RiskWatch
RiskWatch International · Founded 1993 · Annapolis, MD, USA
Multi-framework risk and compliance platform for multi-location retailers.
Summary
RiskWatch ships a risk and compliance assessment platform with 40+ pre-built control libraries spanning PCI DSS v4.0.1, ASIS International Facility Physical Security Control Standards, Cal/OSHA SB 553 workplace-violence-prevention plan, NIST 800-53 physical and environmental controls, HIPAA Security Rule physical safeguards for retail-pharmacy operators, CCPA and GDPR, NIST CSF, ISO 27001:2022, SOC 2, and SOX. The platform runs a survey-based assessment engine, an evidence vault, and a cross-mapping engine so a single store assessment can evidence multiple regulatory frameworks at once. Store-level risk scoring rolls up to chain-level dashboards for board reporting. Customers include US state governments in all 50 states, healthcare networks, financial-services holding companies, and multi-location retail operators. Pricing is partial-transparency: Standard and Professional contract bands are published; Enterprise is quote-only because deployment topology varies materially across chain size.
Strengths
- PCI DSS v4.0.1 control library is pre-built and current with the March 2025 effective-date catalogue (full SAQ requirements including script integrity, MFA, audit logging, penetration testing) without hand-mapping
- ASIS Facility Physical Security Control Standards + Cal/OSHA SB 553 workplace-violence-prevention plan + NIST 800-53 PE controls all pre-mapped in the same tenant as the PCI library
- CCPA / CPRA and GDPR pre-built libraries cover the multi-state consumer-data privacy obligation that hits every multi-state retailer with online commerce
- Cross-mapping engine auto-detects shared controls across PCI DSS v4, NIST 800-53, ISO 27001, SOC 2, and HIPAA Security Rule so the same store assessment can evidence multiple frameworks at once
- Store-level risk scoring rolls up to chain-level dashboards, useful for VP Risk reporting to the board on a quarterly cadence
- 33-year operating history with federal, state, and healthcare customers (US Department of Defense, VA, DOJ, NSA per public press) plus multi-location retail references
- Single-tenant deployment with customer-owned data residency, an advantage for retailers with employee-personal-data and consumer-data exposure under CCPA, NYDFS Part 500, and state privacy law
- Survey-based assessment engine works for non-technical store managers and regional risk leads; no SQL or workflow-builder skills required
Weaknesses
- No native claims-management or RMIS module out of the box (workers comp, GL, property, cargo); Origami Risk and Riskonnect own that workflow for retail TCOR programmes
- No native POS exception-based-reporting engine; Appriss Retail, Solink, and ThinkLP own that surface for sweethearting, refund fraud, and void abuse
- No native ORC intelligence-sharing network across retailers; Auror is the cross-retailer suspect-sharing layer for that use case (covered in /top-10-physical-security-software-for-retail/)
- Public pricing is partial-transparency (Standard and Professional bands published; Enterprise quote-only); fully-published list prices are not yet on the site
- Brand awareness on G2 and Capterra in the retail-risk-management category sits below 100 third-party reviews; Riskonnect, Origami, and Optro all have larger review surfaces
- UI shows its operational-heritage in places; competing newer entrants (Hyperproof, Sprinto) have a more polished first-run experience for IT-led retail security teams
Multi-location retail chains (200-5,000 stores) running a control-mapped risk programme that has to evidence PCI DSS v4, ASIS, Cal/OSHA SB 553, CCPA, and GDPR simultaneously, plus chains that want a chain-level risk score to brief the board.
Retailers whose primary brief is RMIS-and-claims for workers comp, GL, and property at $50M+ annual claim spend; Origami Risk or Riskonnect fit that brief better.
Key features
- PCI DSS v4.0.1 pre-built control library (full SAQ requirements current with March 2025 effective date)
- Cal/OSHA SB 553 workplace-violence-prevention plan library
- ASIS Facility Physical Security Control Standards library
- CCPA / CPRA + GDPR consumer privacy libraries
- Cross-mapping engine across PCI v4, NIST 800-53, ISO 27001, SOC 2, HIPAA
- Store-level risk scoring with chain-level rollup dashboards
- Vendor risk management with BAA and SOC 2 tracking
- Policy management with approval and attestation workflows
- Evidence vault with versioning and audit-ready export
- Single-tenant deployment with customer-owned data residency
Integrations
25+ native. Notable: Microsoft Entra ID (SAML SSO), Okta, Microsoft 365 / SharePoint, Slack, Jira, Salesforce, Custom REST API.
Target size
250 to 1,00,000 employees · US · Canada · EU · UK · AU