FullyInControl

Modular GRC platform for risk, compliance, information security and AI governance

Privacy & Data Protection AI Governance & Compliance Governance, Risk & Compliance fullyincontrol.com

Visit Website

Founded

2016

Starting Price

Custom

About FullyInControl

FullyInControl is a Dutch cloud GRC platform that runs governance, risk and compliance, ISMS/PIMS/AIMS, business continuity, QHSE, third-party risk, ESG and internal audit from one system. It links policy, risks, controls, tests, evidence and improvement actions in a single workflow so compliance status against standards like ISO 27001, ISO 27701, ISO 42001, NEN 7510, BIO, NIS2, DORA and the GDPR is visible continuously instead of only at audit time. The platform is built from 35+ modules that can be bought individually or bundled into domain packages, with three editions (SmartStart, Professional, Enterprise) scaling configurability and user counts.

Pros & Cons

Pros

Genuinely broad domain coverage — GRC, ISMS, PIMS, AIMS, BCM, QHSE, TPRM, ESG, KYC and internal audit in one system, so risks and controls are not duplicated across separate tools
Strong EU regulatory focus with built-in libraries for NIS2, DORA, GDPR, BIO, NEN 7510 and the EU AI Act, which most US-centric GRC tools cover thinly or not at all
One of the few GRC platforms with a first-class AI governance module (AI/algorithm registry plus impact assessments mapped to ISO 42001 and the AI Act) rather than an AI-compliance bolt-on
Cheap 'processor' and viewer licences let large numbers of staff complete tests, answer checklists and upload evidence without paying for full seats
Modular licensing means you can start with one domain package and add modules or step up an edition later without a migration or new platform
Vendor is itself ISO 27001 certified with data held in EU data centres, which shortens security review for public-sector and regulated buyers

Cons

No public pricing at all — every edition is quote-only, so budget planning requires a sales conversation (verified on the rendered pricing pages)
Dutch-first product: the marketing site, much of the documentation and parts of the UI terminology originate in Dutch, and English pages are partly machine-translated with untranslated URLs and headings
AI features, the module configurator, workflow configurator and REST API are paid add-ons on the Professional edition and only fully included at Enterprise
SmartStart is locked to best-practice configuration — no custom roles, custom knowledge bases, custom reports or questionnaires — so smaller buyers give up most of the flexibility
Breadth brings complexity: with 35+ modules and configurable workflows this is an implementation project (roughly 8 weeks even on the fastest edition), not a self-serve signup
Almost no independent review presence — the Capterra listing has zero reviews and there is little third-party validation to check vendor claims against
Heavily concentrated in the Netherlands (municipalities, water boards, housing associations, healthcare), so localisation and reference customers outside the Benelux are limited

Key Features

Integrated management system (IMS)

One platform covering GRC, ISMS/PIMS/AIMS, BCM, QHSE, TPRM, ESG, KYC, performance management and internal audit, so the same risks, controls and evidence are reused across domains instead of duplicated in separate tools.

Standards and framework libraries

Built-in knowledge bases for ISO 27001, ISO 27701, ISO 42001, NEN 7510, BIO, NIS2, DORA, GDPR, COSO ERM, ISO 31000, COBIT, NIST, CIS, SOC 2 and the EU AI Act, plus the option to load custom internal frameworks and map controls to multiple standards at once.

Risk assessment and control management

Register risks, score them with configurable valuation methods, attach control measures and track the tasks that implement and test each measure through to completion.

Privacy module with processing register and DPIAs

Maintain a GDPR processing register across processes and systems, run DPIA workflows with decisions and follow-up, and handle data subject requests (access, correction, erasure, portability, objection) and data breach reporting on deadline-driven workflows.

AI registry and AI Act assessments

AIMS module for building an AI/algorithm registry, running impact assessments on AI use cases and carrying them through to assurance, aimed at EU AI Act and ISO 42001 obligations.

AI assistant (co-pilot)

Optional AI support that drafts risk assessments, proposes control measures and generates policy drafts to shorten the gap from insight to documented action.

Automated periodic audits and testing

Schedule recurring audits, control tests and questionnaires, capture evidence against each test, and involve colleagues who do not hold a full licence via lightweight 'processor' accounts.

Dashboards and reporting

Business intelligence dashboards plus custom Word and Excel report templates (Professional and Enterprise), with KPI, KRI and KCI calculation and saveable custom filters.

Collaboration workflows

Kanban boards, contextual discussion threads, task assignment and responsibility mapping so remediation work happens inside the system rather than in email.

Connect API and Entra ID integration

REST API and web services for pushing data in and out of the platform, standard Entra ID single sign-on on all editions, and extended Entra ID authorisation-role synchronisation as a paid add-on.

Module configurator

Configure fields, workflows, user roles, business roles and questionnaires with conditions without custom code — fully open on Enterprise, available as an add-on on Professional, fixed to best practices on SmartStart.

FICIS implementation method

Structured vendor implementation methodology that gets a SmartStart deployment operational within roughly eight weeks on pre-configured best practices.

Pricing

SmartStart Edition

Custom

Pre-configured on proven best practices
Operational within roughly 8 weeks
2 standard licences, expandable to 5 users
Up to 20 processor licences
100 organisation/viewer licences
2 environment licences
100GB document storage included
Standard Entra ID SSO
No custom roles, knowledge bases, AI or module configurator
Upgradeable to Professional without migration

Professional Edition

Custom

Self-defined user roles and workflows
5 standard licences, expandable to 40 users
Up to 100 processor licences
750 organisation/viewer licences
5 environment licences, expandable to 10
300GB document storage included
2 custom knowledge bases with standards
Custom Word/Excel reports and dashboards
Own questionnaires with conditions
KPI, KRI and KCI calculation
AI, module configurator, workflow configurator and REST API as paid add-ons

Enterprise Edition

Custom

Unlimited users and environments
Unlimited self-defined roles
Unlimited knowledge bases
10 standard licences included
Unlimited processor licences
2,500 organisation/viewer licences (unlimited optional)
750GB document storage included
Full module configurator included
Artificial Intelligence included
Multiple environments for complex org structures
Workflow/business role configurator and REST API as paid add-ons

Best For

ISO 27001 certification and continuous ISMS operation

Run the full ISMS lifecycle — scope, risk assessment, statement of applicability, control measures, periodic tests and evidence — against the ISO 27001 and NEN 7510 libraries, so surveillance audits draw on live data instead of a pre-audit scramble.

GDPR and privacy programme management

Data protection officers maintain the processing register, run DPIAs with documented decisions, log data breaches against statutory reporting deadlines and track data subject requests through to closure in one register.

EU AI Act and ISO 42001 readiness

Build an inventory of AI systems and algorithms, classify and impact-assess each use case, attach controls and assurance evidence, and report on AI governance posture alongside existing security and privacy controls.

Dutch public sector compliance (BIO, ENSIA, municipalities)

Municipalities, water boards and housing associations manage BIO baseline compliance, self-assessments and accountability reporting with pre-loaded local frameworks and viewer licences for large staff populations.

Consolidating separate management systems into one IMS

Organisations running quality, safety, environment, security, continuity and risk in different spreadsheets or tools merge them into a single integrated management system with shared risks, controls, audits and improvement logs.

NIS2 and DORA readiness for regulated firms

Financial institutions and essential-entity organisations map NIS2 and DORA obligations to existing controls, run third-party risk assessments on suppliers and contracts, and evidence board-level oversight through dashboards.