Onspring CISO: Nichole Windholz

What the company sells

Onspring is a flexible, cloud-based GRC platform that connects and monitors business-critical functions, processes and information. Onspring products can be used on their own or together, connecting functions such as internal audit, enterprise risk management and compliance. Onspring Business Resiliency software gives organizations recovery strategies and real-time insights to stay prepared. Onspring AI correlates information across every app and record and takes action based on rules that users define.

Onspring's no-code platform lets users build and manage workflows for approvals, assessments and reviews, without IT dependency. Dynamic GRC workflows in Onspring route content through defined paths for review, input and approval, including internal and external assessments. GRC workflows can be designed and modified with drag-and-drop functionality, and users add steps, assign approvers, embed links to supporting details and include comments. Third-party applications and monitoring services can be integrated into Onspring. Onspring can pull data and content from preferred systems and services so that information on third parties, compliance frameworks and regulatory changes stays up to date.

Onspring compliance management software automates end-to-end tasks for tracking and maintaining adherence to industry regulations and internal policies. Onspring compliance management software covers SOX, ISO 27001, HIPAA, PCI DSS, GDPR, NIST, CMMC and SOC 2. Onspring Policy Management software manages an integrated policy library that handles full policy lifecycles, from authoring to approvals and attestations to exception handling. Onspring AI is available as an add-on that drafts foundational policy language, suggests FAQs and flags regulatory citations.

Onspring provides software to manage inherent and residual third-party risk at the engagement level for an organization and its vendors. Third-party lifecycle management covers due diligence, onboarding, contract review, ongoing performance monitoring, offboarding and exit controls in one system. Surveys can be sent to internal, external and third-party recipients. Questions can be added in the survey builder, and responses can be customized by multiple choice, drop down, text and more. Surveys use branching logic to hide or display questions based on previous answers.

Onspring is offered to federal agencies for managing internal controls in accordance with the Federal Managers’ Financial Integrity Act (FMFIA) and the Government Accountability Office’s (GAO) Green Book. Risk and control content can be imported from external sources, with a focus on security and privacy, after an agency selects the security controls that meet the minimum requirements in FIPS Publication 200 and the control baselines from NIST SP 800-53.^{[1][3][4][5][6][7][8][9][10][11][12][14]}

Categories

• GRC and integrated risk platforms (primary category)
• Third-party risk and security ratings
• Compliance automation
• Privacy management
• Compare Onspring with companies in the same categoryside by side

Headquarters

Not established from our sources

Founded

Not established from our sources

Ownership

Not established from our sources

CISO on record

Nichole Windholz, Chief Information Security Officer (CISO) (roster, verified October 24, 2026)

Website

onspring.com

Products and services

Product names as the company writes them; what each does, in our words, from the company's own product pages. Never how well it does it.

• Compliance Management^[1][8]

  Onspring compliance management software automates end-to-end tasks for tracking adherence to industry regulations and internal policies.

  Onspring compliance management software automates end-to-end tasks for tracking and maintaining adherence to industry regulations and internal policies. Onspring compliance management software covers SOX, ISO 27001, HIPAA, PCI DSS, GDPR, NIST, CMMC and SOC 2.

• Policy Management^[9]

  Onspring Policy Management software manages an integrated policy library across full policy lifecycles.

  Onspring Policy Management software manages an integrated policy library that handles full policy lifecycles, from authoring to approvals and attestations to exception handling. Onspring AI is available as an add-on that drafts foundational policy language, suggests FAQs and flags regulatory citations.

• Business Resiliency^[4]

  Onspring Business Resiliency software gives organizations recovery strategies and real-time insights.

• Onspring AI^[5][9][15]

  Onspring AI correlates information across apps and records and acts on rules that users define.

  Onspring AI correlates information across every app and record and takes action based on rules that users define. Onspring AI is available as an add-on for policy work, where it drafts foundational policy language, suggests FAQs and flags regulatory citations.

