Open source GRC tools: what free actually costs

Open source compliance software has become good enough to take seriously. CISO Assistant from intuitem ships with mappings for over a hundred frameworks. Probo targets SOC 2, GDPR and ISO 27001 for startups. Comp AI positions itself as an open source path to SOC 2, ISO 27001, HIPAA and GDPR. OpenGRC and eramba have been around longer.

These tools are a fine choice for a team that has an engineer with spare time and someone who already knows compliance. For everyone else, the licence fee was never the expensive part, and choosing a tool because it is free usually moves the cost somewhere harder to see.

I've set up compliance programs for companies with no security team at all, and the hardest part was never the software. It was deciding what the controls should be, who owns them, and what counts as evidence.

What the issue trackers tell you

Public issue trackers are an honest view of what users struggle with. On 3 October 2026, the most reacted open issue on CISO Assistant's community repository was a request for single sign on in the community edition, followed by support for the OSCAL data format and a Helm chart for deployment.

On Comp AI, the most reacted issue was titled, in their own words, "Self-hosting is difficult due to missing documentation and Docker configuration gaps". Probo's tracker includes reports of users unable to log in after a fresh installation and a Google Workspace SCIM problem, alongside a thoughtful proposal to add guidance on what evidence to collect for each measure.

There is something quietly funny about a compliance tool whose most requested feature is the access control your auditor will ask you about. It's also a fair summary of the trade off.

The costs that don't appear on the pricing page

Hosting and operations: a server, a database, backups, monitoring, upgrades when a new version changes the schema.

Securing the tool itself. Your GRC system holds your risk register, your incident history, your vendor assessments and sometimes your audit reports. It needs access control, logging and patching like any other sensitive system, and the auditor will treat it as in scope.

Configuration. A framework library is a starting point. Someone has to tailor it, decide which controls apply, write the evidence requirements and map them to your systems.

The person. If you've ever been the engineer who "just set up the compliance tool" and then became the compliance team by accident, you know where most of the cost went.

When open source is the right call

You have an engineer who enjoys this and has time. You have a compliance lead who knows the frameworks. You have strict data residency or air gap needs that rule out SaaS. Or you are a consultancy that wants a shared tool across clients and can afford to run it.

If two of those are true, open source GRC can be a very good decision.

When it isn't

If nobody at your company knows what an auditor wants, a free tool gives you a free blank page. Commercial platforms, whether Vanta, Drata, Sprinto or Steppe, charge for the hosting, the integrations and some of the judgement built into the defaults. Steppe goes further on the last part, because the consultants who set up the program also built the tool.

Pick based on who will run it every week, not on the licence.

The licence is free. Someone still has to run it, and you're paying them whether you count it or not.