Skip to main content
    iShieldGRC · from iShield GRC Ltd.
    iShieldGRC logo

    Governance, Risk, Compliance and Resilience. Connected by Design.

    iShield GRC connects enterprise risk, compliance, controls, assurance and specialized governance Areas through one integrated operating model—enabling informed decisions, coordinated accountability and continuous improvement.

    25 capabilities · four Areas · one eight-stage lifecycle · one governance information foundation.

    Explore the 25 capabilities
    Outcomes

    Governance intelligence for the whole enterprise

    Boards and executives need more than compliance status. They need to understand how risks, obligations, controls and disruptions relate to each other — and who is accountable for acting on them. iShield GRC organises governance around that question.

    • Enterprise-wide governance intelligence

      Risk, compliance, control, incident and assurance information is drawn from a common governance foundation and presented through Analytics Hub, giving leadership one reference point across disciplines.

    • Connected accountability

      Owners, reviewers, risk functions and internal audit work within a shared workspace, with responsibilities traceable from the first line to independent assurance.

    • Risk-informed decisions

      Risks are assessed against the controls, obligations and events that affect them, so priorities reflect actual exposure rather than isolated registers.

    • Assurance you can rely on

      Controls are defined once in the governed library and mapped to the obligations they support, so testing, evidence and findings build a consistent assurance record.

    • Organisational resilience

      Continuity, incident, safety and third-party disciplines sit beside enterprise risk, so disruption is planned for, rehearsed and learned from within the same governance model.

    Operating model

    From parallel programmes to one governance system

    Mature organisations often run risk, compliance, audit, resilience, privacy and ethics as parallel programmes. Each may be well run. Together they leave gaps between owners, taxonomies and evidence.

    Parallel programmes

    • Different taxonomies for the same risks, controls and obligations
    • Evidence requested repeatedly by different functions
    • Findings tracked apart from the risks and controls they concern
    • Regulatory change handled informally, with unclear ownership
    • Leadership reporting reconciled by hand

    One governance system with iShield GRC

    • Common definitions and taxonomies maintained in Unified Libraries / iMDTE
    • Controls mapped to the obligations and risks they address
    • Findings, issues and actions linked to their source assessments, audits and incidents
    • Regulatory change triaged and assigned as owned work in Regulatory Intelligence
    • Leadership reporting built from governed platform information in Analytics Hub

    The difference is one integrated governance operating model — connecting enterprise risk, compliance, assurance, resilience, ethics and speak-up through a common governance information foundation.

    Governance lifecycle

    One lifecycle. Every discipline.

    Each capability contributes to the same eight-stage cycle, so governance work progresses through defined stages rather than being handed between disconnected systems.

    Stage 1 of 8

    Govern

    Set direction, policies, ethics and the obligations the organisation commits to.

    • Policy Management
    • Etika
    • AI Governance
    • Regulatory Intelligence
    • Unified Libraries / iMDTE

    Stages describe how capabilities relate; each organisation configures the cycle to its own governance model.

    Architecture

    An integrated architecture, not a collection of modules

    At the centre is Unified Libraries / iMDTE — the common governance information foundation supporting shared definitions, taxonomies and governed relationships across applicable capabilities. Agent Workspace provides a shared place to work and Analytics Hub a shared view across disciplines. Area capabilities for risk, compliance and specialised governance build on this foundation where applicable, helping keep core definitions consistent.

    • Governance information foundation

      Unified Libraries / iMDTE

    • Shared platform

      Agent Workspace, iShield Studio, Analytics Hub, Nova AI

    • Area capabilities

      20 capabilities across three governance Areas

    iShield GRC operating model: core GRC, Area capabilities and shared platform intelligence arranged around one continuous governance lifecycle.
    Core GRC · Area modules · platform & intelligence, around one continuous lifecycle
    Core Areas

    Core governance and risk

    Two Areas form the backbone of most enterprise programmes.

    Risk, Resilience & Incidents (6)

    From enterprise and cyber risk to safety, continuity and loss events — one governed risk lifecycle.

    Compliance, Controls & Assurance (8)

    Obligations, policies, controls, audits and financial-reporting assurance — connected end to end.

    Specialized & Emerging Governance

    Specialised and emerging governance

    Expectations around sustainability, suppliers, personal data, AI and conduct continue to grow. iShield GRC brings these disciplines into the same lifecycle and information foundation instead of creating new silos.

    Ethics and speak-up are part of the core portfolio — Etika for codes of conduct and Veritas Talk for confidential reporting.

    Platform, Workspace & Intelligence

    Shared platform and governed AI

    Five shared capabilities support every Area. They are the foundation the Area capabilities run on, not separate business modules.

    AI that assists, recommends and acts — under governance

    Assistance
    Nova AI / Virtual AI Agent answers GRC questions from governed data and summarises risks, controls, incidents and findings.
    Recommendations and drafting
    It drafts assessments and disclosures and proposes next steps for practitioners to review.
    Permission-scoped task execution
    It can carry out tasks on behalf of users within their permissions and approved governance controls, with each action traceable. It does not act without restriction.
    Configurable human oversight and governance
    Human-in-the-loop controls and AI Governance oversight apply, configured to the organisation's policies.

    Nova AI is the assistant inside the platform. AI Governance is a separate capability for governing the organisation's own AI systems, models, use cases and related obligations.

    Responsible AI & Data Use
    Representative journeys

    Governance journeys across capabilities

    The following are representative examples of how governance work can move across capabilities within one lifecycle. Each organisation configures its own workflows.

