RiskWatch
RiskWatch International · Founded 1993 · Annapolis, MD, USA
State, local, and federal-contractor compliance platform with 40+ pre-mapped libraries and assessor-ready export packs.
Summary
RiskWatch ships a compliance management platform built around pre-mapped control libraries for 40+ regulatory frameworks including NIST 800-53 r5 (all 1,196 controls in 20 families), NIST 800-171 r3 (all 110 controls plus organisation-defined parameters), CMMC 2.0 Levels 1-3, FISMA, FedRAMP Moderate and High baselines, GovRAMP (rebranded from StateRAMP in 2024), IRS Publication 1075, CJIS Security Policy 5.9, NIST CSF 2.0, HIPAA, and PCI DSS v4. The platform runs on a survey-based assessment engine plus an evidence vault and a cross-mapped control library that auto-detects overlap across NIST 800-53, 800-171, CMMC, and GovRAMP. Government customers include US state agencies, county IT offices, higher-education institutions, defense contractors scoping CMMC 2.0, and federal-civilian-adjacent buyers; the product has been in the field since 1993. The single-tenant deployment model and customer-owned data residency make RiskWatch a defensible compliance platform pick for state CISOs subject to IRS Publication 1075 § 9.3.5 data-locality rules and for defense contractors scoping a CMMC 2.0 Level 2 third-party assessment ahead of the November 10 2026 Phase 2 enforcement deadline.
Strengths
- 40+ pre-mapped framework libraries including NIST 800-53 r5, NIST 800-171 r3, CMMC 2.0 Levels 1-3, FISMA, FedRAMP Moderate and High baselines, GovRAMP, IRS Publication 1075, CJIS Security Policy 5.9, and NIST CSF 2.0
- 33-year operating history with assessor-recognised evidence-pack export; C3PAO and 3PAO export packs are first-class output rather than a custom report build
- Cross-mapping engine auto-detects shared controls across NIST 800-53 r5, NIST 800-171 r3, CMMC 2.0, and GovRAMP; one assessment satisfies multiple framework attestations
- Single-tenant deployment with customer-owned data residency, an advantage for state agencies subject to IRS Publication 1075 § 9.3.5 and for defense contractors handling CUI under DFARS 252.204-7012
- Survey-based assessment engine works for non-technical control owners (county records clerks, branch IT, sub-contractor security officers) without a workflow-builder learning curve
- Vendor risk management with BAA, SOC 2, and FedRAMP package tracking aligned to NIST 800-53 SR-3 supply-chain controls and EO 14028 SBOM obligations
- Physical security assessment software is in the same tenant as cyber and compliance, useful for federal-facility, state-courthouse, and county-data-center buyers under NIST 800-53 PE-family controls
Weaknesses
- RiskWatch is not currently FedRAMP authorised at the platform level; federal mission systems that require a FedRAMP boundary on the compliance tool itself will need Telos Xacta, RegScale, ServiceNow IRM in GovCommunityCloud, Hyperproof (FedRAMP Moderate as of March 12 2026), Vanta Government Cloud (FedRAMP 20x Moderate as of April 24 2026), or IBM OpenPages on AWS GovCloud (we are evaluating a FedRAMP path; this is honest)
- No native OSCAL ingest or export pipeline at the platform level today; agencies adopting the FedRAMP 20x machine-readable workflow under RFC-0024 will want RegScale, Telos Xacta, or Vanta for that specific automation path
- Public pricing is opaque; the federal and state procurement community expects GSA Schedule list pricing and our public page does not yet match that expectation
- Brand awareness in federal civilian agencies is lower than ServiceNow IRM, Telos, IBM OpenPages, or Diligent; G2 plus Capterra review volume sits below 100
- Smaller integration marketplace than ServiceNow IRM in GovCommunityCloud or Vanta's 400+ marketplace; eMASS and DISA STIG ingestion are partner-built rather than first-party connectors
State agencies, county IT, higher-education, defense contractors scoping CMMC 2.0 Level 2, and federal-civilian-adjacent buyers running NIST 800-53 r5 plus NIST 800-171 r3 plus CMMC 2.0 in one tenant with strong assessor export artefacts.
Federal mission systems that require the compliance platform itself to carry a FedRAMP High or DoD IL5 boundary; Telos Xacta, RegScale, ServiceNow IRM GovCommunityCloud, Hyperproof, Vanta Government Cloud, or IBM watsonx on AWS GovCloud fit that brief better.
Key features
- Pre-mapped control libraries for NIST 800-53 r5 (all 1,196 controls), NIST 800-171 r3 (all 110 controls), CMMC 2.0 Levels 1-3, FedRAMP Moderate + High, GovRAMP, FISMA, IRS Publication 1075, CJIS 5.9, NIST CSF 2.0
- Cross-mapping engine auto-detects shared controls across NIST 800-53 / 800-171 / CMMC / GovRAMP
- Assessor-export packs (PDF + Excel) for C3PAO CMMC Phase 2 assessments and 3PAO FedRAMP and GovRAMP reviews
- Survey-based assessment engine for non-technical control owners (branch IT, records clerks, sub-contractors)
- Evidence vault with versioning, hashing, and audit-ready export for ATO package assembly
- Vendor risk management with BAA, SOC 2, and FedRAMP package tracking aligned to NIST 800-53 SR controls and EO 14028 SBOM obligations
- Policy management with approval and attestation workflows for governance documents required under OMB Circular A-130
- Single-tenant deployment for state-agency, defense-contractor, and federal-adjacent data-residency requirements under IRS Publication 1075 § 9.3.5 and DFARS 252.204-7012
Integrations
25+ native. Notable: Microsoft Entra ID (SAML SSO), Okta, Microsoft 365 / SharePoint, Slack, Jira, Salesforce, Custom REST API.
Target size
50 to 25,000 employees · US · Canada