GRC FlowGRC Flow
  • Inside GRC Flow
  • Services
  • Packs
  • Encyclopedia
  • FAQ
FeedbackSign inGet started
  • Inside GRC Flow
  • Services
  • Packs
  • Encyclopedia
  • FAQ
  • Share feedback
  • Sign in

All services

Each service works on its own or inside a pack, and any deliverable can be used as input to another service.

Keep your deliverables with a free account

Forms prefilled from your profile, and deliverables you can reuse in any service.

Create a free account
GRC Flow

Governance, risk, compliance and IT operations services whose deliverables feed each other.

Product

  • Inside GRC Flow
  • Services
  • Packs
  • Encyclopedia
  • FAQ
  • About
  • Free tools

Frameworks

  • ISO/IEC 27001
  • GDPR
  • NIS2
  • DORA
  • HIPAA
  • PCI DSS

Legal

  • Terms
  • Privacy
  • Legal notice

© GRC Flow

  • Inside GRC Flow
  • Services
  • Packs
  • Encyclopedia
  • FAQ

Service categories

Organisational context4

  • Scope Definition

    The scope statement of a management system or programme: what it covers, what it leaves out and why, and what it depends on.

  • Context Analysis

    SWOT, PESTEL and interested parties, and what they mean for you.

  • RACI Matrix

    Who decides, who does it, who is asked first and who is told after, activity by activity.

  • Use Case Inventory Generator

    Every use case in one inventory: AI, IT, software, cloud, processes, data, network or security, with gaps and overlaps found.

Documentation2

  • Policy Builder

    24 kinds of policy, from information security and BYOD to quality, human resources and procurement, each built from its own template.

  • Plan & Procedure Builder

    IT plans and step-by-step procedures: incident management and response, change management, IT continuity, SOPs, recurring workflows and operational handbooks.

Risk management12

  • Asset Inventory

    What you own and depend on, each asset with an owner, a sensitivity and an importance.

  • Risk Identification

    List the risks of any area you choose, each with its cause, consequence and owner.

  • Risk Assessment

    Rate the risks you choose on a 5×5 matrix, with the reason for each rating.

  • Risk Register

    Track your risks in one register, each with its rating, action, owner and review date.

  • Risk Treatment Plan

    What to do about each risk of your register: three proposed treatments, an action, an owner and a deadline.

  • Risk Summary Report

    Management-ready summary of your risk position: main risks, treatment progress and decisions to take.

  • Risk Assessment Scoping

    Context, scope, impact and likelihood criteria, risk acceptance criteria and responsibilities of a risk assessment.

  • Risk Evaluation & Prioritization

    Assessed risks compared with the acceptance criteria: risks within criteria, risks requiring treatment and priorities.

  • Residual Risk Acceptance Register

    Residual risks after treatment, the acceptance criteria they meet or not, and the approvals still pending.

  • Risk Monitoring & Review Plan

    Review schedule, reassessment triggers, risk indicators and responsibilities for ongoing risk monitoring.

  • Third-Party Risk Assessment

    Assess a supplier, provider or partner: inherent and residual risks, evidence gaps, contract requirements and a treatment plan.

  • Business Impact Analysis

    Rank your activities by what their interruption costs and set their recovery targets: RTO, RPO, dependencies and the systems to recover first.

Risk methods (EBIOS RM)5

  • EBIOS RM Workshop 1: Scoping and Security Baseline

    Missions, business values, supporting assets, feared events with their gravity, and the security baseline.

  • EBIOS RM Workshop 2: Risk Sources and Objectives

    Risk sources, the objectives they pursue, and the relevant source/objective pairs retained.

  • EBIOS RM Workshop 3: Strategic Scenarios

    Ecosystem threat mapping and strategic scenarios leading from each retained pair to the feared events.

  • EBIOS RM Workshop 4: Operational Scenarios

    Operational attack paths on the supporting assets, their likelihood and the assumptions to verify.

  • EBIOS RM Workshop 5: Risk Treatment

    Risk map, treatment strategy, security measures, owners, deadlines and residual risks to validate.

NIST Risk Management Framework7

  • RMF Prepare: Preparation & Context

    System, missions, stakeholders, RMF roles, initial authorization boundary and risk tolerance.

  • RMF Categorize: System Categorization

    Proposed FIPS 199 categorization of the information types and of the system, with rationale and validations.

  • RMF Select: Security Control Selection

    SP 800-53 controls of the baseline matching the categorization, tailoring decisions and controls to implement.

  • RMF Implement: Control Implementation Record

    Implementation register: description, responsible person, evidence reference, status and missing information per control.

  • RMF Assess: Control Assessment Plan & Results

    Assessment plan (objectives and methods per control), results provided by the assessor, deficiencies and recommendations.

  • RMF Authorize: Authorization Package

    Authorization package: system summary, control and assessment summary, POA&M, residual risk and the decision to document.

  • RMF Monitor: Continuous Monitoring Plan

    Continuous monitoring: controls and activities, frequency, indicators, reassessment triggers and responsibilities.

Vulnerability management7

  • Vulnerability Management Plan Generator

    Your vulnerability management programme: policy, procedure, roles, assessment schedule, remediation SLAs, exceptions and escalation.

  • Vulnerability Register

    All vulnerabilities in one register: standardised, checked for errors and duplicates, with severity, status and overdue counts calculated.

  • Vulnerability Prioritization & Triage

    What to fix first: a priority for each vulnerability from its severity and its business context, with the reasons and the order of work.

