How is access controlled?
The service supports single sign-on, multi-factor authentication and password authentication. Authentication arrangements can be configured for the customer environment. Discuss your access requirements and the options applicable to your deployment during technical review.
How is information protected?
Data is encrypted in transit and at rest. Access arrangements and the way information is used should be considered alongside your organisation’s own policies, user responsibilities and assurance requirements.
Where is customer information hosted?
Customer environments are hosted within a selected Azure region, using multiple data centres in that region. Hosting location and deployment arrangements should be confirmed for the service being proposed to your organisation.
What supports availability and recovery?
The service operates backup and recovery arrangements and processes for planned maintenance and service incidents. Relevant service levels, support hours, recovery objectives and exclusions are set out in the applicable service documentation and agreement.
Discuss any recovery or data location requirements during evaluation so they can be assessed against the proposed service.
Can customers access and export their information?
Customers retain access to their data during the contract term. Excel export and API access support data retrieval, with post-termination access and deletion governed by the agreed exit provisions.
Clear responsibilities for effective use
GRC ONE provides the technology service and its associated operational support. Customers remain responsible for the accuracy and lawful use of information entered into the platform and for their own governance, risk and compliance decisions.
Frequently asked questions
Does using iGRCs certify our organisation?
No. Software can help organise controls, assessments and evidence. Certification and legal compliance depend on the organisation’s activities, applicable requirements and assurance processes.
Is the same hosting arrangement used for every customer?
The applicable region, deployment and service arrangements should be confirmed to ensure you are set up in the most appropriate hosted environment.
Can we request security information during evaluation?
Contact GRC ONE with your security and procurement questions so that the relevant service information and supporting material can be discussed.
Discuss your assurance requirements
Share your access, hosting, recovery and procurement requirements with our team.