Grace Ferrante had a signed purchase order for $112,000 a year before she had a risk register.
She was VP of Compliance at Calloway Diagnostics, a 140-person medical device and diagnostics company in North Carolina that needed ISO 27001 to keep selling into European hospital networks. Her CEO had given her a mandate and a deadline: certified within nine months, no excuses. Grace did what a lot of first-time compliance leads do under time pressure — she went shopping. She found a well-marketed, well-funded GRC and compliance-automation platform with a slick dashboard, a "path to certification" wizard, pre-built policy templates, and a sales team that told her, more or less directly, that the software would "get them audit-ready in twelve weeks."
Nine months and $84,000 in software spend later, Calloway Diagnostics walked into its Stage 2 audit with a beautiful dashboard showing 91% "control coverage." The auditor spent four hours in the tool during the opening meeting, nodded politely, and then spent the next three days doing what auditors actually do: interviewing the network engineer about how patch management really worked, asking the HR director to produce evidence that background checks had actually been performed (not just that a checkbox existed in the platform), and pulling change tickets to see whether the change management process documented in the tool matched what happened in the ticketing system. It didn't. The platform had auto-generated a change management policy that nobody had adapted to Calloway's actual DevOps workflow, and the "evidence" attached to Control 8.32 (Change management) was a policy PDF, not a single real change record. The audit closed with five nonconformities — two major — including one that read, in essence, "documented process does not reflect operational practice." Recertification required a follow-up visit, a delay of eleven weeks, and roughly $40,000 in additional consulting and audit fees to fix what the software had never actually built: a working management system.
Grace's mistake wasn't buying software. It was believing the software was the compliance program. This is one of the most expensive misconceptions in the entire ISO 27001 industry, and after fifteen years advising organizations of every size through this standard — from three-person startups running everything out of Google Sheets to 4,000-person enterprises with dedicated GRC teams — I can tell you the pattern repeats constantly. Tooling is a real lever. It is not a substitute for the thing it's supposed to support.
I've told versions of the Calloway story to boards, to procurement teams mid-negotiation, and to founders convinced that the right dashboard is the fastest route to a certificate on the wall. The market makes this an easy mistake to fall into. GRC and compliance-automation vendors have raised enormous sums of venture funding over the past several years, and enormous sums of venture funding buy enormously persuasive marketing — polished onboarding flows, "instant SoA generation," and sales decks with logos of recognizable customers who, if you asked them privately, would tell you the software was one part of a much longer, much more human effort. None of that makes the tools bad. It makes the marketing incomplete, and it puts the burden on you, the buyer, to separate the software's real capability from the certificate-shaped promise wrapped around it.
Who This Is For
This article is for the compliance lead, CISO, IT director, or founder staring at a decision: do we spend $15,000–$150,000+ a year on ISO 27001 or GRC software, or do we run this on spreadsheets, SharePoint, and the tools we already pay for? You'll walk away understanding what each category of tool actually does under the hood, when spreadsheets are genuinely sufficient (more often than vendors want you to believe), when a platform earns its price tag, and the specific questions that separate a tool that will help your audit from one that will just generate a very convincing-looking failure. If you're earlier in the process and haven't yet scoped your program, it's worth reading this alongside a broader ISO 27001 implementation roadmap so tooling decisions slot into the right phase rather than driving the whole project. If terms like "Statement of Applicability" or "control owner" are new to you, keep our ISO 27001 terminology and glossary open in another tab as you read.
The "Tool ≠ Compliance" Reality
Let's state the accuracy point plainly, because it's the single most important sentence in this article: ISO/IEC 27001:2022 does not require you to purchase any software. There is no clause, no Annex A control, and no certification body rule that mandates a GRC platform, a compliance-automation tool, or any specific piece of technology. Organizations have been certifying against this standard since the 1990s (back when it was BS 7799), long before "GRC platform" was a product category, and organizations certify today running their entire ISMS out of a shared drive, a spreadsheet-based risk register, and a well-organized document folder structure.
What ISO 27001 requires is a functioning Information Security Management System — documented policies, a risk assessment and treatment process, a Statement of Applicability, evidence that controls are operating, records of management review, internal audits, and continual improvement. Software can help you produce, store, version, and retrieve all of those artifacts. It cannot manufacture the underlying judgment, ownership, and operational discipline that make them real. An auditor is assessing your management system — whether people actually do what the documents say, whether risk decisions were genuinely made by accountable owners, whether evidence reflects real operational activity — not whether your dashboard is pretty.
"I've audited companies with a $200,000 GRC platform and a shoebox of screenshots for evidence, and I've audited a nine-person startup with nothing but Google Sheets and Google Drive that sailed through Stage 2 without a single nonconformity. The software was never the variable that predicted the outcome. Ownership was." — Marcus Feld, Lead Auditor, Ridgeline Assurance Partners
This doesn't mean tooling is worthless — far from it, as the next section covers. It means the buying decision has to start from a clear-eyed view of what a tool is actually for: reducing manual effort, improving consistency, and creating a durable audit trail — not manufacturing compliance you haven't done the work to earn.
What Tooling Actually Does (When It's Working)
Strip away the marketing language and every credible ISO 27001 or GRC tool on the market is doing some combination of six concrete jobs:
Centralizing documents and version control — one authoritative location for policies, the SoA, the risk register, and procedures, with revision history, approval workflows, and access control, instead of seventeen versions of "Information Security Policy_FINAL_v3_reallyfinal.docx" scattered across email threads.
