# Sources

Sources below were located during this research. Supplier pages establish supplier claims and documented behaviour, not independent implementation outcomes. Product documentation is version-specific where identified.

### Product scope, comparisons and pricing

1. IBM OpenPages overview — `https://www.ibm.com/products/openpages`
2. ServiceNow Integrated Risk Management — `https://www.servicenow.com/products/integrated-risk-management.html`
3. Ncontracts bank offering — `https://www.ncontracts.com/bank-risk-management`
4. LogicGate pricing — `https://www.logicgate.ai/platform/pricing/`
5. Archer integration methods, 2024.09 documentation — `https://help.archerirm.cloud/platform_2024_09/en-us/content/platform/integration/int_overview.htm`
6. Optro-issued rebrand announcement, 9 March 2026 — `https://www.prnewswire.com/news-releases/meet-optro-auditboard-unveils-new-identity-as-ai-transforms-grc-302707321.html`
7. Optro Controls Management — `https://optro.ai/product/controls-management`
8. Workiva SOX compliance — `https://www.workiva.com/solutions/sox-compliance`
9. Workiva GRC announcement, 9 March 2026 — `https://newsroom.workiva.com/press-releases/data-silos-executive-clarity-workiva-reimagines-grc-ai-powered-platform-audit-risk`
10. ServiceNow GRC custom-pricing page — `https://www.servicenow.com/in/lpgp/pricing-grc.html`
11. IBM OpenPages pricing and deployment qualifications — `https://www.ibm.com/products/openpages/pricing`
12. Optro pricing — `https://optro.ai/pricing`

### Implementation, migration, integration and operations

13. KPMG, Implement GRC Technology the Right Way — `https://kpmg.com/kpmg-us/content/dam/kpmg/pdf/2024/implement-grc-technology-right-way.pdf`
14. ServiceNow IRM Data Model Design service description — `https://www.servicenow.com/content/dam/servicenow-assets/public/en-us/doc-type/legal/irm-data-model-design-tier-2-service-description.pdf`
15. IBM OpenPages 9.1.x FastMap overview — `https://www.ibm.com/docs/en/openpages/9.1.x?topic=fastmap-overview`
16. Archer ServiceNow integration, including April 2026 release information — `https://help.archerirm.cloud/exchange/content/exchange/integrations/servicenow.htm`
17. IBM OpenPages 9.1.x data export — `https://www.ibm.com/docs/en/openpages/9.1.x?topic=ci-exporting-openpages-data-be-used-by-other-applications`
18. Hyperproof automated control testing, 2 April 2026 — `https://help.hyperproof.app/en/articles/14303627-collecting-proof-automated-control-testing`
19. State Street Archer production-support posting; historical role example — `https://statestreet.wd1.myworkdayjobs.com/en-US/Global/job/Hyderabad-India/Archer-Production-Support---Assistant-Manager_R-789809`
20. ServiceNow Risk Speed Learning tutorial index, updated September 2026 — `https://www.servicenow.com/community/grc-articles/risk-speed-learning-hands-on-how-to-video-tutorials-to-configure/ta-p/3462795`

### Regulation, assurance and AI governance

21. OCC interagency third-party guidance announcement — `https://www.occ.gov/news-issuances/news-releases/2023/nr-ia-2023-53.html`
22. Federal Reserve, Third-Party Risk Management: A Guide for Community Banks — `https://www.federalreserve.gov/publications/2024-may-third-party-risk-management.htm`
23. FTC Safeguards Rule business guide — `https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know`
24. NYDFS Cybersecurity Resource Center — `https://www.dfs.ny.gov/cybersecurity`
25. NYDFS implementation timeline — `https://www.dfs.ny.gov/system/files/documents/2023/11/cybersecurity_implementation_timeline_covered_entities.pdf`
26. SEC cybersecurity disclosure rule announcement — `https://www.sec.gov/newsroom/press-releases/2023-139`
27. PCAOB AS 2201 — `https://pcaobus.org/oversight/standards/auditing-standards/details/AS2201`
28. HHS Security Rule summary — `https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html`
29. HHS HIPAA cloud-computing guidance — `https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html`
30. HHS Security Rule NPRM page — `https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/index.html`
31. The IIA’s current Statements of Position — `https://www.theiia.org/en/resources/statements-of-position`
32. The IIA’s refreshed Three Lines podcast and transcript — `https://www.theiia.org/en/content/podcast/getting-started-with/2026/ep-0040/`
33. NIST Cybersecurity Framework FAQs — `https://www.nist.gov/cyberframework/faqs`
34. NIST AI 600-1, Generative AI Profile — `https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf`
35. NIST SP 1353 initial public draft, 19 August 2026 — `https://csrc.nist.gov/pubs/sp/1353/ipd`