IT Governance Publishing

What IT Governance Publishing does

IT Governance Publishing (now operating as GRC Solutions) is a UK-based, privately held governance, risk, and compliance (GRC) and cyber security services firm founded in 2002 under the IT Governance Ltd brand and consolidated in 2025 as GRC Solutions through the merger of IT Governance Ltd, DQM GRC, and GRCI Law. The company delivers a broad GRC portfolio across six primary solution lines — AI Governance, Data Privacy/GDPR, PCI DSS, Cyber Essentials, ISO 27001, and SOC 2 — supported by professional services in penetration testing (including AI Red Teaming, application security, red teaming, purple teaming, IoT/OT, cloud, and infrastructure testing), consultancy (NIS2, DORA, incident response, business continuity, NCSC assured services, GDPR, PCI, ISO 27001), auditing, and managed services such as DPO as a Service and GDPR UK/EU Representative services. Its technology stack comprises the CyberComply Portal for compliance management, the GRC eLearning Platform for staff awareness training, and the Cyber Security Platform, alongside discrete documentation toolkits and interactive gap analysis tools sold through a self-serve e-commerce storefront. The business operates a hybrid GTM — sales-led for enterprise compliance and pen-testing engagements complemented by product-led self-serve for toolkits, e-learning, and gap analysis tools — and distinguishes itself through scarce regulatory accreditations: founding Cyber Essentials certification body, PCI QSA, CREST member, NCSC assured consultancy, and CHECK assured penetration testing. Customers span automotive, legal, construction, healthcare, and technology sectors with named logos including Volkswagen, Slaughter and May, Freshfields, Severfield, Arkessa, and Congenica; the firm maintains sales contact points across the UK, Ireland, Europe, and the United States and reports a private, founder/management-controlled ownership structure with no disclosed external funding.

Name

IT Governance Publishing

Legal name

GRC Solutions Ltd

Website

https://itgovernancepublishing.co.uk

Company type

Private

Founded year

2002

Operating status

Operating

Headcount range

11–50 employees

Short description

UK-based GRC Solutions (rebranded from IT Governance Ltd in 2025) delivers governance, risk, compliance, and cyber security services — spanning ISO 27001, GDPR, PCI DSS, Cyber Essentials, SOC 2, NIS2, DORA, and AI governance — combined with documentation toolkits, gap analysis tools, and accredited penetration testing for global enterprise and mid-market clients.

Ownership category

akta.pro rank

Product category

Governance, Risk and Compliance (GRC) Services

NAICS

Software Publishers (513210), Management, Scientific, and Technical Consulting Services (5416), Custom Computer Programming Services (541511)

SIC

Services-Prepackaged Software (7372), Services-Computer Programming, Data Processing, Etc. (7370)

akta.pro primary industry

Governance, Risk & Compliance (GRC) Platforms (BPAEAPAA)

akta.pro secondary industries

Compliance Technology, GRC Platforms & Controls Automation Advisory (BPAHAFAO), Privacy, Consent & Data Protection Management (BPAEAPAF), Audit Management, Controls & SOX Compliance (BPAEAPAH), AI Governance, Risk & Compliance (GRC) Platforms (HDAAAMAA)

Keywords

• GRC compliance services
• Cybersecurity training
• Compliance documentation toolkits
• Penetration testing services
• Regulatory compliance consulting

Headquarters

HQ city

Ely

HQ country

United Kingdom

HQ region

Europe

Offices4 records

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Operations, Technology or R&D, Marketing or Sales, Infrastructure, Supply Chain

