MetricStream

MetricStream provides connected governance, risk and compliance software, with operational resilience and business continuity as one area within a considerably wider platform. The vendor reports being ranked first in enterprise GRC by Chartis Research and named category leader across all seven GRC categories.

Being strong across all seven categories rather than in one is the relevant fact for a buyer, because the argument for connected GRC rests on breadth. The premise is that risk, compliance, audit, cyber and resilience are the same underlying information viewed by different teams, and that maintaining them separately produces contradictory answers to the same question. A control tested by internal audit, monitored by compliance and relied upon in a continuity plan should be one record, not three.

Coverage spans enterprise risk, operational risk, regulatory compliance, regulatory change, case and incident management, regulatory engagement, internal audit, SOX compliance, IT and cyber risk, compliance and policy, vendor and third-party risk, and operational resilience with business continuity.

Regulatory engagement as a distinct capability is unusual and practical, covering the correspondence and interaction with regulators themselves, which in supervised industries is a substantial ongoing workload separate from compliance monitoring.

The platform layer covers cloud deployment, AppStudio for building applications, analytics, integration, a marketplace and AI. AppStudio matters because GRC requirements are organisation-specific in ways no vendor anticipates fully, and being able to build an application rather than request a feature is what prevents a platform ossifying.

Named regulatory frameworks include DORA, the UK Corporate Governance Code, UK SOX, CCPA, CMMC, COSO, HIPAA, ISO, NIST and PCI DSS. Continuous control monitoring is the current published direction. Pricing is not published.