ISO-STANDARD.app

GRC software built for UK certification, procurement and UK GDPR

Governance, risk and compliance in one workspace for UK organisations: complete ISO 27001 management-system records for your UKAS-accredited certification body, Cyber Essentials in the same crosswalk, UK GDPR-aware policies and evidence, and pricing in sterling you can start on today.

What UK buyers ask for

UKAS-ready ISO 27001 records

Clause 4–10 evidence: scope, risk methodology, SoA, internal audit programme, findings, corrective actions and management review minutes.

Cyber Essentials alongside ISO

Cyber Essentials and CE Plus requirements crosswalked to Annex A so one evidence set serves both public sector and supply chain demands.

UK GDPR operations

Supplier and transfer risk in the register, retention and access policies with acknowledgement records, incident logs and a published subprocessor list.

Group and shared-service ready

Multi-tenant workspaces with per-entity registers, roles, MFA and audit logging for groups, councils and managed service providers.

Compare the UK options

Our GRC software comparison breaks the market into five categories with typical UK costs. Also see risk management software UK, GRC platform, GRC tools, Cyber Essentials software and UK GDPR software. Need hands-on help? Our UK ISO 27001 consultancy runs alongside the platform.

Answers buyers, procurement and auditors want

What is the best GRC software in the UK?+

For UK SMEs and scale-ups certifying to ISO 27001, the deciding factors are complete management-system records for a UKAS-accredited certification body, UK GDPR handling, Cyber Essentials alignment and sterling pricing without a mandatory enterprise contract. Larger regulated groups may still need an enterprise suite for entity hierarchies and regulatory change feeds.

How much does GRC software cost in the UK?+

Roughly: enterprise GRC suites from £40,000 per year plus implementation; automation-first compliance platforms £8,000–£30,000 per year; self-serve platforms with published per-workspace pricing you can start immediately. Certification audit fees from your certification body are separate in all cases.

Does GRC software help with UK GDPR?+

It provides the operational spine — records of processing, supplier and data transfer risk in the register, retention and access policies with acknowledgement evidence, and incident and breach records. It is not legal advice, and a DPO or legal adviser should still sign off your lawful bases and transfer mechanisms.

Where is our data stored?+

Data residency, subprocessors and security posture are published in our trust profile so procurement can verify them without a questionnaire round trip.

Does it support Cyber Essentials as well as ISO 27001?+

Yes. Cyber Essentials and Cyber Essentials Plus requirements sit in the same control crosswalk as ISO 27001 Annex A, so evidence collected for one contributes to the other — useful for public sector and supply chain contracts that require both.

Is it suitable for UK public sector procurement?+

Published pricing, no mandatory sales call and a verifiable trust profile suit framework and below-threshold procurement. Multi-tenant workspaces also fit shared service and group structures.

Start your UK ISO programme today

Pre-loaded Annex A and Cyber Essentials catalogues, a working risk register within the hour, and a trust profile your buyers can verify before the first call.

Start free See pricingTalk to us

Prefer a conversation? Email hello@iso-standard.app — a practitioner responds within one business day.

← Browse guidesPricing →
AI-enabled — privacy-respecting

AI does the drafting. You keep the control — and the data.

How we handle data →

  • AI that assists — not replaces

    Assisted drafting for policies, risks, controls and buyer questionnaires. Every AI suggestion is reviewed and approved by you before it lands in the record.

  • Opt-in, workspace-scoped

    AI features run only when you invoke them, only against the workspace you're in. We never mine your data to answer someone else's prompt.

  • Your data stays yours

    Prompts routed via the AI Gateway to model providers whose API terms exclude your content from model training. Nothing is sold or shared for advertising.

  • Isolated by design

    Row-level security enforces workspace boundaries at the database. MFA, SSO, audit logs and least-privilege roles govern who sees what.

We never sell personal information, never share it for advertising, and never use your workspace content to train third-party models. Full sub-processor list and Acceptable Use Policy on the Trust page.

MM
Michael McCarroll
Founder · 25+ years
IT governance · Information security · AI
Why this platform exists

Enterprise-grade governance — built for the SMEs and consultants enterprise GRC forgets.

I've spent 25 years in corporate governance — aligning technology, controls and compliance with what the business is actually trying to do. Time and again, the same pattern: the organisations that win new clients aren't the ones with the biggest GRC budget. They're the ones who can demonstrate trust on demand. This platform is the tool I wanted for the SMEs and consultants I've worked with — institutional-grade governance without an institutional price tag, built on the way audits and buyer reviews actually happen.

Read the founder story ·See plans built for SMEs and consultants