• Dynamic GRC Workflows^[6]

  Dynamic GRC workflows in Onspring route content through defined paths for review, input and approval.

  Onspring's no-code platform lets users build and manage workflows for approvals, assessments and reviews, without IT dependency. Dynamic GRC workflows in Onspring route content through defined paths for review, input and approval, including internal and external assessments. GRC workflows can be designed and modified with drag-and-drop functionality.

• Surveys^[12]

  Surveys can be sent to internal, external and third-party recipients.

  Surveys can be sent to internal, external and third-party recipients. Surveys use branching logic to hide or display questions based on previous answers.

Competitors and alternatives

The other companies on our record filed under the same categories, category by category: first those that lead with that category and share more of Onspring's categories, then alphabetical. A list from the record, never a ranking.

• On grc and integrated risk platforms, Onspring competes with Anecdotes, Cynomi, MetricStream, Archer, LogicGate, Optro, ServiceNow, Apptega, Copla, CyberSaint and 6 more.

• On third-party risk and security ratings, Onspring competes with Bitsight, Black Kite, iCOUNTER, Panorays, Prevalent, RiskRecon, SecurityScorecard, UpGuard, Whistic, Anecdotes and 28 more.

• On compliance automation, Onspring competes with Apptega, Copla, Hyperproof, RegScale, Scytale, Vanta, Drata, Scrut Automation, Secureframe, Sprinto and 17 more.

• On privacy management, Onspring competes with OneTrust, Osano, Ketch, TrustArc, BigID, Immuta, Protegrity, Securiti, Skyflow and Transcend.

What review platforms show

The headline rating and review count each platform showed in public search results on the day we looked, with the link. We do not read or reproduce the reviews, and a rating is the platform's, not ours.

• G2 · 4.7 out of 5^[2]seen November 10, 2026

Recent news

Dated company events from the last twelve months, each in one sentence of ours with its source. Newest first.

• July 27, 2026

  Onspring announced the next phase of Onspring AI, which automates workflows and rule-based decisions within boundaries set by system administrators. PRNewswire^[15]

References

Every fact above cites one of these by number. Tier A is the company itself, a regulator or a filing; tier B is trade or business press.

1. [1]onspring.comOnspring · onspring.com · undated page, accessed September 30, 2026 · Tier A: the company, a regulator or a filing
2. [2]Onspring Reviews 2026: Details, Pricing, & Features - G2G2 · undated page, accessed October 31, 2026 · Tier C
3. [3]Automated Business Process Solutions | Onspring TechnologiesOnspring · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
4. [4]Products Archive - OnspringOnspring · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
5. [5]Artificial Intelligence (AI) | Automation | OnspringOnspring · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
6. [6]Dynamic GRC Workflows Improve Your Processes | OnspringOnspring · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
7. [7]Automated Data Integration For Simplifying Workflows | OnspringOnspring · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
8. [8]Compliance Management Software | OnspringOnspring · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
9. [9]Policy Management Software for GRC | OnspringOnspring · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
10. [10]Regulatory Change Management - OnspringOnspring · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
11. [11]Third-Party Risk Management Software - OnspringOnspring · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
12. [12]Easy Surveys for Third-Party Risk Management | OnspringOnspring · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
13. [13]OMB A-123 Risk & Controls Management - OnspringOnspring · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
14. [14]Flexible Pricing - OnspringOnspring · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
15. [15]Onspring Launches the Next Wave of AI Innovation with Agentic GRCPRNewswire · published July 27, 2026 · Tier A: the company, a regulator or a filing

Last verified November 2, 2026. Our code found the quoted passage behind each fact on its source page when the fact was recorded, and re-checks every record against its sources each month.

Recorded September 30, 2026, expanded November 10, 2026 from the references above.

Work for Onspring? Suggest a correction to a fact on this page (with a source on your own domain), or claim this entry by publishing a small file on your domain.