GRC (Governance, Risk & Compliance) platforms operationalize the security compliance program — mapping internal controls to regulatory and industry frameworks (SOC 2, ISO 27001, HIPAA, PCI-DSS, NIST CSF, CMMC, GDPR), collecting evidence continuously, managing policy exceptions, and producing audit-ready documentation. Core capabilities include control-framework libraries and cross-framework mapping, automated evidence collection from cloud and SaaS systems, control attestation and ownership workflows, policy management and exception tracking, vendor-risk assessment, and continuous control monitoring with real-time posture dashboards. The category spans the enterprise-grade incumbents (ServiceNow GRC, Archer, MetricStream) and the compliance-automation wave targeting mid-market SaaS companies (Vanta, Drata, Secureframe, AuditBoard).