RiskWatch
RiskWatch International · Founded 1993 · Annapolis, MD, USA
ISC RMP + FEMA 426/452 + GSA P-100 + FIPS 201 evidence physical security assessment software with offline mobile site walks.
Summary
RiskWatch ships a physical security risk assessment platform built around pre-mapped libraries for the DHS Interagency Security Committee Risk Management Process for Federal Facilities, FEMA 426 Reference Manual to Mitigate Potential Terrorist Attacks Against Buildings, FEMA 452 Risk Assessment How-To Guide, GSA P-100 Facilities Standards Chapter 8 Security, NIST SP 800-53 r5 PE Physical and Environmental Protection family (PE-1 through PE-23), FIPS 201-3 Personal Identity Verification access-control evidence, DoD UFC 4-020-01 Security Engineering Facilities Planning Manual, ASIS Facility Physical Security Control Standards, and the ISC Baseline Level of Protection countermeasure record. Customers include the US Department of Defense, the Department of Veterans Affairs, the Department of Justice, and the NSA (per public press references), plus state government customers across all 50 US states. Likelihood pulls from four crime-data feeds. The product has been in the field since 1993 and is the only platform in this ranking that pre-maps every requirement a federal Facility Security Officer owes the ISC and the agency security office in one tenant.
Strengths
- ISC RMP + FEMA 426 + FEMA 452 + GSA P-100 Chapter 8 + NIST 800-53 r5 PE-1 through PE-23 + FIPS 201-3 PIV evidence + DoD UFC 4-020-01 + ASIS Facility Physical Security Control Standards + ISC Baseline Level of Protection pre-mapped on day one in one tenant
- Crime-data overlay from four independent feeds (Cap Index CRIMECAST, Security Gauge, GlobalIncidentMap, World Aware) so likelihood traces back to source and last-updated date for the ISC reviewer record
- Browser-based mobile TVRA that works offline at remote federal field offices, courthouse annexes, and military bases with no cellular signal and syncs when connectivity returns; no findings lost
- Site Risk Cycle with ISO 31000 and NIST SP 800-30 r1 semi-quantitative scoring; findings convert to tracked remediation tasks with owners and proof-of-close defensible to the ISC reviewer, the agency security office, and the OIG
- Single-tenant deployment with US-only data residency for federal agency customers under FOUO + CUI handling rules; supports air-gap inventory of facility security plans for sensitive sites
- 33-year operating history with federal customers including DoD, VA, DOJ, and NSA per public press references; long-track-record requirement on federal procurement vehicles
- Multi-facility rollup dashboards at facility, region, and agency level with year-over-year ISC Facility Security Level trends and Baseline Level of Protection countermeasure coverage
Weaknesses
- Not FedRAMP authorised at the platform level today; single-tenant deployment is the federal path for sensitive agency customers rather than a multi-tenant FedRAMP boundary; covered honestly in /top-10-risk-management-software-for-government/ companion ranking
- Not a VMS, access control system, FICAM-Approved PACS, or perimeter intrusion sensor; integrates with Lenel S2, Honeywell Pro-Watch, AMAG Symmetry, Genetec, Avigilon, Milestone via APIs and bulk imports rather than deep native connectors
- Brand awareness on G2 and Capterra in federal physical security specifically is lower than Genetec or AlertEnterprise; total review volume sits below 100
- Public pricing is opaque, quote-based and scaled by framework count and facility count; marked partial because typical contract bands are published in the pricing calculator on this page
- UI shows operational heritage in some assessment-builder screens; newer cloud-first entrants like Verkada and Avigilon Alta have a more polished first-run experience for non-specialist users
Federal agencies (civilian + DoD), GSA-managed building portfolios, federal courthouses, state government building portfolios, and municipal public-safety facilities running ISC RMP + FEMA 426/452 + GSA P-100 in one tenant.
Single-site municipal offices that only need cameras and badge readers and have no ISC RMP, FEMA, or GSA obligation; Verkada or Avigilon Alta is the better fit there.
Key features
- Pre-mapped library for the DHS ISC Risk Management Process for Federal Facilities + ISC Baseline Level of Protection countermeasures
- FEMA 426 Reference Manual to Mitigate Potential Terrorist Attacks Against Buildings + FEMA 452 Risk Assessment How-To Guide libraries
- GSA P-100 Facilities Standards Chapter 8 Security + GSA Public Buildings Service security requirements
- NIST SP 800-53 r5 PE-1 through PE-23 Physical and Environmental Protection control library
- FIPS 201-3 PIV access-control evidence collection workflow
- DoD UFC 4-020-01 Security Engineering Facilities Planning Manual + UFC 4-021-02 Electronic Security Systems libraries
- ASIS Facility Physical Security Control Standards library
- Four-feed crime-data overlay for likelihood scoring (Cap Index CRIMECAST + Security Gauge + GlobalIncidentMap + World Aware)
- Offline mobile TVRA site walks for remote federal facilities + military bases
- Multi-facility rollup dashboards by agency + region + Facility Security Level
Integrations
25+ native. Notable: Microsoft Entra ID (SAML SSO), Okta, Microsoft 365 / SharePoint, Slack, Jira, ServiceNow, Custom REST API.
Target size
100 to 50,000 employees · US