BitSight Security Ratings vs. NAVEX One

If you are considering BitSight Security Ratings as a portion or bulk of a larger vendor management project you will be well served in letting the risk scores be an indication of how closely you need to examine a vendor. However, you should not base your assessment solely on the risk score provided. The risk score is based on publicly available data and can be inaccurate.

Incentivized

We have used PolicyTech for over 13 years. We have found it to be a robust solution, that has great technical support, and that continues to evolve as technology changes. If a business is looking for a solution to support best practices in policy and procedure development and distribution, there is no better solution than PolicyTech. We currently use PolicyTech’s SAS service. This solution would not be as effective for business environments that do not have computers for their employees to access on a daily basis.

Incentivized

• Security hygiene tracking over time
• Understandable risk score based on observations
• Predictability model of potential cyber security issues based on security habits.

Incentivized

• Ease of use and ability to modify documents.
• Versatility/Adaptability to utilize for other document management processes
• Ability to assign documents to groups of users to make policy review and notification more job/role specific

Incentivized

• Since data is based on public registration IP and domain data can be stale depending on ISP/Domain registration update delays.
• Correcting a false detection is a month-long endeavor and requires the company with the impacted score to clean up BitSight's data.
• Customer service for incorrect data is convoluted and requires a deep understanding of domain registration to correct the data. The responsibility for correcting data is placed solely on the customer's shoulders.

Incentivized

• In my point of view, I would love this platform if it could be customized more to my personal taste and my needs, in this aspect it has its limitations.
• Unfortunately, the technical support of this program is not the best when it comes to responding, the truth is that they are never capable of responding to our problems on the spot.

Incentivized

Only the administrator can talk to them.

Incentivized

BitSight Security Ratings ranks evenly with SecurityScorecard and both below OneTrust for our use case. We needed a platform that would let us define risk for our organization and weight scores differently based on data sensitivity. BitSight and SecurityScorecard are aggregate data that can provide insight into the security habits of a potential vendor and should be considered as an addition to most vendor management projects. However, they both provide metrics based on hygiene and not on data-defined risk. In concert with a platform to evaluate risk based on data and to inform the overall evaluation of a vendor, BitSight Security Ratings can be made to shine. Just understand that you may have to validate some data.

Incentivized

Navex is best intuitive and satisfied all the security & compliance requirement. ServiceNow GRC is complex & not easy to deployable.. also need that cost effective solution. Even it was tough to customize initially but later after doing fine-tuning with policies & process we got best insights & inputs from solution .

Incentivized

• Wasted resource hours cleaning up data to correct erroneous risk score.
• Extra time spent addressing calls from clients about erroneous risk score data.
• Extra time validating risk score provided by BitSight Security Ratings for potential vendors to ensure valid data.

Incentivized

• Eliminates silos.
• Establishes a holistic central point of governance, management, and assurance of the organization's performance, risk and compliance.
• Lets you make informed decisions.

Incentivized