Structuring the risk assessment and treatment workflow — asset-linked or scenario-linked risk entries, consistent scoring, automatic risk-owner assignment, and treatment-plan tracking, so the register doesn't become an unmaintainable 40-tab spreadsheet.
Mapping controls to evidence and tracking control status — a live view of which of the 93 Annex A controls are implemented, partially implemented, or not applicable, with evidence artifacts attached to each.
Automating evidence collection via integrations — pulling configuration data, access review logs, ticket records, or vulnerability scan results directly from cloud providers, identity platforms, and ticketing systems, reducing the manual screenshot-and-upload cycle.
Running task and workflow management — reminders for control owners, policy review cycles, access recertification campaigns, and internal audit scheduling.
Producing audit-ready reporting — SoA exports, control-status dashboards, and gap reports that a certification body auditor or a customer's security questionnaire can consume quickly.
Every one of those six functions is genuinely useful, and it's worth being specific about why. Centralized document control matters because auditors routinely ask "show me the previous version of this policy and who approved the change" — a request that takes seconds in a proper system and can take hours of email archaeology without one. Structured risk workflows matter because a risk register that only one person can interpret becomes a single point of failure the moment that person leaves. Control-to-evidence mapping matters because the Statement of Applicability review during Stage 1 is essentially an auditor asking, control by control, "prove this is real" — and a tool that keeps that mapping current saves real time re-assembling it from scratch every audit cycle. None of them, alone or together, replaces a competent risk owner making a real decision, an engineer actually patching a system, or a manager actually reviewing an access list. Software accelerates the mechanics of an ISMS. It does not perform the judgment.
The Software Categories at a Glance
"GRC software" is used loosely to describe several genuinely different product categories, and conflating them is where a lot of buying decisions go wrong. Here's how they break down, vendor-neutrally.
Category | Primary Job | Typical Buyer | Typical Price Range (Annual, Illustrative) | ISO 27001 Fit |
|---|---|---|---|---|
Spreadsheets / document stores | Manual record-keeping, no automation | Startups, small businesses, lean teams | $0–$2,000 (existing Microsoft 365 / Google Workspace licenses) | Full fit for small, single-framework scopes |
Document / ISMS management systems | Centralized policy and record control, version history, workflow | Small-to-mid orgs wanting structure without full GRC cost | $2,000–$15,000 | Strong fit for document-heavy control needs |
Risk management tools | Structured risk register, scoring, treatment tracking | Orgs with complex or numerous risk scenarios | $3,000–$20,000 | Strong fit for Clause 6 risk workflows |
Compliance-automation platforms | Evidence collection via integrations, continuous control monitoring | Tech companies, SaaS vendors, multi-framework needs | $10,000–$60,000+ | Strong fit for cloud-native, integration-rich environments |
Full GRC platforms | Enterprise-wide risk, compliance, audit, and policy management across multiple frameworks and business units | Large enterprises, regulated industries, multi-framework/multi-entity | $30,000–$250,000+ | Strong fit for scale and audit complexity, overkill for single-scope SMBs |
Illustrative figures throughout this article reflect what I've seen quoted across dozens of client procurement cycles; actual pricing varies by vendor, seat count, and negotiated terms, so treat every number here as a planning anchor, not a quote. If you're ready to compare specific vendors within these categories, our roundup of the best ISO 27001 compliance software breaks down how the leading options stack up on price, fit, and real-world evidence coverage.
Category Deep Dive: Spreadsheets and Document Stores
This is the baseline every organization starts from, and for a meaningful share of the small-and-mid-size companies I've worked with, it's also where they finish — successfully certified. A well-structured Google Sheets or Excel ISO 27001 risk register, a shared drive with clear folder taxonomy and access control, and disciplined version-naming conventions can absolutely carry a 10–150 person organization through certification. The limiting factor isn't the standard's requirements — it's your own operational discipline. Spreadsheets don't enforce version control, don't send review reminders, and don't stop three people from editing the same risk entry with conflicting numbers. That discipline has to come from the team, not the tool.
Category Deep Dive: GRC Platforms
Traditional GRC (governance, risk, and compliance) platforms were built originally for enterprise risk and regulatory compliance programs — often SOX, internal audit, and vendor risk — and later extended to cover information security frameworks including ISO 27001. They tend to be broad, configurable, and built for organizations managing many frameworks, many business units, or many entities simultaneously. Strengths: enterprise-grade workflow, strong audit trail and role-based access, ability to map one control implementation to multiple framework requirements (useful if you're running ISO 27001 alongside SOC 2 or a regulatory framework). Weaknesses: often expensive, frequently over-engineered for a single-scope ISMS, and can require significant configuration effort before they save any time at all. If this category fits your situation, our comparison of the best compliance automation / GRC platforms is a useful starting point for shortlisting vendors before you sit through a round of demos.
Category Deep Dive: Compliance-Automation Platforms
This is the newer, faster-growing category — platforms built specifically around continuous evidence collection: connecting to your cloud provider, identity provider, HR system, and ticketing tool via API integrations, then automatically pulling configuration snapshots, access logs, and change records as ongoing evidence rather than one-time screenshots. These platforms are heavily marketed for both ISO 27001 and SOC 2, since the evidence-gathering mechanics overlap significantly between the two frameworks. Strengths: dramatically reduces the manual "screenshot everything before the audit" grind, gives near-real-time visibility into control drift. Weaknesses: integrations only cover what they're built to cover (a lot of Annex A — physical controls, HR processes, supplier contract review — isn't API-observable at all), and teams sometimes mistake "the integration is green" for "the control is actually effective."
