Njordium launches Inspect360 GRC to unify governance and risk
Njordium Cyber Group AB has launched Inspect360 GRC, a governance, risk and compliance platform developed in Sweden and aimed at European organisations navigating an increasingly demanding regulatory environment. The platform is designed to bring internal GRC programmes and third-party risk management under a single traceable record, rather than leaving organisations to reconcile fragmented spreadsheets, shared drives and siloed compliance tools.
The launch formally establishes Inspect360 as Njordium's platform brand. Inspect360 GRC is intended to work alongside the company's existing Inspect360 TPRM (Third-Party Risk Management) product, creating a connected view that spans supplier dependencies, internal controls, policy frameworks, and audit evidence.
The platform
Key technical capabilities include cross-framework control mapping, which allows evidence and controls to be mapped once and reused across multiple regulatory requirements, reducing duplication for organisations subject to overlapping frameworks. The platform also supports traceable decision logging, capturing who approved a risk treatment, on what basis and what followed, a feature that directly addresses auditor expectations under several EU frameworks.
Integrations are available with ServiceNow, Microsoft, Jira, SAP, GitLab and GitHub. Authentication supports Google and Microsoft OAuth with hardware security key options including YubiKey and Google Titan. AI-assisted workflows are included to surface gaps and flag items requiring attention, with Njordium emphasising that human accountability is retained throughout.
Deployment is offered as managed SaaS or on-premises, with the on-premises option positioned explicitly for organisations where data sovereignty or contractual requirements demand greater control over their environment. Mads Becker Jørgensen, chief executive of Njordium Cyber Group, said the platform was designed to shift focus away from compliance checklist maintenance and towards understanding the relationships between requirements, controls, evidence and the risks those controls are intended to manage.
Regulatory context
The timing of the launch is well aligned with the current regulatory cycle in Europe. NIS2 and DORA both became applicable to in-scope organisations in late 2024 and early 2025 respectively, and both require systematic, documented and continuously maintained cybersecurity and operational resilience programmes rather than point-in-time audits. DORA in particular imposes explicit third-party ICT risk management obligations on financial entities and their critical service providers, meaning the integration of supplier risk with internal GRC is no longer optional for regulated firms.
The GRC software market is well established and competitive. Enterprise incumbents including ServiceNow, IBM OpenPages, SAP GRC and RSA Archer hold significant share, while a wave of specialist vendors such as OneTrust, LogicGate and Diligent have built cloud-native platforms with strong compliance workflow features. Njordium's differentiation rests on its European provenance, on-premises deployment flexibility, and explicit positioning around data sovereignty, all of which are increasingly meaningful to public-sector buyers and regulated industries operating under strict data-residency requirements.
The company is headquartered in Stockholm with offices in Malmö and Oslo. It has not disclosed pricing, customer numbers or revenue figures in connection with the launch. The next near-term milestones investors and buyers will watch for are named reference customers and any certifications, such as ISO 27001 or SOC 2, that would independently validate the platform's security posture.