# SimpleRisk > SimpleRisk is a GRC (Governance, Risk Management & Compliance) platform. The Core is free and open source (Mozilla Public License 2.0) with unlimited users, and can be extended with paid flat-rate Extras (from $5,000/year, no per-user fees). Available as self-hosted open source, self-hosted on-premise with support, or fully managed SaaS. This file expands on llms.txt with the full page inventory, including every industry and region solution page. ## Product - [Platform Overview](https://www.simplerisk.com/platform): Complete GRC software overview - governance, risk management, compliance, and 250+ built-in frameworks. - [Why SimpleRisk](https://www.simplerisk.com/why-simplerisk): Free Core download, 250+ frameworks, FAIR risk quantification, unlimited users - how SimpleRisk compares to nine enterprise GRC platforms. - [Pricing](https://www.simplerisk.com/pricing): Free, open-source Core with unlimited users, plus flat-rate Extras from $5,000/year. No per-user fees, no hidden costs. - [Download](https://www.simplerisk.com/download): Install the full SimpleRisk open source GRC platform free via scripted install, virtual machine, Docker, or manual install. - [Try SimpleRisk](https://www.simplerisk.com/try): Options to try SimpleRisk via demo, hosted trial, or download. - [Request a Demo](https://www.simplerisk.com/schedule/demo): Schedule a personalized demonstration. - [Schedule a Discovery Call](https://www.simplerisk.com/schedule/discovery): Talk through requirements before a demo. ## Deployment Options - [Compare Deployments](https://www.simplerisk.com/deployment/compare): Compare the three ways to run SimpleRisk - open source, on-premise, and fully managed SaaS - side by side. - [Open Source](https://www.simplerisk.com/deployment/open-source): Self-host the free Core under the Mozilla Public License 2.0. - [On-Premise](https://www.simplerisk.com/deployment/on-premise): Self-hosted deployment with commercial support and access to paid Extras. - [SaaS](https://www.simplerisk.com/deployment/saas): Fully managed, hosted SimpleRisk instance. ## Solutions - By Discipline - [Governance](https://www.simplerisk.com/governance): Tools for managing governance frameworks and processes. - [Risk Management](https://www.simplerisk.com/risk-management): Risk identification, assessment, and management capabilities. - [Compliance](https://www.simplerisk.com/compliance): Define tests, run framework/control/test-level audits, and keep the evidence and timeline auditors expect. - [GDPR Compliance](https://www.simplerisk.com/solutions/compliance/gdpr): Achieve and manage GDPR compliance for EU citizens' personal data (PII), free with SimpleRisk Core. - [HIPAA Compliance](https://www.simplerisk.com/solutions/compliance/hipaa): Meet HIPAA requirements for protected health information, free with open-source Core. - [PCI DSS Compliance](https://www.simplerisk.com/solutions/compliance/pci-dss): Achieve and manage compliance with the PCI Data Security Standard for cardholder data. ## Solutions - By Industry - [Aerospace & Defense](https://www.simplerisk.com/solutions/industry/aerospace-defense): CMMC, DFARS, ITAR, and the 110 NIST 800-171 controls mapped to one library, assessment-ready. - [Financial Services](https://www.simplerisk.com/solutions/industry/financial-services): NYDFS, PCI DSS, DORA, GLBA, and FFIEC mapped across one control library. - [Government](https://www.simplerisk.com/solutions/industry/government): NIST 800-53, FedRAMP, CMMC, GovRAMP, and CJIS, ATO-ready. - [Healthcare](https://www.simplerisk.com/solutions/industry/healthcare): HIPAA, HITRUST, and PCI mapped to one library, audit-ready. - [Higher Education](https://www.simplerisk.com/solutions/industry/higher-education): FERPA, GLBA, HIPAA, PCI, and CMMC mapped to one library for lean teams. - [Insurance](https://www.simplerisk.com/solutions/industry/insurance): NAIC Model Law (25+ states), NYDFS, and GLBA mapped to one control library. - [Life Sciences](https://www.simplerisk.com/solutions/industry/life-sciences): FDA 21 CFR Part 11, GxP, GAMP 5, HIPAA, and GDPR mapped to one library. - [Manufacturing](https://www.simplerisk.com/solutions/industry/manufacturing): NIST 800-171, IEC 62443, ISO 27001, and CMMC mapped across IT and OT. - [Public Utilities](https://www.simplerisk.com/solutions/industry/public-utilities): NERC CIP, TSA, and IEC 62443 mapped across IT and OT. - [Technology & SaaS](https://www.simplerisk.com/solutions/industry/technology): SOC 2 and ISO 27001 mapped to one library to speed up security questionnaires. ## Solutions - By Region - [United States](https://www.simplerisk.com/solutions/region/united-states): The 20-state privacy patchwork plus HIPAA, SOC 2, NIST CSF 2.0, and PCI DSS. - [Canada](https://www.simplerisk.com/solutions/region/canada): OSFI B-13, SOC 2, and ISO 27001, plus PIPEDA and Quebec Law 25. - [Europe](https://www.simplerisk.com/solutions/region/europe): GDPR, NIS2, DORA, and the EU AI Act unified in one platform. - [Australia](https://www.simplerisk.com/solutions/region/australia): The Essential