The first risk analysis that doesn't stand still.
Lucy, our own AI, builds it with you in an afternoon and, from then on, it recalculates itself. Your route tells you what's next, your SoA adapts to your company and your suppliers stay monitored. All in Spain: your data never leaves our data centre.
✓ No card on Basic · Same-day activation · Local AI: your data never leaves our data centre
Meet Lucy
Lucy is our AI. She lives in Spain and works only for you.
Lucy is GRC GO's artificial intelligence. We've trained her for one thing only: security, risk and standards (ISO 27001, ENS, NIS2, MAGERIT). She's the companion who guides you through Vigía.
See it
Six screens. Your whole risk cycle.
No abstract promises: this is what you'll use from day one. Click each step or let it play.
My route Route B Guided mode
21 controls undecided · then «Treatment» and the «BIA» branch unlock.
Go → See all routesAssets 37 + Add
| Asset | Type | C · I · A · Au · T | Risks | Owner |
|---|---|---|---|---|
| Online shop | Service | AAAMA | 9 | Laura P. |
| Customer DB | Data | AAMAA | 7 | Laura P. |
| ERP | Software | MAMMA | 6 | Jorge M. |
| External service · Cloud | External service | MMAMM | 5 | Jorge M. |
| Laptops | Equipment | MBBBB | 4 | — |
R-058 · Ransomware on the online shop Inherent high Residual medium
Malicious encryption · Online shop, Customer DB
AssessmentLikelihood 4 · Impact 5
A.8.13 BackupsA.8.7 MalwareA.5.24 Incidents
+ Search Suggest with AISoA ISO 27001ENS mediumNIS2
| Control | Maps to | Applies | Status | Risks |
|---|---|---|---|---|
| A.8.13 Backups | mp.info.6NIS2 21.2.c | Yes | Implemented | R-058R-012 +2 |
| A.8.7 Malware protection | op.exp.6 | Yes | Partial | R-058R-031 +4 |
| A.8.25 Secure development | mp.sw.1 | No | — | no in-house dev |
| PRIV.1 Record of processing custom | GDPR art. 30 | Yes | Partial | R-040R-047 |
There is customer data and the online shop is critical (RTO 8 h).
Treats 4 risks: R-058 RansomwareR-012 Accidental deletionR-031 Disk failureR-044 Supplier error
Suppliers 6
| Supplier | Criticality | Assessment | Reassessment |
|---|---|---|---|
| SaaS cloud | Critical | 72 · Conditional | due in 30 d |
| Payment gateway | High | 86 · Approved | up to date |
| Web hosting | High | Not assessed | — |
| Accountants | Medium | 81 · Approved | up to date |
32 questions (Lucy added 1, skipped 0) · 2 dated actions
A.5.23 is run by SaaS cloud → amber. «Web hosting» not assessed: «verified» not allowed.
Home 2 indicators out of threshold
186.000 € −38 % with the plan
31/48 risks with data
PDF · 24 pages · ready for management
Download PDF CSVStandards
One analysis, all your standards
Basic plan: one standard (27001 or ENS) · Advance plan: up to three · Pro plan: all.
Living SoA
Fit the SoA to your company. Not your company to a generic SoA.
ISO 27001's 93 controls are the starting point, not the ceiling. Your SoA is proposed from your assets, explains every decision, covers several standards with the same control and adds what no standard includes.
Generic SoA
- 93 identical rows for every company
- «Applies» to secure development… even if you don't develop
- One spreadsheet per standard; none match
- Nobody knows which control treats which risk
- New standard = start from scratch
Living SoA
- Proposed from your assets, with the reason why
- One control covers 27001, ENS and NIS2 at once
- Custom controls: privacy, AI, notification
- Each control shows which risks it treats
- Approved versions that can't be altered
Applicability 72/93
The ones you wrote by hand stay untouched.
| Control | Proposal |
|---|---|
| A.8.25 | N/A no in-house development |
| A.7.4 | Applies 2 sites with physical access |
| A.5.23 | Applies cloud services |
Suppliers
The risk that comes in through someone else's door
If your supplier fails, the problem is yours. Vigía tells you how much you depend on each one, checks whether they can be trusted and warns you when they no longer can.
