IT GRC · ITGC · IT Operations
Run ITGC + IT operations audit
on the same platform as SOX and SOC 2
Access management, change management, computer operations, incident response, capacity, BCDR, vulnerability management, asset management — all on one engagement model. ITGC findings flow into your SOX programme; SOC 2 evidence reuses the same controls; IT-ops issues land on the same remediation tracker.
Access management testing
- Joiner / Mover / Leaver review workflow
- Quarterly UAR with data-owner sign-off capture
- Privileged access (break-glass + MFA) controls
- SoD ruleset library with violation reporting
Change management
- Production-change approval evidence capture
- Dev / production segregation testing
- UAT sign-off retention with evidence map
- Emergency-change retrospective tracker
Computer operations & resilience
- Job scheduling + batch failure investigation
- Backup execution + restore-test evidence
- Capacity & availability monitoring
- Incident management with RCA
Vulnerability + asset management
- Vulnerability program control testing
- Asset inventory accuracy assertions
- Patch SLA compliance reporting
- Pen-test register cross-linked to findings
Frameworks crosswalked
ITGC controls map across the major IT frameworks. One row in the controls library cites all of these.
COBIT 2019
ITIL 4
NIST 800-53 (AC, CM, IR, CP)
ISO/IEC 27001 Annex A
SOC 2 CC6 / CC7 / CC8
HIPAA Security Rule
PCI DSS Reqs 7-10
FedRAMP Moderate
CMMC 2.0
Stop running ITGC in three different tools
Move ITGC, IT operations, SOC 2, SOX ITGC, and ISO 27001 onto one engagement model. Evidence reused, findings unified, remediation in one tracker.