Compliance at 200 employees: too big for spreadsheets, too small for a GRC team

Small startups have an obvious compliance owner: the founder, whether they like it or not. Large enterprises have a compliance department. Companies in between, somewhere from 100 to 500 people, often have neither, and that's where I find the messiest programs.

At this size, the biggest compliance risk is ownership, not technology. Responsibility gets split between functions until nobody can describe the whole program, and the fix is a single accountable owner with the right support, not another tool or another policy.

I've worked inside companies at exactly this stage, where ISO 27001 sat with IT, privacy with legal, vendor contracts with finance and the last security questionnaire with whoever happened to be free.

How it gets this way

Each obligation arrived separately. A customer asked for ISO 27001, so IT took it. A lawyer flagged DPDP, so legal took it. A bank client sent RBI outsourcing requirements, so whoever managed that account took them. HR owns background checks and onboarding. Finance owns vendor payments, so somehow it owns vendor risk.

Each piece is managed reasonably well. Nobody looks at how they connect, which is where gaps hide. The vendor finance onboarded last month has never been reviewed by security. The DPDP notice legal drafted promises a deletion process IT never built.

You've probably sat in a meeting where three people each assumed one of the others was handling the audit. That meeting is the whole problem in miniature.

The options

Hire a GRC lead. The cleanest answer if you can justify the salary and find the person. In India experienced GRC people who also understand engineering are scarce, and one hire can't cover every framework alone.

A fractional or virtual CISO. Senior judgement a few days a month. Good for direction and board reporting, weaker on the weekly operational work unless someone internal carries it.

A platform plus a specialist. A tool that holds the program, evidence and reminders, with an internal owner who coordinates and an external specialist for judgement calls and audits. This is often the right fit for 100 to 500 people, because it gives one person enough reach to own the whole thing.

Whatever you choose, do these

Name one accountable owner for the compliance program as a whole, with authority to chase other functions. Write a one page RACI showing who is responsible for each framework and regulator, who approves and who needs to be consulted. Put all obligations on one calendar and one register, so connections become visible. Report to leadership quarterly on status, top risks and decisions needed.

This middle stage is the company we designed Steppe for: several frameworks, several regulators, several departments, one view. Vanta, Drata and Sprinto each have their strengths at this size too. The deciding question is whether the tool helps one person see the whole program, or just gives each department its own corner.

If compliance at your company is partly everyone's job, it's fully nobody's, and the auditor will notice before you do.