Tugboat greatly simplifies the completion of security questionnaires resulting in significant savings of time and resources. Having ready access to infosec reports and listing of controls by area is incredibly handy for compliance exercises. Review collected by and hosted on G2.com.

This isn't so much a dislike of Tugboat, but we were underwhelmed to hear that professional services firms (e.g. Big 4 audit firms) aren't familiar with the tool and proposing instead to populate a massive spreadsheet. We've since heard that Tugboat is partnering with select audit firms so we will be looking to leverage those partnerships to gain significant efficiencies in the certification/audit process. Review collected by and hosted on G2.com.

The product layout and usability are some of the best I have ever seen. The pre-built policies and controls are saving us a "tugboatload" of time. They even receommended and audit company that is very professional, reasonable and fast. Sales process with Jeff was great and their support team has been excellent all around. Needless to say, I have already recommended this to other companies in the same situation, needing SOC 2 certification. Review collected by and hosted on G2.com.

Nothing that I dislike yet, although would have preferred if the trial had the full list of controls and policies, but understand the need to not give it all away up front. Review collected by and hosted on G2.com.

Tugboat has an easy to use interface that doesn't take a lot of time to get used to. I was able to quickly navigate and figure out how things work. The policy section is detailed and had essentially everything I needed for our organization to get up to speed and compliant. The same is true of controls as well. Review collected by and hosted on G2.com.

I wish there was a way to customize frameworks such that I could easy add/remove controls and policies as I switch between different frameworks. Unfortunately, the workaround suggested seems a little tedious and at times, redundant. Also, for the application access review, it would have been ideal to have Tugboat query these applications to determine user access levels, as the users are already loaded on TBL and each of the application. Review collected by and hosted on G2.com.

The UI is very flexible and intuitive. You can apply filters to your work to help you sort and manage. We knew we needed to try to achieve SOC2 Type 1 compliance in just 4 short months, start to finish, and that was a daunting task. Gratefully, Tugboat allowed us to approach the work very methodically, and the default policy templates were an excellent starting point for us to build off of. Once we began our SOC2 audit, Tugboat allowed us to prepare everything in an organized way for the auditors, exactly as they wanted to see the information.

Other important features we fell in love with:

The ability to easily manage our employees' annual Security Awareness Training with the push of a button. Any updated policies automatically make it into the training, and we can see who completed which sections and who has not yet completed their requirements.

We opted for the Questionnaire add-on, to aid in responding to security questionnaires from prospects and RFPs. This has already been a huge timesaver for us- we simply upload the questionnaire into Tugboat, and walk through the questions. Tugboat looks for the correct response from our list of policies and controls, and it's as simple as clicking a button to insert the response. When we're done, we can download from Tugboat back to the customer's original format. Review collected by and hosted on G2.com.

The biggest downside at this point is the inability to integrate Tugboat with our own Component Content Management system, easyDITA. We have been working with Tugboat's product management team however, and they are delivering on an API that will allow us to integrate, later this year.

The only other downside, and it's a small one, is that the Questionnaire add-on only takes spreadsheet or CSV formatted documents. When a customer provided us with their security questionnaire in an MS Word format, our Tugboat CSM was kind enough to convert it for us so we could upload into Tugboat to pull our responses, but it wasn't ideal because we couldn't export it in its original format to return to the customer. It took a bit of rework, but in the end, using the Questionnaire tool was still a timesaver, even with the additional steps needed. Review collected by and hosted on G2.com.

Automates the process of SOC audits. Great additional module support for questionnaires and other compliance practices. Keeps all of our application accesses logged easily. Integrations into AWS are helpful for sanity checks on configuration. Review collected by and hosted on G2.com.

Wish I could expand columns on index pages. Review collected by and hosted on G2.com.

It actually supports the process of getting SOC implemented and audits done, instead of just being a database, or doing something that's not really SOC like some of the competitors. Review collected by and hosted on G2.com.

I have minor misgivings about details in the UI, though the functionality is solid. Review collected by and hosted on G2.com.

Seems useful and deeply integrated with other platforms Review collected by and hosted on G2.com.

Post sales I would say this is one of the worst platforms I have ever used. We saw a complete drop in engagement with our company right after the dotted line was signed. Review collected by and hosted on G2.com.

The ease of collecting and organizing the evidence for audits. Review collected by and hosted on G2.com.

I would love to see more guidance and templates Review collected by and hosted on G2.com.

Everything I could need in one place. Great Customer Service. Review collected by and hosted on G2.com.

Took a bit to get the hang of the navigation. Not always intuitive. Review collected by and hosted on G2.com.

An intuitive user interface, templates derived from current cybersecurity standards Review collected by and hosted on G2.com.

Does not include AsiaPac cybersecurity standards/ compliance regime Review collected by and hosted on G2.com.