Many options of things to record (audits, issues, etc.)
User access easily integrated into our single sign on capability. Reseña recopilada por y alojada en G2.com.
Could do better withthe side bar menu as not all options are listed and it's a roundabout process to get to some of the options.
Also navigation from one screen or page to another often entails going back to the beginning.
Search functionality could be improved - not always easy to find information within a recorded item.
Could do with having more fields when recording an issue/risk, to include more for action plans/due dates/owners and details for example.
Some of the above might simply be because I am farily new at using it. AS I get more familiar, they might become easier. Reseña recopilada por y alojada en G2.com.
ZenGRC nos da la capacidad de utilizar los diversos aspectos de una herramienta GRC. No restringe en función de los módulos, lo que nos ayuda a implementar todos los módulos de la manera que mejor funcione para la organización. Los módulos facilitan la personalización de los campos que queremos capturar y cómo queremos importar o exportar datos en masa. Además, el mapeo de controles utilizando SCF es beneficioso para vincular varios estándares con un conjunto común de controles.
También me encantó el equipo dedicado que pudo responder a todas nuestras preguntas durante las fases de demostración y POC. Los especialistas del producto conocen el producto y realmente me encantó que estuvieran trabajando continuamente para mejorar la funcionalidad de la herramienta. Reseña recopilada por y alojada en G2.com.
La interfaz de usuario actual se puede mejorar.
Los extractos del informe y la apariencia de una vista necesitan ser mejorados. En este momento, la plataforma tiene demasiadas pestañas bajo el mismo control / riesgo / problemas... es altamente beneficioso si todo esto se puede reunir en una sola vista.
La plataforma no permite que el acceso de usuario se restrinja por módulo. Por ejemplo: el propietario del control con acceso de editor puede incluso editar políticas y riesgos, lo cual no es una gran manera de implementar la segregación de funciones. Necesitamos acceso basado en roles en toda la plataforma. Reseña recopilada por y alojada en G2.com.