Very good experience. Helps simplify and manage multiple aspects of my role in the bank.

Management of ISP is very easy in Trac. Vendor Management is a very large and can be complex project. Trac makes it easy to manage, and present to Examiners and Auditors.

Used to be slow, but that has been resolved. No real complaints, the software has really matured into a good product.

Overall, I have saved HOURS of time utilizing TRAC. It allows us to manage our contracts and risk audits so much easier and do more than what the regulators are requiring. This enables us to keep our ducks in a row much easier.

The useability of TRAC makes my life so much easier. Before choosing TRAC, I tested multiple solutions ranging from cheap to super expensive. Those systems tested were decent, but TRAC was designed in my opinion with the end user in mind. I feel if I would sit down and design a system today, this is how I would have designed it. Since their company also does outside security audits for financial instructions, I feel it keeps TRAC current with what regulators are requiring.

I understand why they offer separate TRAC modules, but I wish they offered better pricing for existing customers. Even better if I use them for my 3rd party security IT audits, it would be nice to be able to purchase TRAC inclusive package for a discounted flat fee.

It gets the job done for my needs.

Solves most of my compliance needs with regulators for vendor management, IT risk assessment. I do not use the other modules as we have other products.

Like all vendors, there are flaws and annoying issues that should be resolved. SBSCyber does resolve most items provided to support. There is an active development in the product(s) and an end user group that meets annually.

Overall, we are very happy with TRAC and we've had no issues.

One stop shop for managing a bank's InfoSec program.

There's really no major issues. Only wish list items we have is SSO and an option for one login for multiple institutions (helps with holding companies or MSP)

TRAC provides easy to use and up to date tools to help automate and assist an organization in the implementation of their information security program.

TRAC's IT Assets, Vendor, and Business Continuity modules provide a straightforward and consistent method to conduct risk assessments for these activities plus it generates reports and review schedules. You can easily document references and add notes to each item in the modules. The Information Security Program (ISP) module is a customizable tool that generates polices and maintains a review schedule.

I would like to see more customization options for the vendor management module, especially for vendor selection. Vendors provide diverse products and services to banks. Some vendors do not provide services or products that apply to a strict safe guarding regulatory approach to vetting or managing a vendor. For non-bank transaction centric vendors, banks still have needs to manage these vendors which TRAC is capable of handling.

Organization and truly knowing what you have and how each asset or vendor touches your network. Increased your awareness and thus your ability to take action where you see possible vulnerabilities you may not have been aware of before from third parties who do not undergo penetration testing.

I like the reporting features for both board members and auditors. I love having all our vendors in one location and on a schedule for reviews. We like how you can assign an owner who knows the asset best to help you accurately manage.

You have to buy user licenses just for the owners to come in once a quarter and approve or review their assigned assets. We ended up printing them out and handing to each owner then one person has to enter all their data or changes manually and hit approve on their behalf. Sort of defeats the purpose but saves us a lot of money.

My experience with TRAC has been positive. I am able to use the product with ease. If something comes up that I don't know how to do within TRAC or if a function isn't performing properly, I can reach out to our SBS CyberSecurity rep or to customer service and they can either answer my questions immediately or they will research the issue and get back to me.

It's a product where all information can be stored in a central location. Action tracking, audit reviews, necessary documents can all be stored and tracked within TRAC. It's also helpful with working on different assessments they walk you through the process with potential questions.

Can't really think of anything at this time.

I see two main benefits from TRAC. 1) It is way easier than maintaining the spreadsheet based risk assessments we used originally. We didn't know if our examiners were going to agree with our assessments, whether it was the level of risk or the value of mitigations. This way we can rely on an expert opinion for those facts, and save a TON of time on the assessments themselves. 2) It helps us to see where our dollars will have the largest impact. We can use the planned control option to see how much a new logging system might move the needle on risk across the board.

I would like to get raw data out of it, so we can analyze and report on it ourselves without using their tooling. It would also be nice to have a backup of our own.

It makes governance, vendor reviews, asset risk and liability management, and audit tracking much easier.

The software seems to do everything we ask of it, but it would be nice if when done editing a vendor it did not take you back to the top of the list when going back to your vendor list.

Lots of reporting options. Ease of the reports to manage

Really nothing. I just dont use it as often as i could

Plesant and friendly experience overall.

The way it helps you determine and lay out vendors, network, and access points makes the process easy and satisfies the regulators. Cybersecurity Accessment also has a good summary for Execs.

BSA dept and regulators did not love the BSA Risk Assessment.

