GRC Software for US Companies: SOC 2, HIPAA, SOX, NIST and State Privacy Laws

Last updated: 19 October 2026

Quick answer: US companies need GRC software that can handle several overlapping regimes at once: state privacy laws such as the CCPA/CPRA, sector rules such as HIPAA and SOX, SEC cybersecurity disclosure rules for public companies, and customer-driven frameworks such as SOC 2 and NIST CSF 2.0. The right platform maps one set of controls and evidence to all of them, keeps that evidence current between audits, and gives you the records needed to show regulators, auditors and customers that controls actually work.

There is no single, comprehensive federal privacy or cybersecurity law in the United States. Obligations come from federal sector laws, agency rules, state statutes and frameworks customers expect you to meet. A mid-sized SaaS company selling to hospitals and listed enterprises can easily face HIPAA, SOC 2, several state privacy laws and its customers’ SEC-driven vendor questionnaires in the same year.

Spreadsheets and shared drives work until the second or third framework arrives. Then the same control is documented three times, evidence goes stale and audit preparation becomes a scramble.

This guide explains the main US requirements a GRC platform needs to support, what continuous compliance and audit readiness mean in practice, how to build a realistic ROI case without guesswork, and a checklist for evaluating vendors.

What does the US compliance landscape look like in 2026?

US compliance is a patchwork: federal sector laws (HIPAA, GLBA, SOX), SEC rules for public companies, a growing number of comprehensive state privacy laws, state breach notification laws and voluntary frameworks such as NIST CSF and SOC 2 that customers often treat as mandatory.

Depending on your sector, you may also face the FTC Safeguards Rule under GLBA, the NYDFS Cybersecurity Regulation (23 NYCRR Part 500), CMMC for defence contractors, and the breach notification law of every state where affected residents live.

State privacy laws: CCPA/CPRA and beyond

The California Consumer Privacy Act, as amended by the California Privacy Rights Act, remains the most demanding US privacy law. It applies to for-profit businesses that do business in California and meet at least one threshold: annual gross revenue above a set figure (adjusted periodically for inflation), buying, selling or sharing the personal information of 100,000 or more consumers or households, or deriving 50% or more of annual revenue from selling or sharing personal information.

Core obligations include privacy notices, honouring rights to know, delete, correct and opt out of the sale or sharing of personal information, limiting the use of sensitive personal information, and contracts with service providers. Businesses must generally respond to verifiable consumer requests within 45 calendar days, with one 45-day extension where reasonably necessary. Regulations finalised in 2025 added requirements on cybersecurity audits, risk assessments and automated decision-making technology (ADMT), phased in over several years. Our guide to the new CCPA ADMT and cybersecurity audit rules covers the detail, and the California Privacy Protection Agency publishes the current regulations.

Around 20 states now have comprehensive consumer privacy laws, including Virginia, Colorado, Connecticut, Texas and Oregon. Laws in Indiana, Kentucky and Rhode Island took effect on 1 January 2026. They share a common structure (notices, consumer rights, opt-outs for targeted advertising and sale, data protection assessments for high-risk processing) but differ on thresholds, exemptions, response times and cure periods. Our overview of managing multi-state US privacy compliance explains how to build one programme that covers them.

HIPAA

HIPAA applies to covered entities and to business associates that create, receive, maintain or transmit protected health information (PHI) on their behalf. Three rules matter most for a GRC programme:

• Privacy Rule: limits on uses and disclosures of PHI and individual rights such as access.
• Security Rule: administrative, physical and technical safeguards for electronic PHI, starting with an accurate and thorough risk analysis. See our step-by-step HIPAA security risk analysis guide.
• Breach Notification Rule: notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery. Breaches affecting 500 or more people must also be reported to HHS within that window (and to the media where 500 or more residents of a state or jurisdiction are affected); smaller breaches can be logged and reported to HHS within 60 days of the end of the calendar year. The HHS breach notification guidance sets out the details, and our article on the HIPAA Breach Notification Rule walks through the steps.

HIPAA also means keeping business associate agreements (BAAs) for every vendor that handles PHI and assessing those vendors over time.

SOX

The Sarbanes-Oxley Act requires public companies to maintain effective internal control over financial reporting (ICFR). Under Section 302, the CEO and CFO certify periodic reports. Under Section 404(a), management assesses ICFR each year, and under Section 404(b) the external auditor attests to that assessment for accelerated and large accelerated filers.

For security and IT teams, SOX work centres on IT general controls (ITGCs): access management, change management and IT operations for systems that support financial reporting. A GRC platform helps by documenting controls, assigning owners, scheduling testing and keeping evidence of each test. SOX Section 301 also requires audit committees to set up procedures for confidential, anonymous employee complaints about accounting matters, which a whistleblowing channel can support.

