CyberGRX vs Secureframe: Which is a better fit?

Susan S

BIS Lead

My experience with CyberGRX was positive overall and I think this can be an important assessment tool for an organization when used in conjunction with a technical requirements questionnaire.

There was no overview of the process that warned about being prevented from retracing previous answers to adjust once further questions helped illuminate the previous ones that were confusing.

Durable record of our security posture. Also like the reuse and easy distribution of our findings.

It was a one-way process and if it was possible to redo anything, there was no apparent way to do this. These elements of the software were extremely frustrating.

Brian B

Bid Desk Manager

Great user interface, generally intuitive and user-friendly and very easy to figure out.

Overly aggressive Assessment Coordinator. You should never contact a mutual client and relay derogatory comments about response time.

As a vendor that is responding to customer due diligence requests, I like how seamless and efficient it makes the vendor response and update process.

Brian B

Bid Desk Manager

Allowing somewhat weaker passwords would be more convenient and shouldn't present any real security risks.

For a startup where SOC2 is important, but our team doesn't have budget for a dedicated security and compliance team, it was great.

There is a general lack of work management integrations so all work has to be tracked in Secureframe itself.

By the end of the audit, he said it was the best compliance tool he’d ever seen and planned to recommend it to his clients. If that wasn’t enough, their support team is fantastic.

Initial onboarding can be problematic. Sign up links should be available for 7 days vs. 24 hours as onboarding a new joiner can take longer than a day.

They are always responsive and demonstrate true professionalism. Highly recommend their services and I personally look forward to all of out future interactions.

I love how tests are cross-mapped to controls. The tests also rpovide clear guidance and instructions so providing suitable evidence and workarounds has proven quite easy.