  • Vulnerability Remediation Plan Generator

    Prioritised vulnerabilities turned into actions: who fixes what, by when, with tests, rollback and how to verify, in the right order.

  • Vulnerability Exception & Risk Acceptance

    Document a vulnerability that cannot be fixed on time: justification, residual risk, compensating controls and expiry, for the authorised person to decide.

  • Remediation Verification Report

    Prove a fix worked: original against current status, result of the verification, residual exposure, and whether the vulnerability can be closed.

  • Vulnerability Management KPI Report

    Measure the programme: exposure, severity, SLA compliance, overdue items, trends and what to improve, with every rate calculated.

Compliance assessment8

  • Compliance Questionnaire

    A questionnaire built for the framework you select, with its own questions and references, your answers analysed.

  • Control Register

    Register of your security controls: owner, implementation status, expected evidence and next review.

  • Gap Assessment

    Gaps against any framework, regulation or internal rules.

  • Non-Conformity Report

    Non-conformities and improvement opportunities from an audit, each with its evidence, cause and corrective action.

  • Remediation Roadmap

    Prioritised action plan to close your gaps, with owners, deadlines and the evidence each action produces.

  • Statement of Applicability

    All 93 Annex A controls with applicability and justification.

  • Compliance Change Impact Analyzer

    How a change in a law, standard, contract or internal requirement affects your policies and controls.

  • Data Protection Impact Assessment (DPIA)

    A DPIA under GDPR Article 35: whether it is required, the processing described, necessity and proportionality, risks to people, measures and residual risk.

Evidence & audit readiness2

  • Certification Readiness Review

    Audit-readiness review before certification: what is ready, what is missing and what to fix first.

  • Evidence Register

    What each department must be able to prove, what you hold, and what is missing or expired.

IT service management1

  • SLA Generator

    A complete service level agreement for any service, internal or external: measurable commitments, response times, responsibilities, credits and governance.

Network engineering6

  • Network Architecture Documentation Generator

    Design a new network from your needs: topology, equipment, IP and VLAN plans, security, redundancy, documented in full.

  • Network Configuration Generator

    Draft router and switch configurations for Cisco, Juniper, Aruba and MikroTik, ready for review.

  • IP Addressing Plan Generator

    IPv4 and IPv6 subnet allocation per site, with capacity for growth.

  • Subnet Calculator

    Masks, ranges, usable addresses and capacity of an IPv4 or IPv6 block.

  • Firewall Rule Generator

    Proposed firewall rules from traffic requirements, explained and reviewed before implementation.

  • Network Audit Generator

    Audit your whole network or the areas you choose, and get a report: findings, evidence, severity and remediation roadmap.

Incident & failure diagnostics5

  • IT Network Failure Diagnostic

    A structured network incident investigation, from your evidence and priorities to a diagnostic report.

  • Infrastructure Incident Analysis

    A structured investigation of server, virtualization, storage, power, telecom and cloud incidents, with a diagnostic report.

  • Application / Service Analysis

    A structured investigation of application and service failures, from the front end to the data, with a diagnostic report.

  • Security Incident Analysis

    A structured investigation of security incidents, from identities to detection, with a diagnostic report.

  • Regex & Detection Pattern Generator

    One detection scenario, equivalent patterns in SPL, KQL, Regex, Grok, Sigma and Lucene, explained and with test cases.

AI governance2

  • AI Use Case Classification Generator

    Preliminary classification of AI uses and the criteria that need human validation.

  • AI Output Evaluation Plan Generator

    How to test the quality of an AI system's outputs before going live and after each change.

SaaS, software & cloud3

  • Infrastructure as Code Generator

    Describe your architecture or paste your code: complete Terraform, Ansible or Docker Compose files.

  • SaaS Renewal Tracker

    Track SaaS subscriptions, cancellation deadlines, costs and unused licenses, and decide each renewal in time.

  • Software Lifecycle & End-of-Life Report

    Software whose support has ended or ends soon, and what to do about it.

Game development (Unity)10

  • Level Design Generator & Analyzer

    New levels designed, or existing ones analysed and improved: layout, progression, navigation, difficulty, exploration and spatial gameplay.

  • Game Design & Mechanics Generator

    New game mechanics designed, or existing ones analysed, corrected and balanced: rules, states, parameters, edge cases and tests.

  • Unity C# Programming Assistant

    Unity C# scripts written, debugged, refactored, optimised or explained, complete and for your Unity version.

  • Gameplay System Designer

    Gameplay systems designed or improved: combat, inventory, interaction, quests, dialogue, progression or crafting, with their architecture in Unity.

  • Unity UI/UX Designer & Analyzer

    Game interfaces designed, or existing ones analysed and improved: HUD, menus, inventory, settings, navigation, accessibility and their Unity build.

  • Unity Animation & Character Systems Assistant

    Character and object animation designed, analysed or improved: state machines, transitions, locomotion, blend trees, rigging and script integration.

  • Unity Audio System Designer

    Game audio systems designed or improved: music, sound effects, spatialisation, mixing, dynamic audio and their Unity implementation.

  • Unity AI & NPC Behaviour Designer

    NPC and enemy behaviour designed or improved: perception, decisions, navigation, combat and interactions, with their Unity implementation.

  • Unity Multiplayer & Network Systems Designer

    Multiplayer systems designed or improved: architecture, synchronisation, authority, matchmaking and client-server communication in your networking framework.

  • Unity Project Optimization Analyzer

    Unity project performance analysed and improved: CPU, GPU, memory, loading, rendering and assets, with a prioritised plan and validation tests.