The biggest challenge lies in my limited knowledge regarding the strategy and compliance map. These concepts seem overwhelming and complex, making it challenging to comprehend the cloud aspect of building compliance, mapping controls, and executing API projects. There is a dire need for clear and concise guidelines to aid new learners in quickly grasping these concepts. However, the automation aspect is much simpler to use.

The time to deploy depends on the requirements of the client. Some of the deployments can take several months.

GRC does require some planning / attention to detail. I would say Rsam was far easier than our Archer implementation... but it still had some complexities in deciding on organizational structure and workflow.