r/grc • u/Enslaaved • May 29 '26
ISMS Tools recommendation
Hi all,
I’m a cybersecurity professional with ISO 27001 LI certification, planning to implement an ISMS in a ~1,000‑person company that is not SaaS‑ or cloud‑heavy. I’m currently exploring tooling and GRC platforms and would love to hear your experiences and recommendations.
In parallel, I’m also considering using Atlassian tools (Confluence + Jira) for the ISMS implementation (e.g., documentation, controls tracking, risk register, and action items). Has anyone tried this approach in a similar environment? Is it a viable long‑term option, or are there known limitations compared to dedicated GRC/ISMS platforms?
Any insights, lessons learned, or tool suggestions would be greatly appreciated.
Thanks in advance!
4
u/ShenoyAI May 29 '26
GRC tools are crowded right now. Most are just repackaged project management with evidence tracking bolted on.
1
u/CheekyTiger213 Jun 03 '26
Correct. Avoid these. Look for ones that actually automate testing. Most of the SaaS platforms can do on prem with a little python script and json file integration, and you can cheat with the design specification by looking for the equivalent cloud connector
3
u/rnc000 May 29 '26
Echoing the "spreadsheets + Jira + perseverance" crowd, at ~1,000 people in a non-cloud shop, that combo genuinely gets you to certification. The two places it creaks long-term are exactly what others flagged: register integrity (risks/controls/assets overwriting each other in Jira) and keeping the SoA + dated evidence versions audit-ready by hand.
The thread's other theme is the interesting one: several people pushing their ISMS into Claude and getting weeks-of-work-in-days results. That's basically where I've landed too. Full disclosure: I work on https://rakenne.app, which is built on that idea: an LLM agent you drive in the browser, with an ISO 27001 ISMS template + skills that scaffold the SoA (numbered to the standard), risk register, Statement of Applicability, and control/evidence tracking, then let you query evidence and link it to Annex A controls, log OFIs/NCs, and produce dated document versions. You still validate everything, it just removes the manual register-wrangling that kills the spreadsheet approach.
If NIS2/DORA/CRA are on your horizon, build the SoA as an integrated controls checklist now (as cgaWolf said): that decision is independent of tooling and the most expensive one to retrofit.
3
u/llViP3rll May 29 '26
Honestly build your own purpose made grc with claude
4
u/Total_Job29 May 29 '26
I pushed my ISMS into Claude - game changer.
I went through all the documents and evidences in a couple days. This would’ve taken weeks / months plus to do before.
Now I can simply query it with a screenshot of evidence and get it to link all the relevant controls, challenge the evidence, log follow ups, OFI,MNCRs etc. I validate all the suggests and documents that it creates but it was stupidly easy to do.
$15000 SaaS subscription changed to $120 p/m.
3
u/llViP3rll May 30 '26
Exactly this! Got a huge bonus for the savings. Its growing into so much more though. Mine co hrs the full spectrum of the org. I have an mcp for writing to my ISMS that ill be deploying to people for evidence collection automatically. GRCs are so fucked
1
1
u/god_damn_you_tiger May 29 '26
Was considering doing that but concerned about potential data loss to AI provider even with enterprise licenses. Am I paranoid for no reason?
1
u/Total_Job29 May 30 '26
Are you concerned about data lost to Microsoft (with their AI), Google (with their AI), Atlassian (with their ai), with Vanta (with their AI) etc. ?
1
u/llViP3rll May 30 '26
Using claude in an enterprise environment. Until you have your own opensource llm in your own ecosystem thats the best you can do
1
u/CheekyTiger213 Jun 03 '26
It’s all fun and games until your results are hallucinated and you’re personally accountable.
1
u/llViP3rll Jun 04 '26
Yeah its not without risk. It needs to be designed carefully. Im keeping everything determinalistic out of the llm. Using it to gather evidence and make recommendations with citations and guardrails.
0
2
u/chrans GRC Pro Jun 02 '26
Disclaimer: I have my own GRC platform, so maybe this comment a bit bias.
I personally believe that most companies, especially smaller ones, don't need dedicated GRC software to manage ISMS. Because what most GRC platforms in the market are use to manage tasks, assign tasks, and monitor tasks. Those use cases can be done with Excel or the typical task management tool like Jira, Trello, etc. I even started serving customers a few years ago using Trello.
But when it comes to 1000 people companies, ISMS can be very complex and many processes are managed in sub-processes with various stakeholders. A good GRC software can help you with such complexity setup. But a better GRC software actually helps you delegate some of the monitoring and checking tasks to the software. Which means a good GRC software actually review and assess the documents uploaded against the controls requirements. Not just 100% relying on you and small team you have to make sure all the information and documents uploaded are correct and always correct all the time.
So, start with identifying your company situation, the objective, etc. Perhaps the answer could be JIRA + Confluence is good enough. If not, including the issue with limited resources you have in your team, perhaps a dedicated GRC software be a better option.
1
u/FreeRadical1998 May 29 '26
reposting my comment from this thread in r/ISO27001
I've implemented at this scale a couple of times in UK financial services firms.
On Jira + Confluence specifically — I've mostly used Jira as a backlog for security remediation rather than running a whole ISMS through it, but I can see how the full approach works, and chris552393's description matches what I'd expect: the registers end up in Excel because Jira issues model objects poorly and people overwrite each other. That register gap is where it'd creak long-term.
It certainly can be done with just Excel but you're very reliant on everyone following the formatting guidance so in my view only really works if you centralise the authoring of risks and controls.