Revenue model

1. Professional Services - Consultancy: Expert consultancy services including NIS2 Compliance, DORA Compliance, Incident Response, Business Continuity, SOC 2 Audits, PCI Consultancy, ISO 27001 Consultancy, NCSC Assured Cyber Security Consultancy, GDPR Compliance Solutions
2. Training Courses: Instructor-led and e-learning training courses for GDPR, CISSP, ISO 27001, ISO 22301, Cyber Security, DORA, PCI DSS, and AI governance certifications
3. Documentation Toolkits: Pre-built compliance documentation toolkits for ISO 27001, GDPR, PCI DSS, and Cyber Essentials sold as software/products
4. Penetration Testing Services: Security testing services including AI Red Teaming, Application Security Testing, Red Team Assessments, Purple Teaming, IoT/OT Security Testing, Cloud Security Testing, Infrastructure Penetration Testing
5. Auditing Services: Audit services for Cyber Essentials Plus, IT Audit, Cyber Security Audit, GDPR Compliance Audit
6. DPO as a Service: Data Protection Officer services provided on a subscription basis for UK organizations
7. Standards and Publications: Sale of ISO standards documents (ISO 27001, ISO 42001, ISO 22301, ISO 20000, ISO 27701) and compliance books
8. Gap Analysis Tools: Interactive software tools for compliance gap assessments across multiple standards

Go-to-market motion2 records

Distribution channels3 records

Marketing channels7 records

Core offering

IT Governance Publishing (now operating under the GRC Solutions brand) sells and distributes governance, risk, and compliance (GRC) content and products including books, staff awareness training aids, pre-built documentation toolkits, gap analysis software tools, instructor-led and e-learning courses, and provides custom publishing and distribution services. Its portfolio spans solutions for ISO 27001, GDPR, PCI DSS, Cyber Essentials, SOC 2, NIS2, DORA, and AI governance, complemented by professional services such as consultancy, auditing, and penetration testing.

Product overview

IT Governance Publishing (now operating as GRC Solutions) offers a comprehensive portfolio of governance, risk, and compliance (GRC) solutions rather than a single unified product. The core offerings include six key solution areas: AI Governance, Data Privacy/GDPR, PCI DSS, Cyber Essentials, ISO 27001, and SOC 2. These are complemented by professional services including penetration testing (with specialised AI Red Teaming, application security, red team, purple teaming, IoT/OT, cloud, and infrastructure testing), consultancy services (NIS2, DORA, incident response, business continuity, NCSC assured services, and GDPR solutions), training and staff awareness e-learning courses, and software tools including documentation toolkits and gap analysis tools. The company also provides professional services such as DPO as a Service and EU/UK Representative services. Internal platforms including CyberComply Portal, GRC eLearning Platform, and Cyber Security Platform support delivery of these services. The rebranding from IT Governance Ltd combined three entities (IT Governance Ltd, DQM GRC, and GRCI Law) into a unified brand.

