35 Questions to Ask Before Signing a GRC Platform Contract | GRC Migrate

Pricing & Contracts

0 / 5

Is pricing based on headcount, frameworks, or a flat fee — and which metric is most likely to increase fastest for us?
What is the renewal pricing methodology, and can we negotiate a Year 2 and Year 3 cap in the initial contract?
Are integrations included in the base price or licensed separately — and do any of our required integrations cost extra?
What happens to our price if we add a second compliance framework (e.g., ISO 27001 alongside SOC 2)?
Is there a migration or offboarding fee if we decide to switch platforms before the contract ends?

Integrations & Coverage

0 / 5

Does the platform cover every integration we need for automated evidence collection — verified at the specific evidence level, not just the catalog?
For integrations that are listed in the catalog, do they provide automated test results or only manual evidence prompts?
How quickly are new integrations added when we adopt a tool that isn't currently in the library?
What is the process for collecting evidence from tools that aren't covered by native integrations?
If we use custom or internal tooling, can the platform accommodate custom evidence types and manual uploads at scale?

Audit & Auditor Experience

0 / 5

Does the platform have a dedicated auditor portal, and has our specific audit firm used it before?
How does evidence export work — can the auditor access evidence directly, or do we need to export and re-share manually?
Which audit firms does the platform have formal relationships with, and can they provide a reference from our auditor's firm?
How does the platform handle auditor requests for evidence that isn't captured automatically by an integration?
If we switch auditors mid-contract, does the platform support multiple auditor access configurations without additional cost?

Framework Support & Cross-Mapping

0 / 5

Which compliance frameworks does the platform support, and are they all included in the base contract or licensed separately?
If we add a second framework (e.g., ISO 27001 after SOC 2), how does the cross-mapping work — does it genuinely reduce evidence burden or add a parallel control list?
How is the cross-mapping maintained as frameworks are updated — is it automatic or does it require manual intervention?
For frameworks we plan to add in the next 12–18 months, can we see a live demo of the cross-mapping between our current framework and the planned addition?
How does the platform handle frameworks with significant customization requirements (e.g., FedRAMP, PCI DSS)?

Operations & Ongoing Use

0 / 5

What does the onboarding process look like — is there dedicated implementation support, or is it self-serve?
How does the platform handle evidence collection for quarterly or annual controls versus continuous monitoring controls?
What is the process for managing control failures — how are they flagged, assigned, and resolved within the platform?
How does the platform support policy management and version control for compliance documentation?
What reporting does the platform provide for internal stakeholders (e.g., board updates, security committee reporting)?

Support & Service

0 / 5

What is the support SLA — and specifically, what is the response time commitment during active audit fieldwork?
Is support provided from the same time zone as our team, and is real-time support available during critical audit moments?
Is there a dedicated customer success manager, and what does their role include beyond onboarding?
How are platform outages or integration disruptions handled during active audit periods — is there a compensating control process?
Can we speak with a current customer at a similar company size and compliance scope before signing?

Migration & Exit

0 / 5

If we decide to migrate to another platform, what data can we export — and in what format?
Does the platform retain our evidence history after contract end, and for how long?
Are automated test results exportable, or do they remain locked in the platform's proprietary format?
What is the minimum notice period required to cancel or not renew, and is it clearly stated in the contract?
Have other customers migrated away from this platform, and can the vendor share what the typical migration process involves?

Get this checklist as a PDF

Enter your email and we'll send you a printable PDF version of all 35 questions — formatted for use in vendor demos and contract reviews.

Want help running these questions in a vendor demo?

A free 30-minute consultation maps your exact situation — what data moves, what doesn't, whether your timeline is viable, and what the switch will actually cost in time and disruption.

Book Free Consultation →Take the free assessment first

Independent advice. Not affiliated with any platform vendor.