Category Deep Dive: Risk Management Tools
A narrower category focused specifically on Clause 6 risk assessment and treatment: structured risk registers with configurable scoring methodologies, automatic linkage between assets, threats, and treatment plans, and reporting built for management review. These sit well alongside a broader ISMS document tool or spreadsheet approach for organizations whose main pain point is risk register complexity rather than evidence collection.
Category Deep Dive: Document / ISMS Management Systems
A middle-ground category: purpose-built document control systems with version history, approval workflows, control-to-document mapping, and sometimes lightweight risk modules, without the full evidence-automation or enterprise-GRC feature set (and price tag). These often appeal to organizations that have outgrown spreadsheets' version-control problems but don't need — or can't yet justify — a full compliance-automation platform.
"The GRC platform category is really three or four different products wearing the same marketing language. Before you take a demo, know which job you're actually trying to solve — document control, risk register complexity, or evidence automation — because most vendors will happily sell you all three whether or not you need them." — Dana Okafor, Head of GRC, Solvent Robotics
Multi-Framework Tooling: ISO 27001 Alongside SOC 2, GDPR, and PCI DSS
A large share of the demand for compliance-automation and full GRC platforms doesn't come from ISO 27001 alone — it comes from organizations juggling ISO 27001 plus at least one other framework or regulatory obligation simultaneously. This is exactly where tooling economics change most dramatically, because a single piece of evidence can often satisfy overlapping requirements across frameworks if the tool (or your own mapping discipline) captures that overlap correctly.
Framework Pairing | Where Evidence Overlaps | Where It Doesn't |
|---|---|---|
ISO 27001 + SOC 2 | Access control, change management, monitoring/logging, vendor risk | ISO 27001's formal risk treatment methodology and Statement of Applicability have no direct SOC 2 equivalent |
ISO 27001 + PCI DSS | Network segmentation, access control, vulnerability management | PCI DSS's cardholder-data-specific requirements (e.g., quarterly ASV scans) are narrower and more prescriptive |
ISO 27001 + GDPR/privacy obligations | Data protection impact considerations feed into risk assessment; supports privacy and PII protection under Control 5.34 | GDPR's legal bases for processing and data-subject-rights workflows are outside ISO 27001's scope entirely |
ISO 27001 + industry regulatory frameworks (e.g., HIPAA, DORA) | Governance, incident response, business continuity structures often align | Sector-specific breach notification timelines and regulator-specific reporting formats still need dedicated tracking |
If you're managing two or more of these simultaneously, the case for a compliance-automation or GRC platform gets meaningfully stronger, because the labor saved from evidence reuse compounds with each additional framework. If ISO 27001 is your only current obligation, be skeptical of a sales pitch built around "future-proofing for frameworks you don't have yet" — that's a real consideration, but it shouldn't be the deciding factor for a purchase you need to justify today.
Spreadsheets vs GRC vs Automation: When Each Fits
There's no universally correct answer here — the right choice depends on headcount, scope complexity, framework count, and how much of your infrastructure is API-observable in the first place. Here's the practical breakdown I walk clients through.
Situation | Spreadsheets / Doc Store | Document/ISMS Management Tool | Full GRC Platform | Compliance-Automation Platform |
|---|---|---|---|---|
Under 30 employees, single ISO 27001 scope | Usually sufficient | Optional convenience | Overkill | Often overkill unless cloud-native SaaS |
30–150 employees, single framework | Workable with discipline | Strong fit | Possible but often premature | Fit if heavily cloud/API-based |
150–500 employees, single framework | Increasingly strained | Good fit | Good fit | Strong fit for tech companies |
Multiple frameworks (e.g., ISO 27001 + SOC 2 + PCI DSS) | Painful — duplicated evidence work | Partial help via mapping | Strong fit | Strong fit |
Multiple business units / entities | Very painful | Limited | Strong fit | Moderate fit |
Highly cloud-native, few physical/on-prem assets | Workable but manual | Good | Good | Best fit — integrations do the heavy lifting |
Heavy physical/on-prem/manufacturing environment | Workable | Good | Good | Weaker fit — less to automate |
Fast-growing headcount, frequent access changes | Becomes error-prone quickly | Moderate help | Strong fit | Strong fit for access-review automation |
The pattern worth internalizing: the more your control evidence lives inside systems with APIs (cloud infrastructure, identity providers, ticketing, HR platforms), the more a compliance-automation platform earns its keep. The more your evidence is procedural, physical, or judgment-based (supplier relationship management, physical entry controls, HR screening decisions), the less any tool can automate for you — and the more the price tag is paying for document control and reporting convenience rather than genuine automation.
Do You Need GRC Tooling? A Decision Flow
flowchart TD
A[Start: Scoping your ISMS] --> B{Org size?}
B -->|Under 30 employees| C{Single framework,\nsimple scope?}
B -->|30-150 employees| D{Multiple frameworks\nor entities?}
B -->|150+ employees| E{Complex scope,\nmultiple business units?}
C -->|Yes| F[Spreadsheets + doc store\nlikely sufficient]
C -->|No, growing fast| G[Consider lightweight\ndocument/ISMS tool]
D -->|No| H{Heavily cloud-native\nwith APIs to automate?}
D -->|Yes| I[Compliance-automation\nor GRC platform justified]
H -->|Yes| J[Compliance-automation\nplatform likely worth it]
H -->|No| K[Document/ISMS tool\nprobably enough]
E -->|Yes| L[Full GRC platform\nlikely justified]
E -->|No| M[Mid-tier document/ISMS\nor automation tool]
F --> N[Reassess at ~50-75\nemployees or 2nd framework]
G --> N
K --> N
M --> N
I --> O[Reassess ROI annually\nagainst renewal cost]
J --> O
L --> OThe point of this flow isn't to be prescriptive down to the employee — it's to force the right sequencing of questions. Size alone never justifies a platform purchase; scope complexity, framework count, and the automatable share of your evidence do. I've seen 40-person companies correctly buy a compliance-automation platform because they were a pure-cloud SaaS company managing SOC 2 and ISO 27001 simultaneously with a two-person security team, and I've seen 300-person manufacturers correctly stay on spreadsheets and a shared drive because almost none of their evidence was API-observable in the first place.