How much do you depend on them?
Lucy asks you 4 questions and scores it.
Critical reviewed every 6 months
From Basic planCan they be trusted?
A tailored questionnaire: Lucy removes what doesn't apply and tells you what to ask for.
32 questions · 15 minutes
From Advance planA clear score
Same rule every time. Once signed, it can't be edited.
2 dated improvements
Serves as evidence for the auditor
From Advance planAlerts you if it changes
Their certificate expires or there's news about them: you know, and so does your SoA.
Until they're fit, the control can't be marked as verified
From Advance planImpact
Speak management's language: hours and euros
Management doesn't want colour matrices. They want to know two things: how long the company can stay down and how much money is at stake.
How long can you stay down?
Example: your online shop goes down.
How much money is at stake?
What your risks would cost you on average in a year. And how much it drops if you follow the plan.
Monitoring
An analyst who never sleeps
CCN-CERT and INCIBE alerts, exploited vulnerabilities and news from your sector, cross-checked against YOUR inventory. If it doesn't affect you, it won't bother you; if it does, your risk is recalculated and you're told why.
Cross-checked with your assets
Every alert is compared with what you have. Includes exploited vulnerabilities (KEV). Weekly review.
Daily, with geopolitics
Daily review, attack trends, a radar for your sector and crises in the countries of your sites and suppliers.
Plans and pricing
Three plans, three stages of your company
Prices exclude VAT. What your plan doesn't include is shown locked, and if you downgrade nothing is deleted.
Basic
Do your first risk analysis and find out where you stand.
Advance
Get certified and stay compliant without spreadsheets.
Pro
Risk in euros, continuity and several companies in one place.
Compare in detail
| Basic | Advance | Pro | |
|---|---|---|---|
| The basics | |||
| Standards | 1 (27001 or ENS) | 3 (27001 + ENS + NIS2) | All |
| Analysis review | Manual, once a month | Automatic, weekly | Automatic, daily |
| Organisations | 1 | 1 | Multiple (groups, consultants) |
| Lucy | |||
| Interview and proposed assets and risks | ✓ | ✓ | ✓ |
| SoA applicability | Manual | With Lucy, with the reason why | With Lucy, with the reason why |
| Import the SoA you already have | — | — | ✓ |
| SoA and risks | |||
| Approved SoA versions | — | ✓ | ✓ |
| Indicators (KRIs) | Visible, locked | 14 indicators | 14, with your own thresholds |
| Downtime hours (BIA) | — | ✓ | ✓ |
| Risk in euros | — | — | ✓ |
| ISO 22301 continuity | — | — | ✓ |
| ISO 42001 AI governance | — | — | ✓ |
| Suppliers and monitoring | |||
| Suppliers | Registration and criticality | + Assessment and alerts | + Report and AI questions |
| Monitoring | Headlines | Cross-checked with your assets | Daily + geopolitics |
| Service | |||
| PDF/CSV reports | 1 CSV a month | 5 a month | Unlimited |
| Support | Community | Priority | |
FAQ
What people ask us before getting started
Do I have to redo my SoA?
No. On Pro you import it and Vigía reconciles it with the catalogue; on Advance you start from yours as a reference in route B.
Where are my data and the AI?
In our data centre in Spain. The AI is our own and runs locally: your data never leaves and trains no one.
What happens if I downgrade?
Nothing is deleted. Whatever your plan no longer includes becomes read-only until you upgrade again.
How do the 6 free months work?
Advance starts with 6 months free and same-day activation, no sales calls. Everything you created on Basic is kept when you upgrade.
Questions? Write to us
No sales reps, no calls: we reply in writing within 24 working hours.
Submissions are sent via FormSubmit (USA) to info@grcgo.com. Details and your rights in the privacy policy.
By sending you accept that we process your data only to reply to you. Rights: info@grcgo.com.
Your analysis starts today. And it never expires again.
Fifteen minutes with Lucy and you will have your inventory, your risks and your report. No sales reps, no demos: free, or with your plan active the same day.