RiskWatch
RiskWatch International · Founded 1993 · Annapolis, MD, USA
cGMP + DEA + DSCSA + Annex 1 + BMBL physical security assessment software with site-level rollup.
Summary
RiskWatch ships a physical security risk assessment platform built around pre-mapped libraries for 21 CFR Part 211 Current Good Manufacturing Practice facility design and construction features, 21 CFR Part 1301 DEA controlled-substance vault and cage and safe construction standards, the Drug Supply Chain Security Act chain-of-custody at the manufacturer-to-3PL and 3PL-to-dispenser handoff, ISPE Baseline Guide Vol 5 Commissioning and Qualification, EU GMP Annex 1 (effective August 25 2023) clean-room access with RABS interlock and contamination control strategy, EU GMP Annex 11 computerised systems for the access-control audit trail itself, Biosafety in Microbiological and Biomedical Laboratories sixth edition containment access at BSL-2 / BSL-3 / BSL-4, the Federal Select Agent Program rules at 42 CFR Part 73 and 7 CFR Part 331 and 9 CFR Part 121, NIST 800-53 Rev 5 PE family, and ASIS Facility Physical Security Control Standards. The platform models the headquarters API plant, the drug-product plant, the clinical-trial-material warehouse, the Schedule I and II vault, the Schedule III through V cage, the Grade A through D clean room, the BSL-2 through BSL-4 containment suite, the cold-chain refrigerated storage room, and the loading-dock cargo cage as discrete assessable assets with their own control sets. Likelihood pulls from four crime-data feeds anchored to plant addresses for cargo-route diversion risk. Customers include US pharma manufacturers, multi-state CDMOs, and global biotechs running annual cGMP renewals plus DEA registration renewals. The product has been in the field since 1993 and is the only platform in this ranking that pre-maps every requirement an FDA Form 483 inspector, a DEA Diversion Investigator, an EMA inspector, and a USDA-APHIS Select Agent Program inspector will ask for in one tenant.
Strengths
- 21 CFR Part 211 cGMP facility design and construction + 21 CFR Part 1301 DEA vault and cage construction + DSCSA chain-of-custody + ISPE Baseline Guide Vol 5 + EU GMP Annex 1 (Aug 2023) + EU GMP Annex 11 + BMBL biosafety + 42 CFR 73 + 7 CFR 331 + 9 CFR 121 Select Agent Regulations + NIST 800-53 PE + ASIS Facility Physical Security Control Standards pre-mapped on day one in one tenant
- Site-level, region-level, and enterprise-level rollup dashboards with year-over-year trends covering the annual cGMP renewal pack, the DEA registration renewal at § 1301.13, and the EU GMP qualified-person facility report
- Discrete asset models for headquarters API plant, drug-product plant, clinical-trial-material warehouse, Schedule I and II vault, Schedule III through V cage, Grade A through D clean room with RABS interlock, BSL-2 through BSL-4 containment suite, cold-chain refrigerated storage room, and loading-dock cargo cage with their own control sets
- Crime-data overlay from four independent feeds (Cap Index CRIMECAST, Security Gauge, GlobalIncidentMap, World Aware) anchored to plant street addresses so controlled-substance diversion likelihood and cargo-route theft likelihood trace back to source and last-updated date for the DEA Diversion Investigator and the DSCSA trading-partner auditor
- Browser-based mobile TVRA that works offline at remote API plants and clinical-trial-material warehouses with no cellular signal and syncs when connectivity returns; no findings lost on the annual site walk
- Site Risk Cycle with ISO 31000 and NIST 800-30 semi-quantitative scoring; findings convert to tracked remediation tasks with owners and proof-of-close defensible to FDA, DEA, EMA, MHRA, USDA-APHIS, or state board-of-pharmacy inspectors
- Single-tenant deployment with US-only or EU-only data residency for pharma customers under 21 CFR Part 11 electronic records integrity, EU GMP Annex 11 computerised-systems validation, and HIPAA-adjacent ePHI handling for combination-product clinical-trial-material warehouses
- 30-day free trial with no credit card and full platform access; the only TVRA-first vendor on this list offering it
Weaknesses
- Not a VMS, access control system, alarm panel, BMS, cold-chain refrigeration head-end, or DEA reporting platform; integrates with Genetec, Verkada, Brivo, Avigilon Alta, Milestone, Lenel S2, AMAG, Honeywell Pro-Watch, AlertEnterprise, and SAP S/4HANA via APIs and bulk imports rather than deep native connectors
- Brand awareness on G2 and Capterra in pharma physical security specifically is lower than Genetec or Verkada; total third-party review volume in this niche sits below 100
- Public pricing is opaque at the Enterprise tier and scaled by framework count, plant count, vault count, clean-room class, and biosafety level; marked partial because the Starter and Professional contract bands are published in the pricing calculator on this page
- No native DEA Form 222 or DEA Controlled Substance Ordering System (CSOS) e-signature workflow; DEA order-form evidence ingests from third-party DEA reporting platforms rather than first-party integration
- No native cold-chain temperature-excursion telemetry; refrigeration-event evidence ingests from third-party BMS and cold-chain head-ends (Honeywell Forge, Siemens Desigo, Schneider EcoStruxure) rather than first-party hardware integration
- UI shows operational heritage in some assessment-builder screens; newer cloud-first entrants like Verkada and Avigilon Alta have a more polished first-run experience for non-specialist plant managers
US pharma manufacturers, multi-state CDMOs, and global biotechs running annual 21 CFR Part 211 cGMP renewals plus 21 CFR Part 1301 DEA registration renewals across 1-30+ plants with API, drug-product, packaging-and-labeling, clinical-trial-material warehouse, controlled-substance vault, clean-room, biosafety containment, and cold-chain cargo scope in one tenant.
Single-suite virtual pharma startups with no controlled-substance handling, no cGMP manufacturing footprint, and no BSL-2 containment that only need a cloud access bundle for a leased R&D lab; Brivo or Verkada is the better fit there.
Key features
- Pre-built libraries for 21 CFR Part 211 cGMP, 21 CFR Part 1301 DEA vault and cage, DSCSA chain-of-custody, ISPE Baseline Vol 5, EU GMP Annex 1, EU GMP Annex 11, BMBL biosafety, Select Agent Regulations 42 CFR 73 + 7 CFR 331 + 9 CFR 121, NIST 800-53 PE, ASIS Facility Physical Security Control Standards
- Site-level, region-level, and enterprise-level rollup for the annual cGMP renewal pack and the DEA § 1301.13 registration renewal
- Discrete asset models for API plant, drug-product plant, clinical-trial-material warehouse, Schedule I-II vault, Schedule III-V cage, Grade A-D clean room, BSL-2-BSL-4 containment suite, cold-chain refrigerated storage, and loading-dock cargo cage
- Four crime-data feeds anchored to plant addresses for controlled-substance diversion likelihood and cargo-route theft likelihood scoring
- Offline mobile site-walk app for remote API plants and clinical-trial-material warehouses with sync-on-reconnect
- Findings-to-remediation workflow with owners and proof-of-close for FDA, DEA, EMA, MHRA, and USDA-APHIS examiner-defensible evidence
- Single-tenant deployment with US-only or EU-only data residency under 21 CFR Part 11 and EU GMP Annex 11
- 30-day free trial with no credit card
Integrations
25+ native. Notable: Microsoft Entra ID (SAML SSO), Okta, Microsoft 365 / SharePoint, Slack, Jira, Salesforce, Custom REST API.
Target size
100 to 50,000 employees · US · Canada · EU · UK · AU · Switzerland · Ireland