Cost vs Benefit
Here's where the buying decision gets real. Every tool category has a cost side and a benefit side, and the mistake I see most often is evaluating the cost in isolation from the labor it's actually meant to displace.
Category | Illustrative Annual Cost | Primary Benefit Claimed | Realistic Benefit Delivered | Hidden Costs |
|---|---|---|---|---|
Spreadsheets / doc store | $0–$2,000 | N/A (baseline) | Full flexibility, zero vendor lock-in | Staff time for manual version control and evidence chasing |
Document/ISMS tool | $2,000–$15,000 | "Never lose a document version again" | Real reduction in document chaos and review-cycle misses | Setup/migration time (20–60 hours typical) |
Risk management tool | $3,000–$20,000 | "Automate your risk register" | Cleaner scoring consistency, easier management review reporting | Configuration of scoring methodology; ongoing data entry still manual |
Compliance-automation platform | $10,000–$60,000+ | "Continuous, audit-ready compliance" | Meaningful reduction in manual evidence-gathering for API-observable controls only | Integration setup (40–150+ hours), false-positive triage, per-integration fees |
Full GRC platform | $30,000–$250,000+ | "Enterprise-wide risk and compliance visibility" | Strong for multi-framework, multi-entity orgs; weak ROI for single-scope SMBs | Admin/configuration overhead, training, annual license escalation |
"Every renewal cycle, I ask the same question: how many audit-prep hours did this actually save us last year, in writing, compared to what we paid? If nobody can answer that with real numbers, that's the tell the tool bought convenience, not compliance." — Tomas Vrba, Information Security Manager, Kestrel Freight Logistics
Total Cost of Ownership: What the Sticker Price Doesn't Show
License fees are the visible cost. The real total cost of ownership includes implementation time, integration maintenance, training, and the ongoing labor of keeping the tool itself accurate — which is a real, recurring cost that vendors rarely walk you through during the sales cycle.
Cost Component | Spreadsheets | Document/ISMS Tool | Compliance-Automation Platform | Full GRC Platform |
|---|---|---|---|---|
License/subscription | Minimal | Low–moderate | Moderate–high | High |
Initial setup/configuration | Low (hours) | Moderate (1–3 weeks) | Significant (3–8 weeks for integrations) | Significant (4–12 weeks) |
Staff training | Minimal | Low | Moderate | Moderate–high |
Ongoing maintenance (integration breakage, data hygiene) | None (manual anyway) | Low | Moderate — integrations drift, need re-auth, re-mapping | Moderate–high, often needs a dedicated admin |
Consultant/implementation partner fees (if used) | None | $0–$5,000 | $5,000–$25,000 | $10,000–$60,000+ |
This is a cost dimension that pairs directly with your broader ISO 27001 implementation costs planning — a tool line item that looks affordable in isolation can quietly become the largest non-labor cost in your entire certification budget once setup and maintenance hours are counted honestly.
A Simple ROI Framework for Tooling Decisions
Most tooling purchase decisions I've been part of skip a basic calculation that would settle the argument in ten minutes. Before signing anything, run these four numbers:
Step | Calculation | Example (Illustrative) |
|---|---|---|
1. Current manual labor cost | (Hours spent per quarter on evidence collection/document control) × (loaded hourly rate) × 4 | 90 hours/quarter × $65/hour × 4 = $23,400/year |
2. Expected labor reduction | Current labor cost × realistic automation coverage (be conservative — 30–50% is common, not 90%) | $23,400 × 40% = $9,360/year saved |
3. Total tool cost | License + implementation (amortized) + ongoing maintenance labor | $18,000 license + $4,000 amortized setup + $2,000 admin time = $24,000/year |
4. Net position | Step 2 minus Step 3 | $9,360 − $24,000 = −$14,640/year (negative — tool not yet justified at this scale) |
Run that same math for Bramwell Insurance Group from the case studies later in this article and the picture flips: roughly 340 hours/year saved at a loaded rate near $70/hour is about $23,800 in labor value against a $46,000 platform cost — still not a slam-dunk on labor savings alone, which is exactly why Bramwell's decision also weighed the qualitative benefit of near-continuous control visibility and smoother dual-framework audits, not labor cost in isolation. The point of this exercise isn't to produce a number precise to the dollar — illustrative figures like these are planning anchors, not guarantees — it's to force the conversation to happen in numbers instead of impressions from a sales demo.
Selection Criteria and Questions to Ask Vendors
If you've decided the cost-benefit math justifies a purchase, the next risk is buying the wrong tool for the wrong reasons — usually because a sales demo was persuasive rather than because the fit was verified. These are the questions I make clients ask in every vendor evaluation.
