Buying a Compliance Management Solution? Ask These Clarifying Questions First.

Looking for a compliance management system that will make your life simpler? It’s easier said than done. Every tool has a different approach to compliance management, and a completely different set of features and capabilities. You’ll also see a hundred different pricing methods.

You can make your purchasing decisions a lot simpler by doing some basic groundwork at the front end. If you understand what your company’s needs and goals are, you can filter your list of compliance solutions much quicker.

Before you start comparing compliance management products, take some time to ask yourself the following questions. At that point, you’ll have a much easier time evaluating these complex compliance software tools.

Related: Buying Compliance Management Software? Better Ask These Questions First.

Should You Use Your Compliance Assessor’s Tool?

Chances are, your Assessment firm would strongly prefer that you use their compliance management system. It’s far easier for the Assessor, and you don’t have to worry about shopping around for a tool of your own. Besides, it’s free.

While it seems to make sense to use your Assessor’s compliance management system, it’s usually a bad idea. It comes down to the fact that you likely won’t be with them forever, and when you invariably part ways, your organization is left without a systematic approach to compliance that you can use to pick up from where you left off. You’re sent directly back to square one with a horrendous data dump from their system. Don’t pass GO and don’t collect $200.

Do the work of researching compliance software for yourself. Don’t piggyback on someone else’s platform, because you never know what the future holds.

On the other hand, your Assessor may be leveraging a tool that you can actually license yourself. For example, the licensing for TCT Portal can be held either directly by you or your Assessment firm — with no difference in the functionality of the system. If your Assessor happens to take care of the licensing and you leave the Assessor, you can pick up the license and keep all of your data, without interruption.

What Compliance Standards Will You Need?

Your compliance management software should handle all of the compliance standards you currently need to meet, as well as any others that could be in your future. There are some great tools out there that specialize in one or two standards, but they can’t handle more than that. Your system should be able to expand quickly into additional certifications. 

For example, PCI DSS 4.0 is now out. Everybody who leverages a system for PCI 3.2.1 now has to figure out how to support PCI 4.0. Or, when the rules for SOC change, you don’t want to be stuck with a system that can’t quickly spin up to the new rules. Many vendors take quite some time to lumber toward supporting updated standards.

If you need to meet multiple standards, point solution tools aren’t saving you any work, because you’re duplicating or triplicating your efforts between various systems (or manual efforts). At the end of the day, they’re adding work to your plate.

Do You Need Certification Mapping?

Similarly, if you’re subject to multiple certifications, consider a compliance management tool with mapping capabilities. Mapping allows you to upload evidence once and automatically populate it in all of the locations within the certifications that require that evidence. 

For example, one of our clients is subject to five different compliance standards. Each standard requires an information security policy. With TCT Portal, they don’t have to load and reload that file across five certifications and hundreds of requirements. Instead, the various standards are mapped against each other. The client uploads the policy once, and TCT Portal knows exactly where to populate it in each of the five standards. 

Mapping saves an enormous amount of onerous manual effort and cuts down your project time noticeably. 

How Much Customization Do You Want?

Consider how much customization you need from your compliance management software. Some systems are very rigid, which lets you plug-and-play. Others are so flexible that you’re almost designing your own system. Find the approach that works best for your needs.

If you’re like most organizations, you need a system that’s robust enough to have default settings that are all set up for you. But you don’t want so much rigidity that you’re fitting into their mold. Look for options to modify parameters or to define your own control objectives and validation criteria. 

You may also want some flexibility to develop your own customizations on the side. For example, many times it’s easier to consolidate multiple evidence requests into a single list. Create the list within your compliance software, and map it to multiple certification tracks. 

Essentially, you have a customized certification for your own organization that contains only the things you need to supply. This custom list allows you to reduce all of your duplicate requirements down to only singular requests for the data. Load the data once, and it shows up on your PCI track, your ISO track, and your SOC 2 track.

What Are Your Must-have Features?

Don’t purchase any compliance management software that doesn’t have the following essential features:

• Real-time status tracking
• Built-in communication tools
• Automated notifications and accountability
• Individualized task assignments
• Ability to assign to one person or a team
• Centralized data repository
• Historical data records
• Operational Mode
• Easy report generation
• Robust data security

Not every compliance tool offers these capabilities — including data security. Don’t settle for any system that can’t provide each of these features. Otherwise, you’ll be doing more manual labor than you should.

What Will a Compliance Management Tool Cost You?

For many organizations, price is going to be a pretty substantial factor. But it’s important to remember that the price of the compliance management tool is only one portion of the equation. The software should save time and effort, cutting your operational costs. 

Consider the total ROI of any compliance management system and not just the price tag. 

In the case of TCT Portal, we wanted cost to be a non-issue for every organization. Not only did we price the system affordably, our clients are seeing 25-65% reduction in time and effort. They’re gaining back thousands of dollars per year, after the cost of the Portal.

Purchase a Compliance System with Confidence

The last thing you want is to invest in a compliance management system, load all of your data into it, and realize two or three years into it that you’ve made the wrong decision. At that point, you feel locked in. There’s just too much effort and change management involved to move to another system — not to mention justifying the expense to your CFO.

But if you use these questions to help guide your buying decision, you’ll be in a much better position to make the right investment for your organization.