Eight, APRA CPS 234/230, and the SOCI Act. - [New Zealand](https://www.simplerisk.com/solutions/region/new-zealand): The Privacy Act 2020, NCSC standards, and NZISM. - [Asia](https://www.simplerisk.com/solutions/region/asia): Market-specific security regimes and data laws including MAS, CERT-In, ISMS-P, and PIPL. - [Middle East](https://www.simplerisk.com/solutions/region/middle-east): Saudi NCA ECC, SAMA, and UAE PDPL/IA, including data localization requirements. - [Africa](https://www.simplerisk.com/solutions/region/africa): Central-bank cyber rules plus POPIA, NDPA, and Kenya DPA. - [Latin America](https://www.simplerisk.com/solutions/region/latin-america): Financial-sector cyber rules plus Brazil's LGPD and BACEN, and ISO 27001. ## Extras (Paid Add-Ons) - [Risk Assessment](https://www.simplerisk.com/extras/risk-assessment): Build custom questionnaires with logic, send to contacts, turn results into tracked risk, and compare answers over time. - [Vulnerability Management](https://www.simplerisk.com/extras/vulnerability-management): Turn vulnerability scans into tracked risk. Import from Rapid7, Tenable, and Qualys. - [Incident Management](https://www.simplerisk.com/extras/incident-management): Run incident response on the NIST 800-61 methodology; submit, assign, prioritize, and tie incidents to risk. - [API](https://www.simplerisk.com/extras/api): Automate SimpleRisk with a RESTful API; script interactions with CMDBs, ticketing, and BI tools. - [Jira Integration](https://www.simplerisk.com/extras/jira): Two-way sync of risk, mitigation, and review data between SimpleRisk and Jira. - [Artificial Intelligence](https://www.simplerisk.com/extras/artificial-intelligence): AI-assisted risk analysis, FAIR assessments, and tailored documentation built from your organization's profile. - [Custom Authentication](https://www.simplerisk.com/extras/custom-authentication): Active Directory (LDAP) and SAML single sign-on. - [Advanced Search](https://www.simplerisk.com/extras/advanced-search): Search all risk data by keyword or number from the top bar. - [Customization](https://www.simplerisk.com/extras/customization): Add custom fields and forms, and build page templates that match your naming conventions. - [Email Notification](https://www.simplerisk.com/extras/email-notification): Automatic email alerts on risk changes plus scheduled review reminders. - [Encrypted Database](https://www.simplerisk.com/extras/encrypted-database): AES-256 encryption at rest; helps meet PCI DSS, HIPAA, and FIPS. - [Organizational Hierarchy](https://www.simplerisk.com/extras/organizational-hierarchy): Structure SimpleRisk around business units and teams; scope what each user can see. - [Team-Based Separation](https://www.simplerisk.com/extras/team-based-separation): Assign risks to teams so members see only what they own. - [Import-Export](https://www.simplerisk.com/extras/import-export): Import an existing risk register via CSV mapping; export risks, mitigations, and reviews anytime. - [Unified Compliance Framework](https://www.simplerisk.com/extras/unified-compliance-framework): Map controls to UCF's common control framework and test once to satisfy many. - [Secure Controls Framework](https://www.simplerisk.com/extras/secure-controls-framework): 250+ frameworks mapped across 1,000+ common controls. Free with registration. - [One-Click Upgrade](https://www.simplerisk.com/extras/one-click-upgrade): One-click upgrade and backup for self-hosted deployments. Free with registration, built for on-premise. - [Workflows](https://www.simplerisk.com/extras/workflows): Design custom approval and review workflows and route tasks automatically. ## Company - [About / Our Story](https://www.simplerisk.com/company/about/our-story): Company background. - [Leadership](https://www.simplerisk.com/company/about/leadership): Leadership team. - [Careers](https://www.simplerisk.com/company/about/careers): Open positions. - [Contact Us](https://www.simplerisk.com/company/about/contact-us): Contact information. - [GRCaaS Partner Program](https://www.simplerisk.com/company/partners/grcaas): GRC-as-a-service for MSSPs and vCISOs, with a dedicated instance per customer. - [VAR Partner Program](https://www.simplerisk.com/company/partners/var): Authorized reseller program; earn on initial purchase and every renewal. ## Resources - [Resources Hub](https://www.simplerisk.com/resources): GRC guides, documentation, downloads, and community. - [Explainer Video](https://www.simplerisk.com/resources/explainer-video): Overview video of the SimpleRisk platform. - [Blog](https://www.simplerisk.com/blog): Articles on GRC topics and SimpleRisk features. - [Product Releases](https://www.simplerisk.com/product-releases): New feature and release announcements. - [Feature Suggestions](https://www.simplerisk.com/features): Public feature request and voting board. ## Legal - [Terms of Service](https://www.simplerisk.com/tos) - [Privacy Policy](https://www.simplerisk.com/privacy) - [Responsible Disclosure Policy](https://www.simplerisk.com/responsible-disclosure-policy)