Criterion | Question to Ask | Why It Matters |
|---|---|---|
Framework coverage | Does it natively map controls across ISO 27001, SOC 2, and any other frameworks you need, or is mapping manual? | Determines real multi-framework efficiency vs marketing claim |
Integration depth | Which specific systems does it integrate with, and what percentage of our actual Annex A controls could those integrations realistically evidence? | Surfaces the automatable vs non-automatable evidence gap early |
Data portability | Can we export our full risk register, SoA, and document history in a usable format if we leave? | Avoids vendor lock-in and audit-continuity risk |
Auditor familiarity | Has your certification body's audit team worked with this platform's evidence exports before? | Reduces friction and surprises during Stage 1/Stage 2 |
Configuration effort | What is a realistic implementation timeline with our team's current staffing, not your fastest case study? | Prevents underestimating true time-to-value |
Support model | Is implementation support included, or a separate paid service? | Hidden cost that materially changes total cost of ownership |
Scalability | What does pricing look like at 2x our current headcount or a second framework? | Avoids a painful renewal-cycle surprise |
Independence from process | Does the tool require us to adapt our real operational process to fit its templates, or can it reflect how we actually work? | A tool that forces a fictional process onto real operations creates exactly the nonconformity risk Calloway Diagnostics hit |
References | Can we speak to a customer of similar size and scope who has been through at least one full certification or surveillance cycle with this tool? | Marketing case studies rarely include the awkward parts |
A useful gut check before any contract is signed: if you removed the software entirely, could your team still describe — in plain language, without opening a dashboard — who owns each risk, what the current top five treatment actions are, and how you'd prove a control was operating last Tuesday? If the answer is no, the tool has become a crutch for institutional knowledge that needs to live in people and process, not just in a database.
Integration and Evidence Automation: The Real Trade-Offs
Compliance-automation platforms live or die on their integrations — pulling live configuration and log data from cloud providers, identity systems, and ticketing tools instead of manual screenshots. This is the single most genuinely time-saving feature in the entire tooling market, and it's also the most commonly overstated.
The Genuine Upside
Benefit | What It Looks Like in Practice |
|---|---|
Reduced manual evidence-gathering | No more quarterly scramble to screenshot every access list, config setting, and log export before an audit |
Near-continuous control visibility | Control drift (e.g., an MFA policy silently disabled) can surface within days instead of being discovered at the next audit |
Faster audit prep | Auditors can be given time-boxed, read-only access to evidence repositories instead of a slow back-and-forth document request cycle |
Easier multi-framework reuse | One piece of evidence (e.g., an access review log) can be mapped to equivalent requirements across ISO 27001, SOC 2, and other frameworks simultaneously |
The Real Downside
Risk | What It Looks Like in Practice |
|---|---|
Integration blind spots | Anything not natively integrated (physical security, supplier due diligence, HR screening, many People and Physical controls) still needs manual evidence — teams sometimes forget this and leave gaps |
False confidence from green dashboards | A "compliant" status in the tool reflects a configuration snapshot, not whether the control is operating effectively in context — Kestrel Freight Logistics' story below is a direct example |
Integration maintenance burden | API tokens expire, systems get replaced, integrations silently stop syncing — someone has to actively monitor tool health, not just trust it |
Evidence without narrative | Auditors still expect a coherent story connecting evidence to risk treatment decisions; a pile of auto-collected logs without that narrative can actually slow an audit down |
Vendor dependency risk | If the vendor has an outage, pricing change, or acquisition during your audit cycle, your evidence trail's availability depends on a third party |
"Automated evidence collection is one of the best things to happen to audit prep in a decade. It's also the fastest way to convince yourself you're compliant when all you've actually automated is the paperwork. The two are not the same, and I've seen smart teams forget that." — Priya Natarajan, CISO, Alderbrook Health Systems
Build vs Buy
A smaller but recurring question, particularly from engineering-heavy organizations: should we build our own internal tooling — a lightweight internal dashboard, a set of scripts pulling evidence into a shared repository — rather than buying a commercial platform?
Factor | Build In-House | Buy Commercial Platform |
|---|---|---|
Upfront cost | Engineering time (often underestimated) | License fee, known upfront |
Ongoing maintenance | Falls on your engineering team indefinitely | Vendor's responsibility (mostly) |
Customization to your exact workflow | Full control | Limited to vendor's configuration options |
Auditor familiarity | None — auditors see it for the first time with you | Often already familiar with major platforms |
Multi-framework mapping | You build every mapping yourself | Often pre-built |
Risk if key builder leaves | High — tribal knowledge risk | Low — vendor support continuity |
Best fit | Engineering-heavy orgs with strong internal tooling culture and narrow, well-understood scope | Most organizations, especially those without spare engineering capacity |
My honest read after watching a dozen or so build-vs-buy decisions play out: building your own tooling rarely pays off unless you already have a strong internal platform engineering culture and a genuinely narrow, stable scope. The teams who do it well treat it as building an internal evidence-repository utility, not a full GRC replacement — and they still keep their actual risk register and policy documents in more conventional, portable formats.
Getting Team Adoption Right (Not Just Buying the Tool)
Even a well-chosen tool fails if the people who need to use it daily never actually adopt it — and this is a change-management problem, not a procurement problem. I've watched organizations spend six figures on a platform that a majority of control owners quietly avoided in favor of the spreadsheet they were already comfortable with, because nobody built adoption into the rollout plan.
