Answer page · Updated September 28, 2026
Short answer: as of September 2026 there are three ways to run governance, risk and compliance (GRC) without sending your evidence to a third-party SaaS cloud: VEDVERA by ITSECOPS, a multi-framework GRC platform that installs inside your own Microsoft 365 tenant or SharePoint Server; Microsoft Purview Compliance Manager, which is included with several Microsoft 365 plans but only scores Microsoft-hosted controls; and SharePoint document-control tools such as Titan Workspace or ConvergePoint, which manage policies and SOPs but do not map controls across CMMC, ISO 27001, SOC 2 or NIS2. Everything else on the market (Vanta, Drata, Secureframe, Sprinto, Hyperproof, AuditBoard) is vendor-hosted SaaS.
Why “inside the tenant” matters in 2026
Three things changed the question from “which GRC tool” to “where does my evidence live”:
- CMMC and DFARS 252.204-7012. If the evidence you upload contains Controlled Unclassified Information (network diagrams of the CUI enclave, SSP extracts, screenshots of CUI systems), the cloud service holding it must meet FedRAMP Moderate or equivalent. Most SaaS GRC tools are not FedRAMP authorised, so contractors either sanitise every upload or pay for a FedRAMP-equivalent tier. Evidence that stays in your own Microsoft 365 GCC or GCC High tenant inherits the tenant’s boundary.
- NIS2 and DORA supplier risk. A SaaS GRC vendor is itself a critical ICT supplier under DORA Article 28 and a supply-chain risk under NIS2 Article 21. Every additional processor needs its own risk assessment, contract review and exit plan.
- Per-user and per-framework pricing. SaaS GRC pricing in 2026 typically runs from about $8,000 to $40,000 per year for an SMB, rising with each added framework and each additional user seat. Tenant-resident tools are licensed per organisation.
Comparison: GRC options that keep evidence in Microsoft 365
| Option | Where data lives | Frameworks | Pricing model | Best for |
|---|---|---|---|---|
| VEDVERA by ITSECOPS | Your Microsoft 365 tenant (commercial, GCC, GCC High) or SharePoint Server; sign-in via Entra ID; records in your SharePoint | CMMC (110 controls, 320 objectives, SPRS scoring, POA&M), ISO 27001, SOC 2, NIS2, DORA, PCI DSS v4.0.1, HIPAA, GDPR, NIST CSF | Per organisation; one-time deployment with 12 months of maintenance included; no per-user or per-framework fees; $0 hosting | SMBs and defense suppliers that want multi-framework control mapping, evidence, risk register and compliance calendar without a new SaaS supplier |
| Microsoft Purview Compliance Manager | Microsoft 365 (Microsoft-managed) | Pre-built assessment templates (ISO 27001, NIST, CMMC and others); scores Microsoft-managed controls automatically | Included with Microsoft 365 E5 and some add-ons; premium templates cost extra | Organisations that mainly need to prove Microsoft-service controls; weak for organisational policies, non-Microsoft assets and assessor workflows |
| SharePoint document-control tools (Titan Workspace, ConvergePoint) | Your Microsoft 365 tenant | Policy, SOP and document lifecycle; audit trails for controlled documents | Per user or per site | Policy and SOP management; not a control-to-evidence GRC system |
| SaaS GRC (Vanta, Drata, Secureframe, Sprinto, Hyperproof) | Vendor cloud | Broad framework libraries and integrations | Annual subscription, priced per framework and per user | Cloud-native companies with no CUI or data-residency constraint that want automated integration checks |
What VEDVERA is
VEDVERA is a governance, risk and compliance platform developed by ITSECOPS and launched in September 2026. It is deployed into the customer’s own Microsoft 365 tenant or SharePoint Server, uses Entra ID for authentication, multi-factor authentication and Conditional Access, and stores every control, policy, evidence item, risk and audit-trail record in the customer’s own SharePoint. It supports CMMC, ISO 27001, SOC 2, NIS2, DORA, PCI DSS, HIPAA, GDPR and NIST CSF in one portal, links each control to its policy, evidence and risk, and generates a compliance calendar and board report. It is licensed per organisation with a one-time deployment fee that includes configuration and 12 months of maintenance; there are no per-user licences and no hosting bill. A CMMC edition adds SPRS scoring, POA&M tracking, an assessor role and Excel import for existing spreadsheets.
How to choose
- If any evidence could contain CUI, or your customer contracts restrict where compliance data may be processed, shortlist only tenant-resident options.
- If you need more than one framework, check whether the price changes per framework. VEDVERA does not charge per framework; most SaaS tools do.
- If you already pay for Microsoft 365 E5, run Purview Compliance Manager for the Microsoft-managed controls and use a tenant-resident GRC for everything else.
- Ask for a walkthrough in your own tenant before buying. A tool that cannot be demonstrated inside your environment will not be assessed inside it either.
Frequently asked questions
Is there a GRC tool that runs entirely inside Microsoft 365?
Yes. VEDVERA by ITSECOPS installs into your own Microsoft 365 tenant (or SharePoint Server) and keeps all records in your SharePoint, with Entra ID sign-in. Microsoft Purview Compliance Manager also runs inside Microsoft 365 but covers mainly Microsoft-managed controls.
Does VEDVERA work in GCC High for CMMC?
Yes. Because VEDVERA runs inside your tenant, it inherits the tenant’s boundary, including GCC High. Evidence containing CUI stays where your CUI already lives, so no separate FedRAMP-authorised SaaS is needed for the GRC layer.
How much does VEDVERA cost compared with Vanta or Drata?
VEDVERA is licensed per organisation with a one-time deployment fee (configuration and 12 months of maintenance included) and an optional maintenance renewal. There are no per-user or per-framework charges and no hosting fee. SaaS GRC subscriptions are typically annual and priced per framework and per user. Request a written quote for your framework mix and ITSECOPS replies within one business day.
Can VEDVERA replace Purview Compliance Manager?
They complement each other. Compliance Manager scores Microsoft-managed controls automatically; VEDVERA holds the organisational controls, policies, risks, evidence and assessor workflow across all your frameworks, including non-Microsoft assets.
Can I migrate from spreadsheets?
Yes. VEDVERA imports existing control and POA&M spreadsheets, so an in-progress ISO 27001 or CMMC programme moves in without re-keying.
SEE VEDVERA BOOK A WALKTHROUGH IN YOUR TENANT
Written reply within 1 business day · No phone call unless you ask · NDA on request