Pricing Contact Sales Book a Demo
Pricing Contact Sales Book a Demo

North Carolina SISM Compliance Software

The GRC Assessment Platform™ for NC SISM compliance

Isora GRC gives security teams one connected workspace to assess security practices against North Carolina SISM requirements, collect evidence, and track risks and remediation across systems and vendors.

Book a Demo
Trusted by established organizations & partners
https://vt.eduhttps://www.af.milhttps://utexas.eduhttps://yale.eduhttps://www.tdi.texas.govhttps://www.ttuhsc.eduhttps://aws.amazon.comhttps://www.osu.eduhttps://www.wilcotx.govhttps://www.utoronto.cahttps://www.tdcj.texas.govhttps://www.uchicago.edu/enhttps://www.utah.eduhttps://dir.texas.govhttps://www.dps.texas.govhttps://www.berkeley.eduhttps://www.techstars.comhttps://cccs.eduhttps://www.iwu.eduhttps://msu.eduhttps://www.auburn.eduhttps://www.stthomas.eduhttps://www.getezmoney.comhttps://www.sait.cahttps://www.ubc.cahttps://www.cuanschutz.eduhttps://www.tjc.eduhttps://marymount.eduhttps://www.umt.eduhttps://www.pdx.eduhttps://www.tccd.eduhttps://ltu.eduhttps://morantechnology.comhttps://www.merit.eduhttps://www.tccd.eduhttps://www.gonzaga.eduhttps://www.bhc.eduhttps://www.dallascollege.edu

Problem

NC SISM spreads compliance across dozens of executive agencies

Meeting NC SISM is challenging when NCDIT sets policy, agency CISOs execute, and assessments, POA&Ms, and VRARs live in separate spreadsheets and shared drives. When assessment results are due to ESRMO within 30 days, the agency CISO assembles a response from five different files and hopes the numbers reconcile.

Solution

One platform for the NC SISM compliance lifecycle

Isora GRC structures the workflows NC SISM requires in one connected workspace, with NIST-aligned assessments mapped to SCIO-SEC policy families, risk and POA&M tracking, VRARs linked to asset and vendor inventories, and reporting aligned to EGRC submission requirements. Every control, risk, and inventory item stays connected, so the compliance record ESRMO expects stays verifiable.

Assessment Management

Run NIST-aligned assessments mapped to SCIO-SEC policy families

Launch structured assessments using prebuilt questionnaires aligned to NIST SP 800-53 control families and SCIO-SEC policies 301–318. Target agency departments, systems, and data repositories, and collect access control documentation, encryption records, and incident response procedures inline with each response. Recurring campaigns cover both the annual assessment requirement and the three-year independent assessment cycle.

Learn More

Inventory Management

Link VRARs to asset and vendor inventories

Link every system, application, and vendor record to its assessments, risks, POA&Ms, and documentation. Track Vendor Readiness Assessment Reports (VRARs) and third-party attestations (FedRAMP, SOC 2, ISO 27001) in the same workspace. When procurement or ESRMO asks about a vendor's security posture, the VRAR, assessment history, and risk rating are already connected.

Learn More

Risk Management

Turn SISM findings into tracked POA&Ms

Publish control gaps straight from the assessment to the risk register and POA&M tracker. Every finding carries lineage across the SCIO-SEC policy it maps to, the NIST 800-53 control it references, the assessment that surfaced it, and the system it applies to. Assign owners, set remediation milestones, and track progress toward the 30-day ESRMO submission window.

Learn More

Reports & Scorecards

Produce EGRC-ready reports for ESRMO oversight

Generate reports that pull from live assessment scores, POA&M status, risk register entries, and inventory records to show control implementation, remediation progress, and program maturity across the agency. Outputs align to EGRC submission requirements and SCIO-SEC policy families, and export in formats ready for ESRMO review, State CIO oversight, and agency leadership.

Learn More
Let’s Chat
See the GRC Assessment Platform in action
Isora GRC is the GRC Assessment Platform™ that gives security teams one connected workspace to run assessments, manage vendors and assets, track risks, and prove compliance.
Book a Demo
Latest Content
Our latest content
Stay ahead of the curve with our latest research on a diverse range of topics exploring the ever-changing world of governance, risk, and compliance.
US State InfoSec Regulations: Complete Guide [2026]

State Information Security Regulations: Complete Guide Across the U.S., all fifty state governments have issued their own state information security...

Learn More
Article Arizona California SIMM 5300 Florida Cybersecurity Act North Carolina Ohio ORC 9.64 Pennsylvania Regulations State Regulations TAC 202 Virginia SEC530 Wisconsin Public Sector
What Is North Carolina’s Statewide Information Security Manual (SISM)? Complete Guide

All of North Carolina SISM's (Statewide Information Security Manual) requirements, controls, implementation steps for agency compliance.

Learn More
Article North Carolina Public Sector
Read More
Frequently Asked Questions
North Carolina SISM Compliance FAQs
Find the answers you need here, or chat with us.
Contact Sales
What is North Carolina's SISM and who must comply?

The Statewide Information Security Manual (SISM) establishes minimum cybersecurity requirements for all North Carolina executive-branch agencies, departments, and institutions. Issued under the authority of the State CIO and enforced by ESRMO, SISM aligns with NIST SP 800-37 (Risk Management Framework) and NIST SP 800-53 Rev. 5 (Security and Privacy Controls). SCIO-SEC policies 301–318 define the control domains agencies must implement.

What are SCIO-SEC policies and how do they relate to SISM?

SCIO-SEC policies 301 through 318 translate NIST SP 800-53 control families into enforceable, North Carolina-specific standards. Each policy governs a security domain — access control, risk assessment, incident response, system integrity — and defines implementation requirements for executive agencies. Together with SISM, they form the operational framework for statewide cybersecurity compliance.

How do agencies report to ESRMO under SISM?

Agencies must submit risk assessment results and remediation plans to ESRMO within 30 days of completion through the EGRC system. Isora generates structured reports aligned to EGRC submission requirements, consolidating assessment findings, POA&M status, and continuous monitoring data into exports ready for ESRMO review.

How does Isora support North Carolina's three-year assessment cycle?

SISM requires agencies to complete a risk and security assessment every year and an independent third-party assessment at least once every three years. Isora supports both approaches with NIST-aligned questionnaire templates, recurring campaign scheduling, structured evidence capture during assessments, and remediation tracking. Agencies document assessment cycles, track POA&M closure, and demonstrate continuous improvement across multiple review periods in one platform.

Can Isora handle VRARs and vendor oversight under SISM?

Yes. Isora tracks Vendor Readiness Assessment Reports (VRARs), third-party attestations (FedRAMP, SOC 2, ISO 27001), and contract controls required under SISM. Each vendor record links to associated assessments and risks, providing complete visibility into third-party compliance and supporting ESRMO vendor oversight.

How long does it take to deploy Isora for SISM compliance?

Isora deploys in weeks, not months. No-code setup, no consultants, no dedicated admin headcount. Agencies can run their first NIST-aligned assessment within days of onboarding. Prebuilt NIST SP 800-53 questionnaire templates map to SCIO-SEC policy families out of the box.

Woot!
We got your request. Hang on tight and we'll get back to you!
Thanks!
You successfully subscribed to our newsletter