Adoption Risk | What Causes It | What Actually Fixes It |
|---|---|---|
Control owners keep working in old spreadsheets "on the side" | No formal migration deadline or retirement of legacy files | Set a hard cutover date, revoke edit access to the old file, and communicate it clearly |
Only the compliance team logs into the platform | Tool rollout treated as a compliance-team initiative rather than an org-wide one | Involve control owners in tool selection and require them to demo their own evidence upload during rollout |
Evidence uploaded inconsistently or late | No clear cadence or reminder discipline | Use the tool's own workflow/reminder features rather than manual chasing — this is genuinely one of its best uses |
Leadership never opens the dashboard | Management review wasn't redesigned around the new tool's reporting | Rebuild the management review agenda template around what the tool can now show in real time |
New hires never trained on the tool | Onboarding materials weren't updated after purchase | Add tool training to new-hire security awareness onboarding, not just a one-time launch announcement |
The uncomfortable truth is that most "the tool didn't work for us" stories I've been asked to help unwind were actually "we never got the organization to use it" stories. Vendors will rarely tell you this during the sales cycle, because adoption isn't something a demo can prove — it's something only your own rollout discipline delivers.
Common Pitfalls
Pitfall 1: Tool Sprawl
I regularly meet organizations running a GRC platform, a separate risk register tool, a separate policy management system, and a spreadsheet nobody officially owns anymore because someone started it before the platform was purchased and half the team never migrated off it. Each tool was individually justified at purchase time; together they create duplicated data entry, conflicting "sources of truth," and an audit trail that's scattered across systems the auditor now has to be walked through one by one.
Symptom | Root Cause | Fix |
|---|---|---|
Same risk documented differently in two systems | No designated single source of truth | Pick one system of record per artifact type and formally retire the others |
Control owners unsure which tool to update | Unclear ownership handoff during a tool migration | Publish a one-page "where does this live now" map and retire old links |
Auditor confused about which evidence is current | Evidence spread across multiple platforms without cross-referencing | Consolidate evidence indexing even if source systems stay separate |
Renewal costs stacking up across multiple overlapping tools | Tools purchased reactively, one pain point at a time, without a portfolio review | Annual tooling review tied to renewal dates, not just budget cycle |
Pitfall 2: Over-Reliance on Automation
The mirror image of tool sprawl is treating an automation platform's dashboard as the finish line. A green checkmark next to a control in a compliance-automation tool means an integration successfully pulled a data point — it does not mean the control is effective, appropriately scoped, or operating the way your policy says it should. I've sat in management reviews where the entire risk conversation consisted of scrolling through a dashboard rather than discussing whether the treatment plans were actually working. That's a management review in name only.
Pitfall 3: Tool as Substitute for the ISMS
This is the pitfall that sank Calloway Diagnostics in the cold open, and it's the most expensive one because it's invisible until an auditor finds it. It happens when a team equates "the software says we're compliant" with "we are compliant" — skipping the actual risk-owner conversations, actual management review discussions, and actual verification that documented procedures match real operational practice. No platform, regardless of price, performs that verification for you. The ISMS is the organization's actual behavior; the software is, at best, a faithful record of it.
"The single question I ask every client considering a platform purchase: if the software vanished tomorrow, would your ISMS still exist? If the honest answer is no, you don't have a management system — you have a very expensive filing cabinet." — Renata Silva, Founder, Silva Compliance Consulting
Pitfall 4: Ignoring the Controls Software Can't Reach
Because compliance-automation platforms make cloud and identity-related evidence so visible, teams sometimes let that visibility crowd out attention to the roughly one-third of Annex A that isn't API-observable at all — People controls, most Physical controls, and large parts of Organizational controls like supplier due diligence and legal/regulatory tracking.
Control Area | Why It Resists Automation | What Still Has to Happen Manually |
|---|---|---|
Screening and HR processes (6.1–6.2) | Background checks and employment terms are one-time, judgment-based HR actions | HR must retain and produce records; no integration substitutes for the actual check |
Physical entry and office security (7.1–7.3) | Badge logs may be digital, but physical walkthroughs and visitor sign-in discipline aren't | Periodic manual physical security review, documented and evidenced |
Supplier relationship security (5.19–5.23) | Contract review and supplier risk assessment are relationship-based, not system-based | Manual due diligence records, contract clauses, and periodic supplier reviews |
Legal, statutory, and contractual tracking (5.31) | Regulatory obligations change through legal research, not system telemetry | A maintained legal/regulatory register, reviewed on a schedule |
None of this is a reason to avoid automation — it's a reminder to budget real attention (and, if needed, separate lightweight tooling or simply disciplined manual process) for the roughly one-third of your control set no automation platform will ever touch.
What Auditors Actually Look At, Regardless of Tooling
Whatever platform (or spreadsheet) you use, certification body auditors are ultimately verifying the same things. Understanding this list before you buy anything reframes the entire purchasing decision around evidence quality, not software features.
Auditor Focus Area | What They're Really Checking | Tool-Agnostic Evidence Needed |
|---|---|---|
Risk assessment integrity | Were risks genuinely assessed by people who understand the assets, not auto-populated from a template? | Interview consistency with documented risk register |
Control implementation | Does the documented control match operational reality? | Interviews, system walkthroughs, sampled records |
Management commitment | Is leadership genuinely engaged, per Clause 5 leadership requirements? | Management review minutes with real decisions, not attendance logs |
Internal audit quality | Were internal audits substantive, per your internal audit program? | Internal audit reports with findings and follow-through, not a checklist with all "pass" |
Document control | Are documents version-controlled and appropriately approved, per document control practices? | Version history, approval records — tool or no tool |
Evidence traceability | Can a specific control be traced to specific, dated, real evidence? | Consistent, retrievable evidence regardless of storage medium |
None of these rows require a specific software category. They require diligence. A tool can make diligence faster to document; it cannot manufacture the diligence itself.
