Integration Coverage

Does the platform have a native integration for every tool in our current infrastructure stack?
For our top 5 integrations, what specific services or APIs are monitored (not just the integration name)?
Is the integration list publicly documented with specifics, or is it a marketing claim?
What is the process for requesting a new integration, and what is the typical delivery time?
Are there any integrations currently listed as 'beta' that we depend on?
Does the platform monitor cloud infrastructure at the resource level (individual buckets, instances) or only at the account level?

Audit Experience

Has this platform been used in a completed SOC 2 Type II audit by our target auditor or audit firm?
Can the vendor provide a reference customer in our industry who has completed an audit on this platform?
What does the auditor-facing evidence package look like? (Request a redacted sample.)
How does the platform handle evidence requests that come up mid-audit?
Does the platform have a dedicated auditor portal or audit hub, and does our auditor use it?
What is the process for granting our auditor access to evidence?

Control Framework

Are we required to use the platform's control framework, or can we bring our own controls?
How does cross-framework mapping work? Does evidence automatically satisfy controls in multiple frameworks?
Can we create custom controls or modify existing test criteria?
What happens to our controls and evidence if we add a new framework mid-contract?
How does the platform handle frameworks that are not listed in the standard library?
Is there a documented mapping between this platform's controls and the frameworks we're targeting?

Support Model

Will we have a named CSM, and what is their response time SLA?
What tier of support is included at our plan level, and what does it cost to upgrade?
Is implementation support included, or is it a separate fee?
What is the process for urgent support issues during an active audit?
Can we speak with 2–3 reference customers who have been on the platform for more than 2 years?
What is the support handoff process when a CSM leaves or changes?

Pricing and Renewal

What is the exact pricing model — is it per employee headcount, per framework, or a flat rate?
What happens to our price if we cross a headcount tier threshold mid-contract?
Can we see example renewal pricing for a comparable customer who has been on the platform for 2 years?
Will the vendor include a renewal cap clause (e.g. increases capped at 10% per year)?
Are there any add-on modules included in our quote that we can opt out of?
Is there an implementation fee, and is it negotiable?

Migration Risk

What data can we export from this platform in machine-readable format if we ever decide to leave?
Is there a documented data export process, and how long does it take?
What happens to our compliance data after account cancellation?
What is the API access model — which plan tier includes API access, and what are the rate limits?
If we later need to migrate to a different platform, what will transfer and what won't?
What is the account cancellation notice period and process?

Want help working through this checklist for a specific vendor?

A free 30-minute consultation maps your exact situation — what data moves, what doesn't, whether your timeline is viable, and what the switch will actually cost in time and disruption.

Book Free Consultation →Take the free assessment first

Independent advice. Not affiliated with any platform vendor.

GRC Platform Selection Checklist: 35 Questions Before You Sign