Run your vCISO service on Coriqa GRC

Coriqa GRC gives vCISOs, consultants and service providers a standards-based method to show every client where they stand, what to fix first and in which order, and to report on it every quarter.

A remediation plan for every assessment

Every completed assessment ends in a plan: the actions, in phases, with effort and impact. Add the budget and proposal add-on to turn it into your next quote.

All your clients, one login

Switch between your clients from one login, each with their own business units, assessments, risks and reports.

Your brand on the reports

Board packs and assessment reports carry your logo as the partner who prepared them.

A repeatable vCISO rhythm

Baseline assessment, monthly risk review, quarterly board pack and a repeat assessment each review period, done the same way for every client.

Less writing, more advice

Written steps for 533 questions and 50 base documents, plus training, a demo account and help with your first client assessments.

Who partners with us

Built for the people who look after security for others

vCISOs and security consultants

Act as the client's CISO with structure behind you: CIS, ISO 27001, NIST CSF 2.0, POPIA or Joint Standard 2 assessments, a risk register the client signs off, and a board pack and Statement of Applicability under your name.

MSPs and MSSPs

Add a vCISO service to your contracts. Show clients where they stand, turn the gaps into a remediation plan, and keep their risk register up to date as you fix things.

Distributors and buying groups

Give your resellers a way to start the security conversation and quote the products that close the gaps.

Referral partners

Introduce organisations to Coriqa GRC and earn on their subscription.

How it works

Start small, grow the account

Begin with a once-off assessment, move the client to an ongoing service, and give them their own access when they are ready. You own the client relationship: you invoice your clients, and we invoice you. Partner pricing is shared once you are registered.

Step 1 · Once-off

Advisory ONE

One assessment, run by you
Sized to the client, from a basic hygiene check to CIS IG3, NIST CSF or Joint Standard 2
The client gets the assessment report and the remediation plan as PDFs
Pay per assessment, or buy bundle packs

Step 2 · Ongoing

Advisory Ongoing

Repeat the assessment each review period
Compare results over time and show progress
Still run by you; the client does not need to log in
An annual add-on

Step 3 · Subscription

Company Subscription

The client gets their own access, with or without you
Unlimited assessments and users
Dashboard, risk register, guidance, documents and all reports
An annual subscription per client

Add-ons

Remediation budget and proposal Cost the plan per control with your own services and products, and send a branded proposal. You decide whether the client sees the costs.

Additional business units Another subsidiary, department or location, assessed on its own and shown in one company view.

Third-party assessments Send a supplier questionnaire; gaps become supplier risks in the client's register.

External scan A passive, outside-in check of the client's domains: e-mail security, DNS, certificates, website settings and privacy.

Scan monitoring Repeat the external scan on a schedule and see what changed since the last one.

Coriqa Agent for Windows Checks Windows 10 and 11 computers against the CIS benchmark. Failed checks become proposed risks, and passed checks proposed evidence.

Watch the story

See how a vCISO briefs the board with Coriqa GRC

2 minutes · the same board briefing, done with spreadsheets and with Coriqa GRC. Want the product tour instead? It is on the Coriqa GRC page.

Become a partner

Tell us about your business and your clients, and we will set up a demo account for you.

Partner with us

Looking for Coriqa GRC for your own organisation? We will introduce you to a partner.