We are using it for vendor management and to build a new Information Security program for our new bank. The support and documents are regulatory focused which ensures we are implementing policies, programs and procedures based guidelines set by our industries' regulatory bodies, which bodes well when the bank is audited and examined by those regulators.

The solution is fairly intuitive, and the reporting is great when you need to pull data for management or an executive summary. Data in the module feeds into other modules, which is great for building policy and program documents and reduces redundancy of data entry.

No way to set ticklers for vendor reviews or Action Tracking. Would be great if it could notify whoever's email address is noted when a vendor review is due or when a contract is up for renewal. Also, it would be nice to be able to upload multiple files at once. For example due diligence documents for a vendor. As is you have to upload them one at a time which is tedious.

TRAC has been a really useful tool for our Bank. I really like that the risk assessments are all within their own respective area. It has also assisted us with rewriting policies and continuing to be up-to-date on changes with the use of TRAC's templates. We utilize a consultant, and that has been very beneficial for the first few years in getting everything set-up and to understand what we were doing.

TRAC sometimes does not have a logical solution, but customer support is always there to assist and submit recommendations to the developers. The only other thing I can say that I don't like is that it is not consistent throughout the different modules. An example would be that some pages you have to click to save and others automatically save. This can easily be forgotten and work not saved. That is pretty minor when looking at the overall product and what we have gotten out of it though.

Trac has been a life saver for me in setting up and maintaining my ISP. Also great for audits and project tracking from any area. SBS does great with qtrly fun educational meetings to share and expand knowledge of the product.

SBS and Trac is a great place to begin your Information Security Program (ISP). Their system makes it possible to build a cohesive program. The rating is easy and customizable but also the heavy lifting of risk and rating has been pre-entered to help get you started and keep evolving. Examiners love it - since easy to follow.

If not admin; some users find it difficult to use. Not intuitive to not IT brains? Really need to watch the permissions to be sure they have read only on what they need. Permissions are a bit confusing in the implementation. Realize cost is needed but wish bigger discount for other products so could use more together. Can't get approval to add on more modules due to cost.

An amazing asset to cover most of our policies and risk assessments. Examiners are very satisfied with the results we gain from Trac.

Their customer service is out of this world!

Not much to complain about! I have a little stress figuring out some reports, but one phone call is all it takes, and Trac employees explain it perfectly to me!

It is an excellent tool for vendor management.

Everything in one place. You can store vendor related doc as well as the risk for it.

It could use a “Point of View” for some of the questions, this will make it easier to answer then.

We are solving several compliance related concepts with the various modules in the TRAC universe. I like the fact that once you learn one module, you can easily add additional modules and they follow the same entry/reporting flow and concepts.

I appreciate all of the integrated modules in the TRAC system. We started with one of the modules and recently added two more! It is easy to get started, each module follows the same concepts, so the learning curve is short when adding more features. Once we have everything entered in the new system, we may be adding more!

I wish there was an option to create a report to list all of the entries in a module.

I love how the audit findings flow to the action tracking. Each person is then responsible for updating their findings.

Multiple findings in one category don’t flow to action tracking correctly.

Customer Service has been awesome!

TRAC has been a very user friendly product to use!

So far, everything seems to be going well

Support staff makes this product an A+ product and make up for any functionality limitations compared to other competitors.

Low cost of the product and ease of use makes this product hard to find anything that compares.

Protection Profiles are similar in control sets and no ability to have multiple control response contributors assigned to control sets. Also, no ability to auto answer internal controls.

Keeps us all honest as to if we have addressed our issues.

If we could use all modules we would. They really work well together keeping everyone on the same page with risk, audit etc.

Sometimes hard to remember that I have to reset our search functions to see everything.

Exceptional. It was a game changer for us!

TRAC makes us more efficient in our operations/compliance and gives us back time. Nothing is more valuable than time in a community bank when one of the biggest keys is lean operating.

I don't have any complaints. Updating of the product and customer service are all top notch.

Very good and positive.

I love that the Cyber Risk Tool now being include in Trac is great, so that everything is under onsite and log in.

Sometimes hard to navigate and pulling reports can be challenging.

I like the program, it wasn't too hard for me to figure out how it worked.

It is helpful to track our outstanding audit findings and track our policies renewal dates.

Some of the risk assessments have several questions on it. We have trouble with some of the vendor items.

We are taking the guesswork and manual labor out of the risk management process. Streamlining many of the info sec tasks required.

This product is very easy to use and does a great job at risk management. The parameters that are built in are specific to our industry and take a lot of the guesswork out of risk analysis. The customization available is also very useful.

I think the reporting feature could be more customized to allow more flexibility in producing reports.