Hi everyone, I am a designer that was hired to help design a GRC tool MVP. I have no prior domain experience but I’m eager to learn! Please be kind :)

I’m coming to all of you amazing SMEs for help, I’ll take all the info and advice you want to give me! Thank you in advance!

Knowledge I have so far: - an overview of the RMF process - some concepts of personas involved but not the nuances (e.g., small org vs large org) - some concepts of risk baselines and tailoring controls - some concepts of controls to assessment objectives and assessment procedures - some concepts of evidence and implementation statements - Some concepts of an SSP - we’re wanting to start with NIST 800-53 rev 5 controls management with OSCAL and inheritance through system components that other systems can inherit through a component library.

Things I could use help on: - Educational resources - The must-knows for someone in my position - Your idea of what the perfect GRC tool MVP looks like (necessary features and magic wand features) - Any pitfalls to avoid - Best existing tools to reference great UX/UI - Any one that would be interested in testing a prototype!