Relationships across different system objects (e.g., risks, controls, vulnerabilities, assessments, issues, products, assets, etc.) are robust and intuitive Review collected by and hosted on G2.com.

Limited capabilities for customizing notifications. Additionally, the interface automatically opens new tabs on most clicks, quickly cluttering your browser. Review collected by and hosted on G2.com.

We are a start-up and we needed a quick and easy way to manage our ISMS and Compliance program. I've used other GRC products, ZenGRC made it simple, what I liked best was:

- Working with Reciprocity, the onboard was organized, ISMS programs uploaded and customer success manager to make it successful

- Using ZenGRC to managed the core of ISMS, service catalog, incidents, exceptions, vendor and customer requirements

- No more looking for spreadsheets or documents - our program is active, accessible and managed.

- An affordable solution for your needs. Review collected by and hosted on G2.com.

Two areas of improvement for the product that Reciprocity is addressing is more flexibility with access management and workflows on actions and issues. Review collected by and hosted on G2.com.

Easy to onboard, train out and see effects from quickly. Getting off spreadsheets has been great. One quick win for us has been Issues/Tasks/Reminder emails functionality. That removed a lot of admin for the Compliance function with not much effort. We're not that far into our implementation, but we're finding it pretty painless so far.

One of the comments I've had from operational areas is that it's easy to use and find what you need. This was so important to us when trailing different companies platforms, and I'm glad ZenGRC is so easy for people. The training material is useful too.

The wiki is brilliant and I use it all the time. It's been so great having that resource available as you feel much more independent when using the software, you don't need to reach out to your account manager all that often.

Everyone I've spoken to at ZenGRC throughout the process has been brilliant. Erica, my current Success Manger, is so easy to talk to and is quite to offer support and suggestions - even with our 9 hour time difference! Review collected by and hosted on G2.com.

I'd like to be able to format the dashboard more. For example, change colours, add commentary for each chart. I'd also like to be able to have more flexibility around permissions, but I know that's a huge piece of work you're on with, and from seeing the demonstration at the User Group last week, it's looking really good.

There are training videos, but I think more of them would help. The wiki is amazing and full of great info, but sometimes a small video showing you how to do something is so useful. Especially to share with those in the business who aren't regular users of the platform.

As a UK user of the platform, it would be great to have some UK-specific regulations transposed into the system. For example, in the UK, most financial services firms will need to follow specific rules outlined within the FCA Handbook. This is a huge piece of regulation for us to transpose, and something we'll absolutely do, but I do think it could be a real feature for ZenGRC if they had this already transposed for UK financial services firms. Review collected by and hosted on G2.com.

It is easy to use, and the support from reciprocity is outstanding. They are there to help you every step of the way! There was a little bit of a learning curve at start-up, but Reciprocity was there to make sure everything worked properly. Review collected by and hosted on G2.com.

I cannot honestly think of anything that I dislike about using ZenGRC. Directing and completing audit and compliance functions have been much easier since we switched to using ZenGRC. Review collected by and hosted on G2.com.

ZenGRC enables our business to manage our certification, risks, and compliance adherence in one place. It enables us to perform our internal audits/assessments by the department for all areas, therefore, minimizing disruption to our business. Review collected by and hosted on G2.com.

The ZenGRC Wiki and api interface data sets Review collected by and hosted on G2.com.

I like the simplicity that everything is an object and that you can relate all objects to each other. Review collected by and hosted on G2.com.

Mapping can be very cumbersome and not always intuitive with what the system displays during the mapping. Review collected by and hosted on G2.com.

The thing I like best is the ease of functionality and dashboard options. The onboarding process and working with their implementation expert was the best! Review collected by and hosted on G2.com.

The only thing is that it opens up multiple windows. Review collected by and hosted on G2.com.

It's a tool that doesn't take long to master; I am a massive fan of its simplistic yet comprehensive design. Review collected by and hosted on G2.com.

I wish there were more automation, especially when it comes to vendor assessments. Review collected by and hosted on G2.com.

ZenGRC has provided my contract compliance team with its first ever compliance tool, which has been huge in collecting and retaining documentation for our quarterly compliance audits. With over 500 requirements our account team must comply with, Zen has allowed easier and more direct access to useful information for our business owners. As compliance is not always top of mind for them with their day to day work, the tasks feature has become very helpful in reminding them of our requirements without my team having to pester them with emails or follow up on every major requirement to ensure it is completed. Both sides have appreciated this!

The Reciprocity team has been helpful and easy to work with. Since our compliance audits are not any of the standard ones, we had to add multiple new categories of information when setting up our account. Reciprocity worked closely with us so the tool could work for our purposes, and this customization ability for a reasonable price was a major reason why our team chose to use ZenGRC. Review collected by and hosted on G2.com.

Overall, the tool is not as flexible as I would prefer, but Reciprocity seems to be constantly working on updates. It is important to note that my team mostly works with the Audit Management section of ZenGRC; therefore, I do not care about Reciprocity's updates to the risk and threat sections (which currently seems to be going through the most changes).

Our compliance audit is not one of the standards--SOC, SOX, etc--so how the Compliance Objects (programs, standards, sections, objectives, controls) are set up in the tool creates a lot of redundancy. In order for us to complete an assessment of a requirement after it being tested, we need to have a control and cannot tie it directly to an objective. Additionally, we were able to create custom attributes relevant to our needs, but are unable to hide or remove the standard attributes that do not apply to us.

Regardless of the sections used, the tool has multiple ways of viewing information, which is good, but not all of them allow for column widths or the order of the columns to be changed for optimal viewing by the user. Additionally, the ability to filter and sort is not consistent between the audit view, objects list, and the to-do list, which can be frustrating. These features seem to be standard in most applications these days so I was disappointed with the limited flexibility. Review collected by and hosted on G2.com.

I like that I can pick up the tool relatively quick. I like the different categories separated on the left panel in ZenGRC. The different categories separated make it easier to navigate through things and the categories are also easy to remember. I like that the ZenGRC UI is not complicated to use and everything is straight-forward. Review collected by and hosted on G2.com.

Alot of repetitive steps to get something done. For example, if I need to look at the attachments information for a control, rather than being able to get to the attachments directly from a control - I need to go to requests under mapped object --> find the control --> finding the attachments.

The roles in ZenGRC is also too limited and/or not enough flexibility for modification to enforce certain access rights. For example, if a contributor is assigned a request, he or she is not able to re-assign the request to someone else. Review collected by and hosted on G2.com.