Thinking about a GRC platform?
Nine reasons to think again
There's a lot of pressure on MSPs to buy a governance, risk, and compliance (GRC) platform to run ISO 27001. Here are nine reasons Microsoft SharePoint is the better option for you as an MSP (and for your customers).
1. It just works (really well).
There's no need to overcomplicate this one: you can run an Information Security Management System (ISMS) that's fully compliant with ISO/IEC 27001:2022 inside Microsoft SharePoint.
Policies sit in a document library, and every register is a SharePoint list. Evidence stays where it was created, so there's no reason to copy it into a third-party SaaS app. Staff get access to what they need and nothing more, and auditors get read access when audit time comes around.
We have more than 170 management systems running in SharePoint right now, which is a lot of money that isn't feeding the GRC SaaS machine.
2. You already own it.
SharePoint is included in Microsoft 365 Business Basic, Standard and Premium. So, if you and your customers are on any of them, the platform is already paid for.
A GRC platform is new spend stacked on top of those licences, and it isn't cheap. When you're talking to a customer about ISO 27001 certification, the last thing they want to hear is that they also need to buy a tool the standard doesn't require.
3. Your governance data is a literal map of your weaknesses.
An ISO 27001 risk register lists the weaknesses in the business, the incident log records everything that's gone wrong, and the supplier register lists every dependency.
That's the material you'd least want to sit on someone else's platform, yet it's exactly what GRC platforms ask you to upload.
A platform holding those records for all its customers becomes a bigger target than any individual customer.
4. Did someone say AI?
This is the exciting stuff: With Microsoft 365 Copilot, your people can ask questions of your policies directly inside SharePoint. They can get a plain-English summary of the access control policy, check what the acceptable use policy says about personal devices, or find which policy covers a situation they're dealing with right now.
Copilot only returns what each person already has permission to see, so it answers from the documents they're entitled to read and nothing else.
GRC vendors are racing to add AI features, and those features run on data you've uploaded to them. Copilot is a paid add-on (we won't pretend otherwise), but it works across everything in Microsoft 365, not just the management system, and your policies never have to leave your tenant for it.
5. The evidence already lives in tools you're paying for.
GRC integrations are a clever piece of marketing. For most MSPs, the evidence an auditor asks for already sits in systems they're paying for: devices in Intune, access in Entra ID, tickets and changes in the PSA, restores in the backup console. An integration copies that evidence into a GRC platform so you can pay again to look at it somewhere else.
Auditors will look at evidence where it lives, and anything that needs to be kept for the audit gets filed in SharePoint alongside the rest of the management system. Duplicating it into a GRC tool adds cost without adding anything an auditor needs.
6. People update tools they already work in – not the ones off to the side.
Realistically, nobody logs into a compliance platform because they feel like it.
In most MSPs, people spend the day in the PSA (HaloPSA, ConnectWise, Autotask), in Teams and in SharePoint. Adoption is what separates a live management system from a folder of documents, and a system only stays live if it’s updated when things happen, in the tools people already have open.
We see it time and again when we migrate partners off a GRC tool and into SharePoint: the tool was being used to pass the audit, not to run the management system.
7. Your headcount becomes your GRC headache.
ISO 27001 requires your policies to be communicated to, and acknowledged by, the people they apply to, which means everyone in the business needs access.
Many GRC platforms price by employee, so that requirement becomes a licence for every person you hire, and the bill climbs every time the business grows.
In SharePoint, anyone on your Microsoft 365 licence can read and acknowledge policies at no extra cost, whether you have 15 staff or 150.
8. Who actually owns your management system?
If you stop paying your GRC vendor, you lose access to your own management system. Yes, you might get an export, but you won't get a working system back.
It's worth reading that twice, because these platforms can cost more than $20,000 a year for the licence alone, before anyone has done any of the actual work. Run the business case over ten years, assuming you plan to be in business that long, and see how you feel about it.
A management system belongs to the organisation that runs it, and in SharePoint, it sits in that organisation's own tenant. Whoever you pay to help run it (and we'd like that to be us), you should be paying for the work, not for the privilege of accessing your own policies.
9. A tool does not equal a system.
SharePoint is where the management system should live, and we've proven that over and over. But on its own, it won't get anyone certified (neither will a GRC platform).
What gets a business certified, and keeps it certified, is the governance rhythm. In our model, that's a monthly governance meeting, risks owned by named people, corrective actions assessed, treated and closed, and evidence filed at the time rather than reconstructed the week before the audit.
What next?
We work mainly with Australian and New Zealand MSPs, more than 120 of them at last count. We help them achieve and maintain their own ISO certifications and build recurring revenue by helping their customers do the same. And it’s all done in SharePoint. There's no new platform to buy, and the only new supplier is us, with the management system running where they already do business.
Not an ISO365 client? Get in touch, and we'll walk you through what the transition involves.