Case Study 1: Certified on Spreadsheets, No Platform Purchased
Solvent Robotics, a 22-person industrial robotics startup, needed ISO 27001 to close a major automotive-sector contract. With a tight $40,000 total compliance budget and no dedicated compliance headcount, founder-led leadership made an early decision to run the entire ISMS on Google Workspace: a shared-drive folder structure for documents, a single well-maintained Google Sheets risk register with data validation rules to prevent scoring inconsistency, and a lightweight project tracker for control implementation tasks. Dana Okafor, brought in as fractional Head of GRC three months into the project, resisted pressure from a board member to "just buy a platform to look more serious to auditors."
Metric | Result |
|---|---|
Total ISMS tooling spend | $0 beyond existing Google Workspace subscription |
Time to certification | 5 months from kickoff to Stage 2 pass |
Total certification project cost | $18,400 (consulting, audit fees, minor training) |
Stage 2 audit outcome | Zero major nonconformities, one minor observation on document review cadence |
Post-certification maintenance effort | Approximately 6 hours/month for register upkeep |
The lesson wasn't "never buy software" — it was that a 22-person single-scope organization with disciplined ownership had no automatable evidence gap large enough to justify a platform's cost, and the auditor never once asked what tool they used.
Case Study 2: Tool Sprawl and Over-Reliance Create Nonconformities
Kestrel Freight Logistics, a 260-person logistics and freight-brokerage company, purchased a compliance-automation platform eighteen months before their Stage 2 audit, layering it on top of an existing document management tool nobody formally retired. Information Security Manager Tomas Vrba inherited the program mid-cycle and found two parallel risk registers, evidence for some controls only in the old tool, and a team that had started treating the automation dashboard's "green" status as proof of control effectiveness without reviewing the underlying data.
Metric | Result |
|---|---|
Tools in use at audit time | 3 (legacy doc tool, new automation platform, an unretired shared spreadsheet) |
Stage 2 audit outcome | 3 minor nonconformities, all related to evidence inconsistency across tools, not control failures |
Remediation timeline | 6 weeks |
Remediation cost | Approximately $22,000 in consulting and internal labor to consolidate systems and re-document evidence trails |
Post-remediation change | Retired legacy tool entirely, appointed single evidence owner |
The nonconformities here weren't about weak security — the underlying controls were reasonably sound. They were entirely about tool sprawl obscuring a coherent evidence trail, which is exactly the kind of finding that's preventable with a portfolio review, not more software spend.
Case Study 3: A Platform Purchase That Actually Paid Off
Bramwell Insurance Group, a 340-person specialty insurer managing ISO 27001 alongside SOC 2 and state-level regulatory obligations, evaluated a compliance-automation platform specifically to address a documented pain point: their four-person compliance team was spending roughly three weeks per quarter manually re-collecting near-identical evidence for two overlapping frameworks. CISO-equivalent leadership ran a structured pilot against the selection criteria in this article, confirmed integration coverage against their actual cloud and identity stack, and negotiated a contract with an explicit data-export clause before signing.
Metric | Before Platform | After Platform (12 months) |
|---|---|---|
Quarterly audit-prep labor | Approximately 120 hours | Approximately 35 hours |
Evidence reused across ISO 27001 and SOC 2 | Minimal, mostly manual duplication | Roughly 60% of evidence mapped and reused across frameworks |
Annual platform cost | N/A | $46,000 |
Estimated labor cost saved annually | N/A | Approximately $34,000 (at loaded compliance-team rates) |
Stage 2 / SOC 2 audit outcome | N/A (baseline year) | Clean SOC 2 report; ISO 27001 recertified with one minor observation |
Bramwell's case is the honest counterpoint to Calloway's cold open and Kestrel's stumble: the platform paid for a meaningful share of its own cost in labor savings, specifically because the buying decision was driven by a quantified, pre-existing pain point and a genuinely automatable evidence gap — not a belief that the software itself would produce compliance.
"We didn't buy the platform to become compliant. We were already compliant, running a slower manual process. We bought it because the math on labor hours actually worked, and we could prove it a year later." — Ben Ostrowski, VP Engineering, NimbusPay
Signs You've Outgrown Spreadsheets
Spreadsheets fail gracefully at first and then fail suddenly — the pain doesn't scale linearly with headcount, it hits a threshold. These are the signals I tell clients to watch for rather than guessing based on employee count alone.
Signal | What's Actually Happening |
|---|---|
More than one person routinely edits the risk register simultaneously | Version conflicts and silent overwrites become a real risk to data integrity |
Control owners can't find the current version of "their" evidence without asking someone | Document control has broken down informally, which is itself an audit finding waiting to happen |
Quarterly evidence collection takes more than a week of someone's time | The manual labor cost may now exceed a tool's license cost |
You're running two or more frameworks (e.g., ISO 27001 and SOC 2) with largely duplicated evidence | Reuse-through-mapping becomes valuable, not just convenient |
Management review meetings spend more time reconciling data than discussing decisions | The reporting layer, not the underlying process, has become the bottleneck |
New hires take weeks to understand "where things live" | Institutional knowledge is trapped in tribal memory rather than a discoverable structure |
If none of these apply to you yet, a platform purchase is very likely solving a problem you don't have — which is precisely how Calloway Diagnostics ended up buying $84,000 of software before it had built the risk register the software was supposed to help manage.
Phasing Your Tooling Investment Across the Certification Journey
One of the most common and most avoidable mistakes is buying tooling too early — before you understand your own scope, control set, and evidence workload well enough to evaluate a vendor intelligently. Tooling decisions age better when they follow, rather than precede, a real gap analysis.