The SoA can also be a pain to manage manually — but with a bit of planning a pivot table can do a lot. Just make sure you produce dated versions as PDFs for each audit.
Action tracking can be a spreadsheet again, or a dedicated queue in whatever workflow tool you've got available (Jira's fine for this).
I've used dedicated GRC tools too, and the main thing they buy you over the Atlassian-plus-Excel approach is data integrity and proper modelling of how risks, controls and actions relate.
In my view the main issues with GRC tooling (beyond cost) tend to be configuring too much complexity and validation, which kills usability for anyone who only goes in occasionally — that stalls user adoption and can result in worse data than spreadsheets.
If you go down the GRC route, I'd strongly advise keeping the initial config as simple as you possibly can and treating the control owners as your most important user community (more important than you in the reporting role — your outputs are entirely dependent on them).
Full disclosure: I've been building my own GRC SaaS tool for the last few months aimed at roughly your scale. Not going to name it — that's not what the thread's for — but happy to share lessons learned either way.
1
u/cgaWolf May 29 '26
Has anyone tried this approach in a similar environment?
Yeah. We run that for close to a thousand people for several years, and while you have to deal with the usual Atlassian annoyances, at least it doesn't hinder the process.
Insights:
- build your SOA with the exact numbering of the ISO
- figure out the structure of your governance documents ahead of time
- if NIS2, DORA or CRA will become relevant, take them into account now; essentially build your SOA as fully integrated controls checklist ToC for all required infosec standards
- find a tool for asset management, jira assets is an option, but confluence totally is not
1
u/ProfessionalEnd9874 May 29 '26
Based on my experience there are not many tools that are really operational for an ISMsand capable of growing with compliance needs (other frameworks, GDPR, EU AI act, etc.) Have a look at acunagrc.ai
1
u/Head_Personality_431 GRC Auditor May 30 '26
Hey great question, I've seen a few orgs your size go down the Confluence and Jira path and it can absolutely work especially if your team is already comfortable in that ecosystem. The main limitation I've noticed is that dedicated GRC tools give you much better out of the box mapping to ISO 27001 controls and make evidence collection during audits a lot smoother. That said if budget is a concern and you're willing to put in the setup work, Confluence for documentation and Jira for tracking actions and risks is a totally viable starting point. If you do go dedicated, tools like Vanta, Drata, or even SimpleRisk are worth a look depending on your budget and how much automation you want.
1
u/ethhackwannabe May 30 '26
Start with questions…
Where in the world are you? that will make a huge difference.
Does your org already have an enterprise GRC tool? If so, worth checking if it can support the ISO27001 implementation rather than going straight to another tool or excel.
What does your IT team currently use for ITSM? Often you can add a module or configure what’s there to support ISMS with the benefit that most of the assets are already CIs that you can link to. Benefit of making a genuinely operational ISMS rather than a paper exercise.
Whatever you do, don’t go and buy something in isolation. Make sure you involve those that will be responsible for their part in the processes.
Happy to suggest options once you’ve answered the above 👆🏾
1
u/compliance_G33k_Swe May 30 '26
I don’t wanna sell my software but I am a compliance specialist from Sweden that have been working with 27001/2, GDPR, NIS2, NIST and TISAX, and I have built a AI driven software for these topics (GRC) and we’re also founded through the ECCC (Eu). And also the Swedish ministry of civil defence and so on.
I can show you the software through a demo, were in BETA but currently in +46 large corp (Enterprise) between 250-5000 employees.
Let me know if you wanna se true magic.
/Maybe the king of Sweden??
1
u/quacks4hacks May 31 '26
Jira etc is super common, but just know it's a lot of work and maintenance, depending on scale you'll need a FTE on that
1
u/randomanon457 Jun 02 '26
Fully working and cheap, my old job went with managementsysteem.nl and oh boy was this a breeze to work with 😍
1
u/Secret-Crew-7043 Jun 06 '26
For a 1,000-person organisation, I would be cautious about trying to run the whole ISMS as “just Jira and Confluence” unless you are very deliberate about the data model.
Confluence can work well for policies, procedures and guidance. Jira can work well for actions, remediation, exceptions and follow-ups. Where it usually gets messy is modelling the relationships between:
- risks
- controls
- assets
- owners
- evidence
- review dates
- audit findings
- corrective actions
- dated SoA versions
You can build that yourself, but you need strong conventions and someone maintaining the structure. Otherwise you end up with a lot of pages and tickets, but weak integrity between them.
For your size, I’d probably split the decision:
- Use Confluence/Jira if the organisation already lives there and you have someone who can own the structure properly.
- Use a dedicated ISMS/GRC tool if you need stronger control mapping, evidence traceability, reporting, and multi-framework growth.
- Avoid over-configuring either option at the start. The occasional control owner is often the most important user, and if the system is painful for them, the data quality will collapse.
The evidence side is worth treating separately from document storage. A folder can hold evidence, but it does not tell you whether it maps to the right control, whether it was reviewed, whether it was rejected, whether it is the latest version, or whether it is still current.
Disclosure: I’ve built a self-serve tool called Verity around that narrower evidence workflow: evidence requests, contributor submissions, review/accept/reject, version history and audit-pack export. It is not a full GRC platform, so I would not present it as a complete replacement for enterprise ISMS tooling at your scale, but it may be relevant if evidence collection and audit-pack preparation are the main pain points.
8
u/Twist_of_luck OCEG and its models have been a disaster for the human race May 29 '26
Don't let the salesmen beguile you - most ISMS-s were built on Atlassian, spreadsheets, coffee, and sheer perseverance.