SEC cybersecurity disclosure rules

Rules adopted by the SEC in July 2023 require registrants to disclose material cybersecurity incidents under Form 8-K Item 1.05 within four business days of determining that an incident is material. The materiality determination itself must be made without unreasonable delay after discovery. Delay of disclosure is only permitted in narrow cases where the US Attorney General determines that disclosure poses a substantial risk to national security or public safety.

Registrants must also describe their cybersecurity risk management, strategy and governance in their annual report under Regulation S-K Item 106, including how the board oversees cybersecurity risk and management’s role in assessing it. Foreign private issuers have equivalent obligations on Forms 6-K and 20-F.

The practical challenge is speed and documentation: an incident record, an impact assessment and a trail of who decided what and when. Our guide on setting up a cyber materiality committee covers the governance side.

NIST CSF 2.0 and other NIST frameworks

NIST released the Cybersecurity Framework 2.0 in February 2024. It is voluntary, but widely used by US organisations and their customers as a common language for cybersecurity. Version 2.0 has six functions: Govern, Identify, Protect, Detect, Respond and Recover. The new Govern function covers strategy, roles, policy, risk management and supply chain risk. Our article on the NIST CSF 2.0 Govern function explains what changed, and the official NIST CSF page hosts the framework and implementation examples.

It often sits alongside SP 800-53 (detailed security and privacy controls), the NIST Privacy Framework and the AI Risk Management Framework.

SOC 2

SOC 2 is an attestation report issued by an independent CPA firm under AICPA standards. It reports on controls relevant to one or more Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. A Type I report covers the design of controls at a point in time; a Type II report also tests whether they operated effectively over a period, commonly between three and twelve months.

SOC 2 is not a law and not a certification, but for US B2B and SaaS companies it is often a condition of closing enterprise deals. If you also sell internationally, compare it with ISO 27001 in our guide to SOC 2 vs ISO 27001.

What should GRC software do for a US company?

At minimum, a US-ready GRC platform should let you manage risks, controls, policies, vendors, incidents, privacy requests and evidence in one place, mapped across every framework you answer to.

• Cross-framework control mapping: one access review control should satisfy SOC 2, the HIPAA Security Rule, SOX ITGCs and NIST CSF without being documented four times.
• One risk register: the HIPAA risk analysis, SOX risk assessment and NIST “Identify” work feed a single, consistently scored view.
• Privacy operations: data mapping, consumer request handling and data protection assessments for state privacy laws.
• Incidents, vendors and policies: breach deadlines, BAAs and vendor due diligence, and policy approval and acknowledgement records.
• Evidence and reporting: evidence linked to controls with owners and timestamps, plus dashboards for management, the board and audit committee.

What is continuous compliance and why does it matter?

Continuous compliance means maintaining controls, evidence and risk records throughout the year rather than rebuilding them before each audit. It replaces the annual “audit season” with a steady cycle of control checks, reviews and remediation.

Point-in-time compliance creates drift: controls weaken between audits, evidence goes stale and new vendors appear unassessed. Several US requirements make drift harder to tolerate:

• SOC 2 Type II tests whether controls operated over a period, not on a single day.
• SEC rules require a materiality decision without unreasonable delay, and disclosure within four business days of that decision.
• HIPAA expects risk analysis and risk management to be ongoing, not a one-off exercise.
• State privacy laws require timely responses to every consumer request, all year round.

In practice, continuous compliance rests on a few habits:

1. Assign an owner to every control and give each one a review or test frequency.
2. Link evidence to controls when it is produced, not when the auditor asks for it.
3. Schedule recurring tasks such as access reviews, policy reviews and vendor reassessments, with reminders and escalation.
4. Track findings to closure, whether they come from internal audit, an external auditor, a customer or an incident.
5. Report status regularly to management so gaps are visible early.

How does GRC software streamline audits?

GRC software streamlines audits by turning evidence collection and status reporting into byproducts of day-to-day work. Instead of building an audit pack by hand, you export what the platform already holds.

A platform addresses the usual audit problems directly:

How do you calculate the ROI of GRC software?

Build the case from your own numbers: the hours you spend today on compliance work a platform would reduce, the cost of those hours, the tools and external effort it would replace, and the revenue it could unblock, then compare that with the total cost of ownership.

Headline percentage savings rarely transfer between organisations, because results depend on how many frameworks you run, your current maturity and adoption. A simple worksheet is more convincing to a CFO.