Differentiator

Problem solved

Functional benefit

Products and services

• AI Governance Solution Solution offering to help organisations manage AI use safely and responsibly with policies, risk controls, and compliance support aligned with the EU AI Act, GDPR, and ISO 42001.
• Data Privacy and GDPR Solution End-to-end GDPR compliance support covering data privacy objectives, legal obligations, DPO services, and DSAR management for organisations handling personal data.
• PCI DSS Compliance Solution Comprehensive PCI DSS compliance support provided by a PCI QSA company, covering cardholder data protection, QSA assessment, and breach risk reduction.
• Cyber Essentials Certification Solution Cyber Essentials and Cyber Essentials Plus certification support delivered by a founding Cyber Essentials certification body, covering requirements through evidence preparation to compliance.
• ISO 27001 Implementation and Certification Solution ISO 27001 implementation and certification support covering gap analysis, ISMS implementation, and maintenance audits to achieve and maintain certification.
• SOC 2 Compliance Solution SOC 2 compliance support including readiness assessments, remediation, and maintenance services aligned with selected Trust Service Criteria.
• Penetration Testing Services Independent CHECK and CREST accredited security testing to identify exploitable weaknesses, including AI red teaming, application, cloud, infrastructure, IoT/OT, red team and purple team assessments.
• NIS2 Compliance Consultancy Consultancy services to help organisations achieve compliance with the NIS2 Directive requirements.
• DORA Compliance Consultancy Digital Operational Resilience Act compliance consultancy for financial sector organisations.
• DPO as a Service Dedicated Data Protection Officer service providing expert DPO support on a subscription basis for UK-based organisations.
• GDPR Documentation Toolkit Pre-built documentation templates and toolkits to support GDPR compliance implementation.
• ISO 27001 Documentation Toolkit Comprehensive documentation toolkit for ISO 27001 information security management system implementation, sold as a downloadable product.
• PCI DSS Documentation Toolkit Documentation toolkit containing templates and resources for PCI DSS compliance.
• ISO 27001 Staff Awareness E-Learning Course Staff awareness e-learning course covering information security and ISO 27001 fundamentals.
• Cyber Security Staff Awareness E-Learning Course E-learning course designed to build staff awareness of cyber security threats and best practices.
• GDPR and Data Protection E-Learning Course E-learning course covering GDPR requirements and data protection best practices for staff awareness.
• ISO 27001 Gap Analysis Tool Interactive gap analysis tool to assess current compliance status against ISO 27001:2022 requirements.
• GDPR Gap Analysis Tool Interactive gap analysis tool to evaluate compliance status against GDPR requirements.
• CyberComply Portal Online portal platform for managing compliance activities, documentation, and ongoing GRC operations.
• GRC eLearning Platform Dedicated e-learning platform for delivering governance, risk, and compliance training courses to organisational staff.

Named customers6 records

Segments7 records

Ideal customer profiles4 records

Technology focussed Yes

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature5 records

Scale indicators2 records

Recent moves7 records

Expansion highlights5 records

Direct peers

• LRQA: LRQA is a global assurance and certification body delivering ISO 27001/ISO 9001 audits, cyber security assurance, and training - directly comparable to GRC Solutions' certification and training business.
• NCC Group: NCC Group is a UK-headquartered cyber security and GRC consultancy offering CHECK/CREST-accredited penetration testing, ISO 27001 implementation, and managed compliance - closely overlapping GRC Solutions' consulting and testing portfolio.
• BSI Group: BSI is the UK-based standards body that publishes ISO standards and runs certification, training, and compliance toolkits - directly competing with IT Governance Publishing's standards distribution, training, and ISMS certification support.
• OneTrust: OneTrust is a leading privacy, security, and GRC platform covering GDPR, ISO 27001, and AI governance - overlapping significantly with GRC Solutions' privacy, governance, and AI compliance offerings.

Broad incumbents

• ServiceNow GRC: ServiceNow's GRC suite provides enterprise-scale integrated risk, compliance, and audit management as part of a broader platform - overlapping with GRC Solutions' enterprise compliance deployments at the high end.
• KPMG Advisory: KPMG's Risk & Compliance practice delivers GRC advisory, cyber, and ISO 27001 certification support to large enterprises - competing for the same mid-market and enterprise compliance engagements as GRC Solutions.

Emerging players

• Vanta: Vanta sells automated compliance platforms for SOC 2, ISO 27001, GDPR, and more - competing head-on with GRC Solutions' documentation toolkits, gap analysis tools, and readiness services.
• SANS Institute: SANS is a global cyber security training and certification provider, overlapping with GRC Solutions' staff awareness, ISO 27001, CISSP, and DORA training lines.
• Secureframe: Secureframe automates compliance for SOC 2, ISO 27001, HIPAA, PCI DSS and more - a direct competitor to GRC Solutions' tooling-led compliance approach.
• Drata: Drata offers continuous compliance automation across SOC 2, ISO 27001, GDPR, and PCI DSS - a direct substitute for GRC Solutions' manual documentation and gap analysis offerings.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key highlights7 records

Customer concentration

• Xx.com/ITGPublishing
• YouTubeyoutube.com/itgovernanceltd

Compliance2 records

Revenue estimate

Valuation estimate

Number of profiles

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about IT Governance Publishing