1. Webinar Behind The Scenes Of The Forrester Wave: GRC Platforms, Q1 2014 Chris McClean, Principal Analyst and Research Director Renee Murphy, Senior Analyst Nick Hayes, Analyst February 12, 2014. Call in at 10:55 a.m. Eastern time

2. © 2014 Forrester Research, Inc. Reproduction Prohibited2 Agenda › The GRC market today › Forrester Wave overview › Selecting the right vendor

3. © 2014 Forrester Research, Inc. Reproduction Prohibited3 Agenda › The GRC market today › Forrester Wave overview › Selecting the right vendor

4. © 2014 Forrester Research, Inc. Reproduction Prohibited4 “Which of the following best describes your firm’s plans to adopt a GRC platform?” 2011 N = 625 2013 N = 955 52% 28% Demand is on the rise Base: North American and European security and risk management professionals at companies with 1,000 or more employees; Source: Forrsights Security Survey, Q2 2013

5. © 2014 Forrester Research, Inc. Reproduction Prohibited5 “How do you expect your use of the GRC product and vendor to change over the next year?” Once implemented, expansion continues Base: 66 global GRC professionals; Source: Q3 2013 Global Governance, Risk, And Compliance Platforms Forrester Wave™ Customer Reference Online Survey

6. © 2014 Forrester Research, Inc. Reproduction Prohibited6 “Which of the following functionality/capabilities do you currently use your GRC product for?” (Top 12 are displayed) The use cases are also growing Base: 66 global GRC professionals; Source: Q3 2013 Global Governance, Risk, And Compliance Platforms Forrester Wave™ Customer Reference Online Survey

7. © 2014 Forrester Research, Inc. Reproduction Prohibited7 “Approximately how many people at your organization use your GRC platform?” The number of users is impressive Base: 66 global GRC professionals; Source: Q3 2013 Global Governance, Risk, And Compliance Platforms Forrester Wave™ Customer Reference Online Survey

8. © 2014 Forrester Research, Inc. Reproduction Prohibited8 “At your organization, which top leaders/stakeholders are regularly involved in setting the vision and strategy of your GRC program?” (Select all that apply) The value is in the coordination Base: 66 global GRC professionals; Source: Q3 2013 Global Governance, Risk, And Compliance Platforms Forrester Wave™ Customer Reference Online Survey

9. © 2014 Forrester Research, Inc. Reproduction Prohibited9 “Please rate your level of satisfaction with the business value you receive from the GRC vendor/product.” Percent of customers that are very satisfied (selected “9” or “10” on 0-10 scale) Mature programs are better at articulating and defining value. Defining success reflects maturity Base: 66 global GRC professionals; Source: Q3 2013 Global Governance, Risk, And Compliance Platforms Forrester Wave™ Customer Reference Online Survey

10. © 2014 Forrester Research, Inc. Reproduction Prohibited10 “Please rate your level of satisfaction with the technical functionality of the GRC product in the following categories.” Percent of customers that are very satisfied (selected “9” or “10” on 0-10 scale) User experience and reporting still lag Base: 66 global GRC professionals; Source: Q3 2013 Global Governance, Risk, And Compliance Platforms Forrester Wave™ Customer Reference Online Survey

11. © 2014 Forrester Research, Inc. Reproduction Prohibited11 “How is the GRC platform delivered to you?" On-premises is still most common Base: 66 global GRC professionals; Source: Q3 2013 Global Governance, Risk, And Compliance Platforms Forrester Wave™ Customer Reference Online Survey

12. © 2014 Forrester Research, Inc. Reproduction Prohibited12 Agenda › The GRC market today › Forrester Wave overview › Selecting the right vendor

13. © 2014 Forrester Research, Inc. Reproduction Prohibited13 “Which GRC vendors did you seriously consider during the vendor selection process (including the vendor you ultimately selected)?” Select all that apply The vendor landscape is vast Forrester considered close to 60 vendors for our GRC Forrester Wave! Base: 66 global GRC professionals; Source: Q3 2013 Global Governance, Risk, And Compliance Platforms Forrester Wave™ Customer Reference Online Survey

14. © 2014 Forrester Research, Inc. Reproduction Prohibited14 “Does your company use any other GRC platforms?” Having multiple platforms is common Base: 66 global GRC professionals; Source: Q3 2013 Global Governance, Risk, And Compliance Platforms Forrester Wave™ Customer Reference Online Survey

15. © 2014 Forrester Research, Inc. Reproduction Prohibited15 It’s not worth defining sub-GRC markets › All GRC platforms have the same four basic functions: 1.A relational database 2.A workflow engine 3.Features to enable content management 4.Dashboards and analytics › Use cases are extremely diverse... ›... and that diversity will only increase!

16. © 2014 Forrester Research, Inc. Reproduction Prohibited16 The Forrester Wave evaluation process › Considered close to 60 vendors to participate; selected 19 vendors based on: Breadth of capabilities Substantial market presence Relevance to the market › For each vendor, Forrester: Collected detailed questionnaires Conducted 3-hour executive briefings/online demos Surveyed and interviewed 3 customer references Fact-checked all information at 3 stages

17. © 2014 Forrester Research, Inc. Reproduction Prohibited17 The Forrester Wave™: GRC Platforms, Q1 2014 Source: January 27, 2014, “The Forrester Wave: Governance, Risk, And Compliance Platforms, Q1 2014” Forrester report

18. © 2014 Forrester Research, Inc. Reproduction Prohibited18 Agenda › The GRC market today › Forrester Wave overview › Selecting the right vendor

19. © 2014 Forrester Research, Inc. Reproduction Prohibited19 GRC platform functional model

20. © 2014 Forrester Research, Inc. Reproduction Prohibited20 Technical architecture

21. © 2014 Forrester Research, Inc. Reproduction Prohibited21 How do you select the right solution? › One size does not fit all. All 19 vendors are relevant and worth consideration, depending on your specific requirements. › Forrester included tailored weightings to modify the vendor scores for three common use cases: 1.Corporate compliance, environmental compliance, and social responsibility 2.IT GRC and third-party risk management 3.Financial controls and operational risk management

22. Consolidated platform or best-of-breed › Specialized requirements require best-of-breed solutions. › Consolidated platforms can handle a large number of diverse risks and compliance issues. › Some environments can take advantage of both best- of-breed and consolidated solutions.

23. © 2014 Forrester Research, Inc. Reproduction Prohibited23 Download the Forrester Wave tool for the detailed model and analysis Source: January 27, 2014, “The Forrester Wave: Governance, Risk, And Compliance Platforms, Q1 2014” Forrester report

24. © 2014 Forrester Research, Inc. Reproduction Prohibited24 Customize your weightings Customize the weightings according to your specific needs and use case. Source: January 27, 2014, “The Forrester Wave: Governance, Risk, And Compliance Platforms, Q1 2014” Forrester report

25. © 2014 Forrester Research, Inc. Reproduction Prohibited25 Recommendations 1. Determine the scope and roles that your GRC platform will serve. 2. Expect your implementation to take time (at least four to six months). 3. Identify the top one or two use cases, and roll those out first. 4. Define the metrics and milestones you will use to measure success — and be specific.

26. Thank you Christopher McClean cmcclean@forrester.com Renee Murphy rmuprhy@forrester.com Nick Hayes nhayes@forrester.com @nickhayes10