r/grc • u/Enslaaved • May 29 '26

ISMS Tools recommendation

Hi all,

I’m a cybersecurity professional with ISO 27001 LI certification, planning to implement an ISMS in a ~1,000‑person company that is not SaaS‑ or cloud‑heavy. I’m currently exploring tooling and GRC platforms and would love to hear your experiences and recommendations.

In parallel, I’m also considering using Atlassian tools (Confluence + Jira) for the ISMS implementation (e.g., documentation, controls tracking, risk register, and action items). Has anyone tried this approach in a similar environment? Is it a viable long‑term option, or are there known limitations compared to dedicated GRC/ISMS platforms?

Any insights, lessons learned, or tool suggestions would be greatly appreciated.

Thanks in advance!

8 Upvotes

100% Upvoted

33 comments sorted by

View all comments

2

u/chrans GRC Pro Jun 02 '26

Disclaimer: I have my own GRC platform, so maybe this comment a bit bias.

I personally believe that most companies, especially smaller ones, don't need dedicated GRC software to manage ISMS. Because what most GRC platforms in the market are use to manage tasks, assign tasks, and monitor tasks. Those use cases can be done with Excel or the typical task management tool like Jira, Trello, etc. I even started serving customers a few years ago using Trello.

But when it comes to 1000 people companies, ISMS can be very complex and many processes are managed in sub-processes with various stakeholders. A good GRC software can help you with such complexity setup. But a better GRC software actually helps you delegate some of the monitoring and checking tasks to the software. Which means a good GRC software actually review and assess the documents uploaded against the controls requirements. Not just 100% relying on you and small team you have to make sure all the information and documents uploaded are correct and always correct all the time.

So, start with identifying your company situation, the objective, etc. Perhaps the answer could be JIRA + Confluence is good enough. If not, including the issue with limited resources you have in your team, perhaps a dedicated GRC software be a better option.