Disclaimer

GRC Compass publishes reference information about compliance frameworks and the vendors that automate parts of them. It is not legal advice, and it is not a determination that any organization does or does not comply with any obligation.

Regulatory obligations depend on jurisdiction, sector, company size, and the specifics of what an organization does. Consult qualified counsel before acting on anything here.

Vendor entries record public information published by the vendor. Each carries the date its listed address was last checked and the date its identity was verified against a primary source. All 123 listings are confirmed to belong to the company named beside them. Inclusion is not an endorsement, and exclusion is not a judgment. No vendor pays to appear.

Framework coverage records what a vendor claims on its own website, read from one named page on a stated date. It is not a certification, not an audit, and not an assessment of how well anything works. A framework a vendor does not claim is a framework it does not advertise, which is not the same as one the product cannot handle. The methodology page sets out what each check does and does not cover.

Where the author has a commercial interest in a company mentioned, that interest is disclosed on the page where it appears.