Project Phase | Recommended Tooling Approach |
|---|---|
Scoping and gap analysis | Spreadsheets or a free template are almost always sufficient — you're still learning your own control landscape |
Building mandatory documents and initial risk register | Spreadsheets or a lightweight document tool; avoid committing to an expensive platform before you know your real evidence workload |
Control implementation and evidence-building | This is when the automatable-evidence-gap becomes visible — reassess tooling needs here, not before |
Pre-Stage-1 audit prep | If you're going to buy a platform, this is the latest sensible point — give it at least 6–8 weeks of real use before the audit, not a rushed pre-audit purchase |
Post-certification / surveillance cycle | Reassess ROI annually against renewal cost and actual labor hours saved, not against the original sales pitch |
Buying tooling during the scoping phase is a bit like buying a truck before you know how much you need to move. It's not wrong in every case, but it's rarely the wisest sequencing, and it's a major reason vendor contracts get signed based on anxiety about a deadline rather than a clear-eyed read of actual need.
Vendor Lock-In and Exit Planning
A detail that gets far too little attention during the buying decision: what happens if you want to leave? Certification is a multi-year relationship with your ISMS — you'll be through at least one recertification cycle and several surveillance audits over three years — and switching platforms mid-cycle is genuinely disruptive if you haven't planned for it.
Before signing any contract, confirm in writing: full data export in an open, usable format (not just PDF snapshots); a defined timeline for export requests; whether historical audit trail and version history export with the data or are lost; and what happens to evidence integrations if you cancel mid-cycle. I've seen organizations effectively held hostage by a platform at renewal time because switching would have meant rebuilding a risk register and document history from scratch — a bargaining position no compliance team wants to be in three weeks before a surveillance audit.
Red Flags in GRC and Compliance-Automation Sales Pitches
After sitting through more vendor demos than I can count, a few sales patterns reliably predict buyer's remorse.
Red Flag | Why It Should Concern You |
|---|---|
"Our platform gets you certified in [X] weeks" | No platform certifies anyone — certification bodies do, based on your ISMS's actual maturity |
Demo focuses entirely on dashboard aesthetics, not evidence workflows | Suggests the product is optimized for buyer impressions, not auditor scrutiny |
Reluctance to name reference customers of similar size who've completed a full audit cycle | Marketing case studies without operational proof are not proof |
Pricing that scales sharply and non-transparently with headcount or integrations | Signals a renewal-cycle cost shock later |
No clear answer on data export terms | A lock-in risk disguised as a minor detail |
Sales rep implies the SoA or risk register can be "auto-generated" from a template with minimal input | A generic template is exactly what produced Calloway Diagnostics' nonconformities |
Pressure to sign before your gap analysis or scope is finalized | You cannot evaluate integration fit or evidence-automation value before you know your actual control landscape |
A Practical Buying Framework
Pulling the above together into a sequence: (1) complete your gap analysis and initial risk register before evaluating any tool, so you know your real control landscape; (2) quantify your actual pain point in hours or dollars, not vague frustration — "evidence collection takes three weeks a quarter" is a number you can build ROI math around, "this feels chaotic" is not; (3) map that pain point to the narrowest category of tool that solves it, resisting the pull toward a broader platform than you need; (4) run vendor evaluations against the selection-criteria table above, insisting on references from organizations of comparable size and complexity; (5) negotiate data portability and exit terms before signing, not after; (6) implement with a defined pilot period before your next audit, so the tool has been genuinely load-tested by your team, not just configured; and (7) reassess annually at renewal against actual, measured labor savings — not the original sales pitch.
The Strategic Close: Tooling as an Enabler, Not a Shortcut
The organizations that get the most value out of ISO 27001 — measured in genuine risk reduction, faster sales cycles, and smoother recertification — are the ones that treat software as an accelerant for a management system they've already committed to building properly, not as a way to skip the building. Grace Ferrante's story at Calloway Diagnostics isn't unusual because the platform was bad; several of the leading products in this space are genuinely well-engineered. It's unusual only in how visible the cost of the underlying mistake became — five nonconformities, an eleven-week delay, and $40,000 in unplanned remediation, all traceable to a purchase order that arrived before the risk-owner conversations did.
The inverse is just as real. Bramwell Insurance Group's platform purchase worked because it followed a quantified problem, a disciplined evaluation, and a team that already understood its own control landscape well enough to know exactly what the software needed to do. Solvent Robotics' spreadsheet-based certification worked because a 22-person team had the discipline to make manual process sustainable at their scale, and had the judgment to recognize they didn't need to buy their way to credibility.
Certification bodies, customers reviewing your security questionnaire, and regulators evaluating your program all care about the same thing: whether your information security management system genuinely functions. None of them are auditing your software stack. Get the ISMS right first — real risk ownership, a mandatory-documents set that reflects how you actually operate, a risk register that's genuinely maintained, and a project team with clear ownership — and then let the tooling decision follow from real, quantified pain points rather than anxiety about a deadline.
If you're still early in scoping this decision, a structured gap analysis will tell you far more about what tooling you actually need than any vendor demo will. PentesterWorld's ISO 27001 Gap Analysis Tool is built exactly for that first step — mapping your current state against all 93 Annex A controls before you spend a dollar on software. Pair it with our Risk Scoring Calculator to pressure-test whether your risk methodology genuinely needs a dedicated tool, or our free ISO 27001 Risk Register Template if you've decided spreadsheets are the right call for now. If you're weighing the full budget picture, including where tooling should sit relative to consulting and audit fees, run the numbers through our Certification Cost Calculator, and for a complete phase-by-phase view of the certification journey — tooling decisions included — download our Complete ISO 27001 Implementation Guide eBook. Whatever you decide to buy, or not buy, the standard was never grading your software. It's grading you.