    1. Regulatory change to assured control

      A new obligation is captured and assessed in Regulatory Intelligence and assigned an owner. The affected policy is reviewed in Policy Management, related controls are updated in Controls Management, testing and evidence are managed in Assurance & Audit, and gaps are tracked to remediation in Findings, Issues & Actions.

      Lifecycle stages: Govern (show stage in lifecycle)Identify (show stage in lifecycle)Monitor (show stage in lifecycle)Assure (show stage in lifecycle)Improve (show stage in lifecycle)

    2. Incident to stronger resilience

      An event is recorded and investigated in Incident & Event Loss Management. Its impact informs the related risk assessment in ERM or Operational Risk, affected continuity plans are reviewed in Resilience & Business Continuity, and corrective actions are tracked to closure.

      Lifecycle stages: Respond (show stage in lifecycle)Assess (show stage in lifecycle)Improve (show stage in lifecycle)

    3. Supplier onboarding to ongoing oversight

      A third party is assessed in TPRM, personal-data considerations are reviewed in Privacy & Data Protection, relevant controls and evidence are linked in Controls Management, and issues are assigned owners and monitored.

      Lifecycle stages: Identify (show stage in lifecycle)Assess (show stage in lifecycle)Monitor (show stage in lifecycle)Respond (show stage in lifecycle)

    4. Control testing to attestation

      Financial-reporting controls are tested in ICFR / SOX, deficiencies are remediated, results support sign-off in Disclosures & Attestation, and Analytics Hub provides a consolidated view for leadership.

      Lifecycle stages: Assure (show stage in lifecycle)Report (show stage in lifecycle)

    5. AI use case to governed operation

      A proposed AI use case is registered, classified and assessed in AI Governance, related risks are recorded in ERM, controls are applied and evidenced, and the use case is monitored over time.

      Lifecycle stages: Govern (show stage in lifecycle)Assess (show stage in lifecycle)Monitor (show stage in lifecycle)

    Industries

    Governance shaped by your sector

    Each industry faces its own regulators, risks and stakeholders. iShield GRC applies the same lifecycle to the obligations that matter in your sector.

    • Financial Services

      Evidence for DORA, Basel III and PCI DSS obligations, gathered as work happens.

    • Healthcare

      Patient-data obligations under HIPAA and local health laws, tracked with evidence.

    • Technology & SaaS

      SOC 2 and ISO 27001 control evidence for fast-scaling software teams.

    • Energy & Utilities

      NERC CIP and OT/ICS risk, controlled and evidenced across critical operations.

    • Manufacturing

      Supply-chain risk and ISO 27001 controls, evidenced across every site.

    • Retail & E-commerce

      PCI DSS and third-party risk evidence across every sales channel.

    • Government

      FedRAMP, NIST and data-sovereignty obligations, tracked and evidenced.

    • Education

      FERPA and student-data obligations, governed and ready to show.

    • Telecommunications

      Network-resilience and cross-border rules, evidenced in one place.

    Regulations are shown for context and do not imply certification.

    Interoperability

    Part of a connected enterprise estate

    iShield GRC is one of five iShield platforms — iShield Nexus for business and IT service management, iShield Connect for customer and partner relationships, iShield One for enterprise resource planning, iShield Link for integration and iShield GRC for governance, risk and compliance. Integration scope is defined for each environment.

    Our security and privacy commitments are set out in the Trust Center, and our approach to AI in Responsible AI & Data Use.

    Cross-platform

    Used in these business solutions

    iShieldGRC modules are composed into these outcome-led iShield solutions — each one combines capabilities across Nexus, Connect, One, Link and GRC.

    Security, Risk & Compliance

    Integrated GRC & Audit

    One control library, one evidence ledger, continuous audit across every framework.

    Explore solution
    Security, Risk & Compliance

    Workforce Identity, Access & Trust (IGA + PAM)

    Workforce JML, access reviews, privileged sessions and SoD enforcement on one fabric.

    Explore solution
    Security, Risk & Compliance

    Customer Identity & Access (CIAM)

    Passwordless, MFA, consent and progressive profiling for B2C and B2B2C journeys.

    Explore solution
    Enterprise Operations (ERP)

    Finance Transformation (Plan, Close, Report)

    FP&A, continuous close, consolidations, e-invoicing and tax on one ledger — audit-ready.

    Explore solution
    Platform & AI

    Multi-Tenant SaaS Enablement

    Tenant lifecycle, isolation, metering, entitlements and per-tenant residency for SaaS builders.

    Explore solution
    Platform & AI

    Sovereign AI Gateway & Agent Governance

    Governed LLM access, agent orchestration, prompt firewall and human-in-the-loop approvals.

    Explore solution
    Capability discovery

    Explore all 25 capabilities

    Filter by Area to find the capabilities that fit your programme. Each opens its detailed page on ishieldgrc.com.

    Platform, Workspace & Intelligence

    The shared foundation every GRC discipline runs on — one workspace, one data backbone, one analytics fabric and one AI agent.

    Back to filters
    FAQ

    Questions enterprise buyers ask

    See connected governance in action

    Tell us about your governance priorities and we will show how iShield GRC connects risk, compliance, assurance and resilience on one governance foundation.

    Request pricingContact us

    Your privacy choices

    We use strictly necessary storage to run this website. With your permission we also use first-party analytics to understand which pages are useful. Analytics stays off unless you choose "Accept all" or turn it on in "Manage". You can change your choice at any time from "Cookie settings" in the footer. See our Privacy Policy.