Security monitoring inside your compliance platform
The Security Command Center shows what is happening across your connected cloud accounts and domains on one page: open incidents, what needs action now, and which connections are watched. It sits in the same platform as your ISO 27001, SOC 2 or CMMC program, so an incident links straight to the controls and clauses it affects.
At a glance
| Area | What you see |
|---|---|
| Sources | Azure (Microsoft Entra ID), Google Workspace and AWS, read hourly; your verified domains, checked daily. |
| Status | One state for the whole page: Critical unacknowledged, Needs attention, No Critical or High incidents, or Not monitoring, shown as a word and a shape, not color alone. |
| Needs action now | Open incidents by severity and age, plus connections that need reconnecting. |
| Identity and access | Risky sign-ins, MFA removed, privileged role grants, app consents and root sign-ins over the last 7 days, and the accounts involved most. |
| Cloud and web | Findings from the providers' own security services, and open findings from the domain deep scan (HTTPS, certificate and security headers). |
| Email and domains | DMARC pass rate from the reports your domains send, recent domain changes, and registrations and certificates nearing expiry. |
| Response | Median time to acknowledge Critical and High incidents against a target, and incidents opened and closed each week. |
| Compliance impact | The clauses in your active frameworks that each open incident touches. |
| Not covered | Endpoints (laptops and servers) and network traffic. |
How it works
Connect read-only
Connect Azure, Google Workspace or AWS with read-only access. TractionGRC reads settings and security events; it does not change anything in your accounts.
Events become incidents
Every hour, events from all your connected accounts are checked for identity attack chains, such as a risky sign-in, then an MFA change, then a privileged role grant within a few hours. One chain becomes one incident.
Know what to do next
Each incident comes with its events and suggested response steps. Acknowledge it, resolve it, or dismiss it as expected activity, and the follow-up work becomes a task with an owner.
Show the compliance side
Incidents are mapped to the clauses they touch, so your team can see what an incident means for ISO 27001, SOC 2 or CMMC, and the response becomes evidence for your program.
Which plan includes it
Starter ($349 a month) shows coverage for Azure and Google Workspace: which connections and domains are watched and which need attention. Professional ($999 a month) adds AWS, incident detection across your accounts, the response measures and the full panels. Enterprise is priced per customer.
Questions
What does the Security Command Center watch?
Your connected Azure (Microsoft Entra ID), Google Workspace and AWS accounts, read hourly, and your verified domains, checked daily. It does not watch endpoints such as laptops and servers, and the page says so.
How are incidents found?
TractionGRC reads identity and cloud events from your connected accounts every hour and looks for attack chains across them, such as a risky sign-in followed by an MFA change and a privileged role grant within a few hours. A chain becomes one incident with its events, its severity and suggested response steps, instead of three unrelated alerts.
Which plan includes it?
Starter shows coverage: which connections and domains are watched and which need attention. Incident detection, response measures and the full panels are on Professional and above.
Is this a SIEM?
No. It is a focused view of identity and cloud signals from the accounts you connect, tied to your compliance program. It does not collect endpoint or network logs, and it is not a replacement for a security operations team. For many small teams it is the first place those signals are watched at all.
How does it connect to compliance?
Each incident type is mapped to the clauses it touches in the frameworks you have active, such as ISO 27001 Annex A or the CMMC practices, and gaps become tasks in the same remediation queue as your control work.