Then set the costs against it: subscription, implementation, internal onboarding time, training and ongoing administration. A practical formula is:

Annual net benefit = (hours saved × loaded hourly rate) + replaced tool costs + reduced external fees − annual total cost of ownership

Keep risk reduction separate. A lower chance of a missed breach deadline or failed audit is real value but hard to quantify credibly, so describe it qualitatively or use your risk register scores. Better records may help at cyber insurance renewal, but do not assume a premium reduction unless your broker confirms it.

In practice: pilot one framework and measure hours before and after. Your own data beats any estimate.

How should US buyers evaluate GRC software?

Start with your obligations, then test each shortlisted platform against real scenarios from your programme rather than a generic demo.

Evaluation checklist

1. Framework coverage: does it provide content for the frameworks you need now (for example SOC 2, NIST CSF 2.0, PCI DSS, CCPA) and those you expect next? Ask how HIPAA, SOX ITGCs and state privacy laws are handled, and how quickly framework updates are released.
2. Mapping quality: can one control and one piece of evidence be mapped to several frameworks, and can you see the mapping?
3. Privacy operations: does it handle consumer requests across several states with different deadlines, data mapping and data protection assessments?
4. Incident handling: can it record incidents, assess impact, log materiality decisions and track HIPAA, state and SEC deadlines?
5. Vendor risk: are there configurable questionnaires, vendor portals, contract and certification tracking, and reassessment reminders?
6. Risk methodology: can you configure scoring to match your own methodology and risk appetite?
7. Audit trail and exports: will your auditors accept the evidence exports and logs?
8. Multi-entity and access control: can you separate subsidiaries, report across the group and give auditors and vendors role-based access?
9. Usability: will control owners outside compliance actually use it?
10. Security and hosting: ask for the vendor’s own security reports, data hosting locations and subprocessors.
11. Total cost: licence model, implementation effort and the internal resources needed to run it.

Matching the tool to your organisation

Enterprise suites such as OneTrust, Archer or MetricStream tend to suit large organisations with dedicated administrators and complex requirements. Lightweight compliance automation tools often focus on getting a first SOC 2 report quickly. Mid-market organisations needing privacy and security across several frameworks often want something in between: broad coverage, configurable without a large admin team.

Enactia is one option in that space. It is a modular GRC platform for cybersecurity and data protection, with enterprise risk management, policy management, vendor and third-party management, asset management, incident and data breach management, consumer request handling, data mapping, whistleblowing and a cross-framework Compliance Universe. You can review the frameworks and regulations Enactia supports, which include HIPAA, SOC 2, NIST CSF, the NIST Privacy Framework, PCI DSS and ISO 27001, alongside CCPA support. Organisations can start with one module and add others later.

Key takeaways

• The US has no single federal privacy law; obligations come from state laws, sector laws, SEC rules and customer-driven frameworks.
• About 20 states, led by California, now have comprehensive privacy laws with different thresholds and deadlines.
• HIPAA breach notices to individuals are due no later than 60 days after discovery; SEC Form 8-K Item 1.05 disclosures are due four business days after a materiality determination.
• Build ROI from your own hours, costs and deals, not from generic vendor percentages.

Frequently asked questions

Is there a federal privacy law in the US?
Not a comprehensive one. Federal laws cover specific sectors or data types, such as HIPAA for health information, GLBA for financial institutions and COPPA for children’s data online. General consumer privacy is governed by state laws, led by the CCPA/CPRA in California, plus state breach notification laws in every state.

What is the SEC four-day rule for cyber incidents?
Under Form 8-K Item 1.05, SEC registrants must disclose a material cybersecurity incident within four business days of determining that it is material. The materiality decision must be made without unreasonable delay after discovery. Registrants also describe their cybersecurity risk management and governance in their annual report under Regulation S-K Item 106.

Is SOC 2 required by law?
No. SOC 2 is a voluntary attestation report from an independent CPA firm. In practice, many US enterprise customers require a SOC 2 Type II report from SaaS and service providers before signing contracts, so it often becomes a commercial requirement.

Can one GRC platform cover HIPAA, SOX, SOC 2 and the CCPA?
Yes, if it supports cross-framework mapping. Many controls overlap, such as access management, risk assessment, vendor management and incident response. A platform that maps one control and its evidence to several frameworks avoids duplicate work, though each regime still has unique requirements, such as HIPAA BAAs or CCPA consumer rights.

Building a US compliance programme that lasts

US requirements will keep changing as more states pass privacy laws and California’s new regulations phase in. One mapped set of controls, current evidence and a clear risk register make those changes far easier to absorb. Enactia’s AI-powered GRC platform brings enterprise risk management, privacy operations and multi-framework compliance together in one place.

To discuss your US requirements, contact us or book a demo or start your 14-day free trial.

This article is for general information and is not legal advice.