MyVCM has allowed our small organization to implement a solid compliance program starting as early as 10 employees, and now scaling to 30-40 individuals tracked and many systems and assets. I assume MyVCM will be able to cover us as we scale to 50-100 or more individuals as well.

Makes it easy to manage policies, run risk assessments, establish recurring audit tasks, and record and track compliance across an organization. Good and proactive support from the company, and the company and founder clearly care about the product and the mission and are actively introducing new useful features from their deep domain knowledge.

The UX flows are somewhat unintuitive at times, and the product can be complex with significant learning curve. Compliance is complicated, so it's understandable... but could be better. They offer policy templates as well, but they contain some typos and aren't fully harmonized with each other.

Building a security program from scratch is extremely overwhelming. Especially when it's not your primary function within an organization and you have no security experience. MyVCM breaks down the steps into manageable tasks and then gives you the tools you need to maintain the program. I tell the system what training and policies apply to which employees and the system does the rest. My team gets reminders for actions and I can pull reports at any time.

It can assist anyone in building and maintaining a security program. You don't have to be a security professional to use the tool. The tool provides training and document templates. The tool makes managing - training, audits and other security activities - easy. The software is consistent and easy to use. The support team us always friendly and super responsive.

It can sometimes be confusing what needs to be completed on certain action items. For example, when a document has met it's expiration date there is an action for the owner to review the document. The owner needs to review the document and push out the due date another year - I didn't find this to be intuitive but I can see why it was designed that way to provide additional flexibility.

Our experience with MyVCM was satisfactory although disappointing the audit-focused features were so far behind the end-customer facing ones. We would strongly recommend MyVCM to companies looking to operationalize their IT compliance burdens, but we would not recommend MyVCM to strictly audit firms looking for workflow improvements.

The framework cross-walk is a critical feature of the product and one where it excels. The ability to apply multiple frameworks and see the minimum control set needed to satisfy all the frameworks is essential to managing compliance in 2021.

MyVCM was initially presented to us as, an auditing firm, as a way to help operationalize our auditing and facilitate lead generation. It was a significant financial risk, but the framework crosswalk was a deal-maker. As we continued to use MyVCM, it became clear the auditor experience was still evolving and not at a comparable maturity level to the end-customer facing components. This was a significant expectation mismatch.

MyVCM provides a wide range of functionality and modules built-in that grants us all the tools we need to build our security framework. On top of that, Ostendio is very receptive to customer feedback and is constantly incorporating new features and improvements based on that feedback. So, what I like the most about this product is the functionality that is continually improved upon.

The policy and procedural templates that come with Standard licensing is sub-par and required a lot of adjustment to make usable. Once we upgraded to Premium licensing, we gained access to the Premium Templates which are phenomenal.

MyVCM is facilitating and enabling our certification process for SOC II and HITRUST. It holds all of our polices and procedures, as well as the evidence we post supporting our implementation. MyVCM also contains the assessment questionnaire that we use as a gauge to determine how far along we are in the compliance implementation process.

Ease of use and features. Easy to set up users, assign them documents, then record who has acknowledged receipt of said documents. Documents can either be stored as document files or links to documents on other storage platforms. The roles of approver, custodian and customer allow for routing flexibility when processing policy documents.

No real pain points to relate. I would like to be able to make more changes to policies without triggering a policy update process, but that would somewhat defeat the purpose of a protected policy system.