MyVCM

Makes it easy to manage policies, run risk assessments, establish recurring audit tasks, and record and track compliance across an organization. Good and proactive support from the company, and the company and founder clearly care about the product and the mission and are actively introducing new useful features from their deep domain knowledge.

The UX flows are somewhat unintuitive at times, and the product can be complex with significant learning curve. Compliance is complicated, so it's understandable... but could be better. They offer policy templates as well, but they contain some typos and aren't fully harmonized with each other.

It can assist anyone in building and maintaining a security program.
You don't have to be a security professional to use the tool.
The tool provides training and document templates.
The tool makes managing - training, audits and other security activities - easy.
The software is consistent and easy to use.
The support team us always friendly and super responsive.

It can sometimes be confusing what needs to be completed on certain action items. For example, when a document has met it's expiration date there is an action for the owner to review the document. The owner needs to review the document and push out the due date another year - I didn't find this to be intuitive but I can see why it was designed that way to provide additional flexibility.

The framework cross-walk is a critical feature of the product and one where it excels. The ability to apply multiple frameworks and see the minimum control set needed to satisfy all the frameworks is essential to managing compliance in 2021.

MyVCM was initially presented to us as, an auditing firm, as a way to help operationalize our auditing and facilitate lead generation. It was a significant financial risk, but the framework crosswalk was a deal-maker. As we continued to use MyVCM, it became clear the auditor experience was still evolving and not at a comparable maturity level to the end-customer facing components. This was a significant expectation mismatch.

Ease of use and features. Easy to set up users, assign them documents, then record who has acknowledged receipt of said documents. Documents can either be stored as document files or links to documents on other storage platforms. The roles of approver, custodian and customer allow for routing flexibility when processing policy documents.

No real pain points to relate. I would like to be able to make more changes to policies without triggering a policy update process, but that would somewhat defeat the purpose of a protected policy system.