@dianesbaker1 You still need a toolbox to track your compliance for a third party to check and issue a certificate. You can ask, "Is a GRC tool better

@dianesbaker1 You still need a toolbox to track your compliance for a third party to check and issue a certificate.

You can ask, "Is a GRC tool better than my spreadsheet"

But no matter what you have to document how you meet your security requirements.