Features
Everything you need to run your compliance
Fourteen modules sharing the same controls, the same evidence and the same activity log. Start with what is urgent, the rest follows.
Frameworks and Statement of Applicability
Choose your frameworks: OK-GRC creates your controls only once, even when several standards require them.
- 13 frameworks, 1,343 requirements and 353 shared controls with guidance and evidence examples
- Score per standard and per domain, updated in real time
- “High-leverage” controls: what moves the most standards forward at once
- A justified, approved Statement of Applicability exported to PDF or XLSX
Programme management
From kick-off to the audit, then the surveillance cycle: a real project plan, linked to the actual progress of your compliance.
- Ready-made methodologies: ISO 27001, ISO 9001, ISO 22301, ISO/IEC 17025 (COFRAC), SOC 2, GDPR, NIS2, DORA, AI Act…
- Phased plan built around the audit date, milestones and alerts as soon as the project slips
- Automatically checked deliverables: score, approved documents, internal audit, management review…
- Steering committees, project risk and decision log, “Ready for the audit?” checklist
Risks and assets
A simple method inspired by ISO 27005 and EBIOS RM, for risks and opportunities alike.
- Asset inventory with CIA rating and sector templates
- Likelihood × impact matrix, inherent and residual risk
- A library of 66 bilingual scenarios and AI suggestions
- Treatment plans, tasks and signed acceptance of residual risks
Documents and policies
Your policies and procedures, drafted fast and approved properly.
- 52 bilingual templates linked to the requirements they cover
- Editor with autosave, versions and comparison
- Review and approval workflow, periodic review
- Read acknowledgement campaigns for employees
Evidence
Every control has its evidence, up to date and ready for the auditor.
- Files, links or texts linked to one or more controls
- Versions, SHA-256 fingerprint and antivirus scan of files
- Validity dates and reminders before expiry
- Evidence requests assigned to the right people
Action plan and tasks
A concrete action plan, shared by the whole team.
- Tasks linked to a control, a risk, a finding or an incident
- List, kanban and calendar views, checklists
- Reminders the day before the due date and when overdue
- Break a goal down into steps with the assistant
GDPR
Day-to-day GDPR, with the CNIL methods.
- Controller and processor records of processing, 43 templates
- DPIA screening and wizard
- Data subject requests with deadlines, reminders and response templates
- Optional public form to receive requests
Incidents
React fast and notify on time.
- Incident timeline, impacts, causes and lessons learned
- NIS2 (24 h, 72 h, 1 month) and GDPR (72 h) deadlines computed
- Hourly reminders while a notification is due
- Assisted post-mortem and corrective actions
Vendors and third parties
Your vendors, their risks and their commitments.
- Register with criticality, data processed, location and transfers
- Security questionnaires sent by link, no account needed
- AI-assisted analysis of the answers
- DPA tracking and DORA register of information export
Audits and management review
Structured internal audits, as ISO 19011 recommends.
- Annual programme, checklists generated from the requirements
- Findings, nonconformities, root cause analysis and corrective actions
- Effectiveness check before closing
- Management review prepared automatically, minutes in PDF
Training and awareness
Train and raise awareness, and be able to prove it.
- 9 ready-made modules: phishing, passwords, GDPR, AI, NIS2, laboratories…
- Quizzes marked server-side with a pass mark
- Automatic reminders and tracking dashboards
- Training certificates in PDF
AI assistant
The AI that prepares the work, based on your context.
- Drafting and tailoring of policies, procedures and answers
- Suggestions of risks, controls and justifications
- Gap analysis of a document against the requirements
- Claude or a sovereign model, optional masking of personal data
Dashboards and reports
Clear figures to decide and report.
- Dashboard with scores, trends and deadlines
- PDF reports for management and the auditor
- XLSX and CSV exports protected against formula injection
- Weekly summary by email
Multi-company and consultants
Several companies, a group, or a firm with its clients.
- Portfolio view: all your organisations and their scores
- Parent organisation and subsidiaries (Enterprise plan)
- Partner access granted by the client, limited and revocable
- Every consultant action is traced
And everywhere, the same foundations
- Suitable roles: owner, administrator, CISO, DPO, quality manager, contributor, viewer, auditor
- Tamper-proof activity log on every change
- Comments and mentions on every item
- Global search and command palette
- Interface and templates in French and English
- Works on desktop, tablet and phone
All frameworks included in every plan
Ready to simplify your compliance?
Create your workspace in minutes. The assistant suggests the frameworks and priorities that fit your company.
14-day trial with every Pro feature · Nothing charged before the trial ends · No commitment