Cyber GRC Built for Real-World Risk
The Cyber GRC platform designed for real-time visibility, continuous monitoring, and actionable intelligence in language the business can act on.
Trusted by organisations globally
What is STREAM®?
STREAM® is the cyber GRC (governance, risk and compliance) platform from Acuity Risk Management. It brings cyber risk, control monitoring, compliance evidence and third-party risk into one place, so security and risk teams can prove their controls work and show which risks matter most, rather than managing each obligation in a separate spreadsheet.
Who is STREAM® for?
CISOs, CROs and risk and compliance teams in regulated organisations, across UK public sector, NHS and healthcare, utilities and critical infrastructure, pharmaceutical manufacturing and rail, and the suppliers they depend on.
Two editions
STREAM Cloud is fast to deploy for teams moving beyond spreadsheets. STREAM Classic is an on-premises edition for mature programmes needing advanced modelling and air-gapped deployment.
Frameworks supported
ISO 27001, ISO 42001, DORA, NIS2 and third-party and vendor risk, mapped once and evidenced against many frameworks together.
- One cyber GRC platform, two editions: STREAM Cloud and STREAM Classic
- Continuous controls monitoring and compliance evidence capture
- Cyber risk quantification to prioritise by financial exposure
- Third-party and vendor risk via the Vendor Management Hub
Why organisations are moving now
Regulators, auditors and prime contractors now ask for evidence that controls work. These are the obligations driving that shift.
DORA
Applies to EU financial entities since 17 January 2025: the register of information and incident thresholds demand evidence, not intentions.
DORA compliance →NIS2
Extends cyber obligations across essential and important entities, as member states bring it into force.
NIS2 compliance →PRA SS1/26
New operational resilience expectations for UK banks and insurers take effect 18 March 2027.
Regulatory readiness →Defence supply chain
MOD has asked suppliers to achieve Defence Cyber Certification Level 0 by 31 December 2026, and primes are already asking for evidence.
Defence cyber assurance →UK Cyber Security and Resilience Bill
Progressing through Parliament and expected to bring managed service providers into scope: time to prepare, not panic.
Cyber GRC →Who uses STREAM®
How regulated organisations and their suppliers apply STREAM® to connect risk, controls and compliance in one operating model.
- You have outgrown the spreadsheet.
- A prime or regulator has asked for evidence.
- You run supplier assurance for others.
- Your audit found the gap first.
Defence supply chain
Tier 2 and tier 3 suppliers evidencing cyber maturity to primes and MOD, from CSMv4 self-assessment to full certification evidence packs.
Financial services
DORA and PRA-regulated firms running the register of information, incident threshold assessment and ICT third-party risk in one place.
UK public sector
Bring governance, risk and compliance into one operating model, with evidence that stays current for audit and assurance reviews.
NHS & healthcare
Connect cyber, digital and clinical-governance risk so teams work from a shared, current picture rather than scattered spreadsheets.
Utilities & critical infrastructure
Monitor control effectiveness continuously and evidence resilience obligations across essential services.
Pharmaceutical manufacturing
Map controls once and evidence them against multiple frameworks together, from quality to cyber and supplier assurance.
Rail infrastructure
Assess and monitor cyber and third-party risk across complex supply chains, with reporting the board can act on.
One platform, two editions, plus the Vendor Management Hub
Choose the edition that fits how your programme runs today.
STREAM® Cloud
For regulated mid-market teams moving beyond spreadsheets: deployed in days, run by lean teams.
Explore STREAM® Cloud →STREAM® Classic
On-premises for mature programmes needing advanced modelling and air-gapped deployment.
Explore STREAM® Classic →Vendor Management Hub
The supplier cyber assessment layer, with transparent published pricing.
Explore Vendor Management Hub →Not sure which fits? Compare editions →
Trusted by regulated organisations
Around 70 organisations
Organisations across government, defence, utilities, healthcare, broadcasting and manufacturing run STREAM®.
Independently reviewed
Recognised on G2 and rated on Gartner Peer Insights.
Read STREAM® reviews on G2 →Established and listed
Built by Acuity Risk Management, founded 2005, part of AIM-quoted Acuity RM Group plc (LSE: ACRM).
Questions buyers ask about STREAM®
What is cyber GRC software?
Cyber GRC software brings governance, risk and compliance for cyber into one system: risks, controls, evidence, actions and reporting. It replaces the network of spreadsheets that regulated teams otherwise maintain by hand.
What is the difference between STREAM® Cloud and STREAM® Classic?
Cloud is the SaaS edition, built for fast deployment and lean teams. Classic is the on-premises edition for mature programmes that need advanced modelling or air-gapped deployment. Both share the same risk-led approach.
How quickly can we be live?
STREAM® Cloud deploys in days, not months, and is built so teams do not need a dedicated GRC specialist to run it.
Which frameworks does STREAM® support?
ISO 27001, ISO 42001, DORA, NIS2 and third-party and vendor risk, mapped once and evidenced against many frameworks together.
Does STREAM® file our regulatory reports for us?
No. STREAM® supports incident threshold assessment and assembles the evidence behind a submission. Filing remains with your firm, which is how regulators expect it to work.
Can STREAM® help if a prime contractor is assessing us?
Yes. Defence suppliers use STREAM® to build the evidence pack behind CSMv4 self-assessment and Defence Cyber Certification, so a prime's questionnaire is answered from a system rather than from memory.
What does it cost?
Vendor Management Hub has transparent published pricing on its page. STREAM® editions are priced to scope: a 30-minute demo is the fastest way to an accurate number.
Who makes STREAM®?
STREAM® is developed by Acuity Risk Management Ltd, founded in 2005, the operating subsidiary of Acuity RM Group plc, quoted on the AIM market of the London Stock Exchange (LSE: ACRM).
Explore the STREAM® platform
STREAM® is developed by Acuity Risk Management Ltd, founded in 2005, the operating subsidiary of AIM-quoted Acuity RM Group plc (LSE: ACRM).