HouseGRC · the risk register · until it is closedEvery risk the deal brings, owned and dated.
HouseGRC is a self-hosted governance, risk and compliance application. In a deal it is where the findings from the outside and inside views become risks with owners and dates, where the target's suppliers are assessed, and where its controls are measured against the standards you hold yourself to, until the last item is closed.
Runs on your own server with Docker · currently free for personal use, organisations by quote · database encrypted at rest
One register from due diligence to the last fix
A deal turns up dozens of issues across security, infrastructure, suppliers and compliance. HouseGRC keeps them in one place, with someone answerable for each, so nothing found before closing is forgotten after it.
Each acquisition kept apart
Give each target its own organisation, fully separated from the others and from your own, until it is folded in.
One list, one scale
Risks, audit findings and exceptions on one severity scale, each with an owner and a due date that lands in that person's work queue and on a shared calendar.
Reporting the board can follow
Executive dashboards, key risk indicators with their history, and a board pack carrying your own branding.
Findings become owned, dated risks
Each issue the outside and inside views turn up, once you accept it as real, becomes a risk with inherent and residual scores, an owner, a due date and a treatment. Appetite is set per category, and accepting a risk above it takes two people.
- Promote a finding or an assessment result straight into the register
- Business objectives with a risk coverage roll-up
- Nobody approves their own work
Bring the inventory in
HouseGRC's asset import reads CSV and JSON inventory exports, such as SubnetSleuth's. Vulnerabilities are tracked against that inventory, scored, and given remediation deadlines ranked by known exploitation, so the integration team fixes what matters first.
- Imports common vulnerability-scanner export formats
- External attack-surface discovery for domains you verify
- A watch on certificate expiry
The suppliers you are taking on
A target brings its own suppliers, contracts and dependencies. Tier them with the reasoning shown, work out which ones the business cannot do without, and see renewals coming before an auto-renewal locks you in.
- Security questionnaires a supplier answers without an account
- A concentration and single-point-of-failure view
- An offboarding checklist for the suppliers you consolidate
Measure the target against your standards
Adopt the frameworks your organisation is held to and see how far the target is from them: readiness per framework with its blockers and a trend, evidence collected against shared controls, and findings that open and close on their own as controls are checked.
Where HouseGRC fits in due diligence and integration
HouseGRC runs through the whole deal: it is where every finding lands and where its fix is tracked. See every stage of a deal.
Due diligence
- Give the target its own organisation, separate from yours
- Log red flags and confirmed findings as scored risks the deal team can weigh
- Assess the target against the frameworks you hold yourself to
- Send the target's critical suppliers a security questionnaire
Integration
- Track the fixes agreed before closing and the day-one plan
- Turn the register into a ranked remediation plan with owners and dates
- Import the inventory and consolidate suppliers
- Report progress in the board pack, and close out each risk with its evidence kept for audit
Keep the deal's risks where you can see them
HouseGRC is currently free for personal use with a free licence key. Organisations can license it by quote.