Featured guide
Create and assess a risk
Learn how to complete CIA and FAIR assessments, add controls, assign treatment actions and manage risk exceptions.
Read the guideConnected GRC work, without disconnected evidence.
PurpleWASP brings policies, risks, assets and compliance activity into one operational environment so teams can see ownership, decisions and progress in context.
One connected model
See how governance work fits together
Each module can support a focused workflow, while shared ownership and records help teams understand the wider operational context.
Set expectations
Create, review, approve, publish and assign policies with version history and accountability.
Understand risk
Record risk scenarios, complete assessments and document controls, treatment decisions and exceptions.
Know what matters
Maintain ownership, classification and lifecycle data for the assets that support business activity.
Connect requirements, controls and evidence
Coordinate compliance obligations, control ownership, evidence collection, review activity, exceptions and remediation in one traceable workflow.
Core modules
Purpose-built operational workspaces
Each module gives the responsible team a clear place to manage records, actions and decisions.
Policy Management
Manage the lifecycle of policies and governed documents without losing review or publication history.
Risk Management
Move from risk identification to assessment, treatment and formal acceptance with clear accountability.
Asset Management
Build a dependable asset register with the ownership and classification data needed by other GRC workflows.
Compliance Management
Coordinate obligations, controls, evidence, reviews and remediation without a separate spreadsheet chase.
Operational confidence
Give every decision an owner and an audit trail.
Role-based access, approval workflows, notifications, record history and reporting help teams understand what changed, who is responsible and what needs attention next.
- Role-aware dashboards and assigned work.
- Review, approval and exception decisions.
- Linked owners, actions and due dates.
- Evidence and activity retained with context.
Implementation
Adopt the platform in controlled stages
A phased rollout helps teams establish ownership and working practices before increasing scope.
Establish governance
Confirm scope, module owners, roles, access and the first business outcomes.
Prepare trustworthy data
Clean the initial policy, risk, asset or compliance records before importing or creating them.
Launch one repeatable workflow
Prove the lifecycle, reporting and hand-offs with a manageable group before expanding.
Connect additional modules
Link related records and evidence only after ownership and operating cadence are working.
Access designed around organisational responsibilities
Administrators can manage users, role mappings, account status, groups, module access and security preferences. Two-factor authentication can be required according to organisation settings.
Need a fit assessment?
Discuss required modules, user roles, rollout scope and support expectations.