Syntak Security suite

Syntak GRC · Features

Everything Syntak GRC does.

Syntak GRC keeps controls, policies, risks, evidence, and recurring audit work in one place, with an owner, an approver, and a history on everything. Here is what it does today.

Sign up for Syntak GRC Back to Syntak GRC 45 features in 9 areas
modules, each switchable per organization
11
starter policies, plans, and charters
23
ISO 27001:2022 control codes in the lookup
98
live data connectors
4
impact and likelihood scoring scale
1 to 5
01

Controls and statement of applicability

Know which controls apply, why, and how far along each one is.

  • Control catalog

    Each control has a code, description, category, owner, and justification.

  • In or out of scope, with a reason

    Mark each control included or excluded and record why.

  • Implementation status

    Track controls as implemented, partially implemented, not implemented, or not applicable.

  • Approval workflow

    Move controls from draft to approved, with revision history and content hashes. Bulk approve and bulk assign owners.

  • Statement of applicability snapshots

    Freeze the statement of applicability with a label and note, and export it to Excel.

  • ISO 27001:2022 control lookup

    Look up control codes by title across 98 ISO 27001:2022 entries.

02

Policies

A policy library with real approval and version history.

  • Starter library of 23

    Start from 23 policies, plans, and charters, then edit them for your organization.

  • Section editor

    Add, reorder, and edit the sections of a policy.

  • Framework mapping

    Map each policy to ISO 27001 or SOC 2 control references.

  • Approve and publish

    Approval publishes an immutable version, and earlier revisions are kept.

  • PDF export

    Export any policy as a PDF.

03

Risk register and business impact

Score risks the same way every quarter, and show how they change.

  • Scored risk register

    Score impact by likelihood on a 1 to 5 scale, with inherent and current risk.

  • Treatment plans and remediation tasks

    Plan treatments and track remediation as not started, in progress, or complete.

  • Quarterly registers with review

    Submit a register for review, approve it, return it to draft, reopen it, or cancel and restore it.

  • Snapshots, trend, and exports

    Keep approved snapshots, see a risk trend over time, and export to Excel and PDF.

  • Business impact analysis

    Score processes on financial, operational, compliance, and reputation impact plus dependencies, and run it as quarterly assessments.

04

Evidence and audit readiness

Collect proof as you go, so an audit is a download instead of a scramble.

  • Evidence library with review

    Upload files with secure links, and approve or reject each item.

  • Refresh dates

    Every item has a refresh due date, and overdue items and those due within 30 days are flagged.

  • Evidence from other modules

    Approved snapshots from other modules flow into the library as evidence, due for refresh 365 days after collection.

  • Close a compliance window

    Preview and close an audit window, tagging the evidence as closed.

  • Browser capture extension

    Capture the active tab as screenshot evidence certified with a hash.

  • Evidence export package

    Export the evidence for an auditor in one package.

05

Tasks and accountability

The recurring work of a security program, with owners and a record that it happened.

  • Recurring audit tasks

    Schedule weekly, monthly, quarterly, annual, or one-time tasks for asset inventory, access reviews, vendor reviews, policy reviews, or anything custom.

  • Completion records and alerts

    Record each completion, and get due and overdue alerts by email.

  • Owners everywhere

    Assign owners to controls, risks, policies, tasks, and exceptions.

  • Field-level history

    See what changed, who changed it, and who approved it, on every module.

  • Security program objectives

    Track ISO 27001 clause 6.2 objectives and KPIs, and link KPIs to recurring tasks.

06

Access reviews and exceptions

Prove that access was reviewed, and that every exception was accepted on purpose.

  • Quarterly access review registers

    List your systems each quarter and record five checks for each: privileged access, standard users, shared accounts, least privilege, and separation of duties.

  • Per-system approval and remediation

    Approve each system, note issues and remediation steps, and export the package to Excel and PDF.

  • Exceptions register

    Record time-boxed risk acceptances with justification, compensating controls, and residual risk.

  • Exception workflow

    Move exceptions from draft to submitted, approved, rejected, expired, or revoked. An approval comment is required, and a material edit to an approved exception sends it back for review.

  • Expiry warnings and Jira links

    Exceptions expiring within 30 days are flagged, and each can carry a Jira key and link.

07

Assets, people, and vendors

An inventory that fills itself in from the systems you already use.

  • Asset inventory

    Keep an inventory with asset types you configure.

  • Live connectors

    Sync endpoints from Jamf Pro, AWS inventory from Wiz, virtual machines, databases, storage, and networking from Azure Resource Manager, and vendors from Locktivity, with a credential test, on-demand sync, and run history for each.

  • Vendor list List, not a risk workflow

    Keep third-party vendors as an asset type fed from your connector, and schedule vendor review tasks.

  • Personnel directory

    Keep an org chart, performance review files, and org-chart snapshots as PDF.

08

Reporting and exports

Hand people the document they asked for.

  • Home dashboard

    See what needs attention, what is coming up, and what is waiting for approval.

  • PDF reports

    Export business impact analysis, risk register, controls, policies, access review, personnel, and security program reports.

  • Excel import templates

    Import your existing business impact analysis, risk register, controls, policies, assets, and personnel from Excel templates.

09

Access, security, and API

Role-based access with an API for your own automation.

  • Roles for each module

    Give people admin, approver, editor, viewer, or owner access to each module separately.

  • Password rules

    Passwords need at least 12 characters with upper case, lower case, a digit, and a special character.

  • Personal API keys

    Create keys with an expiry, bound to your organization.

  • OpenAPI documentation

    A public OpenAPI description and endpoint catalog document the API.

  • Tenant isolation

    Postgres row-level security keeps each organization's data separate.

  • Organization console

    Product admins create and open customer workspaces.

Syntak GRC

Start with Syntak GRC.

Run governance, risk, and compliance as an accountable security operating system.

Sign up for Syntak GRC See pricing