{"version":"0.42.0","built_at":"2026-11-01T08:34:43.408Z","license":"CC BY 4.0 © Mike Reams","canonical":"https://catalog.mikereams.com","product":{"id":"PR-780","name":"Archer","vendor":"Archer Technologies LLC","category":"Integrated risk management","description":"An integrated risk management platform with use cases for enterprise and operational risk, regulatory and corporate compliance, policy, IT and security risk, third parties, audit and operational resilience on one configurable data model, plus the newer Evolv family of AI features. Offered as SaaS or installed software.","website":"https://www.archerirm.com","license_model":"subscription","deployment":["saas","self-hosted"],"aliases":["RSA Archer","Archer GRC","Archer IRM"],"csdm_note":"One Business Application with an Application Service per environment. Archer often keeps its own list of applications and assets for risk scoping; feed it from the CMDB rather than letting a second inventory grow.","sources":[{"url":"https://www.archerirm.com/","title":"Archer® | Regulatory Change Management"},{"url":"https://www.archerirm.com/reg-corp-compliance-management","title":"Archer Regulatory & Corporate Compliance Management"},{"url":"https://www.archerirm.com/enterprise-operational-risk","title":"Enterprise & Operational Risk Management | Archer"}],"as_of":"2026-11-01","product_capabilities":[{"id":"PC-780.10","name":"Enterprise & Operational Risk Management","description":"A single register of enterprise and operational risks rated on common definitions, each with a named owner and unit; self-assessment campaigns sent to managers with their risks and controls already filled in and approved by the risk team; board and management views showing how ratings have moved.","business_capability_ids":["BC-130.20.10","BC-130.20.20","BC-130.10.20","BC-130.40.20"],"maturity":"core","confidence":"high","source_url":"https://www.archerirm.com/enterprise-operational-risk","business_capabilities":[{"id":"BC-130.20.10","name":"Risk Identification"},{"id":"BC-130.20.20","name":"Risk Analysis & Rating"},{"id":"BC-130.10.20","name":"Risk Taxonomy"},{"id":"BC-130.40.20","name":"Risk Reporting"}]},{"id":"PC-780.20","name":"Loss and Indicator Management","description":"Records of losses with their dates, causes and impact tied to the risks and controls involved, and risk indicators with two warning levels reported by their owners on a set schedule.","business_capability_ids":["BC-130.40.10","BC-130.40.30"],"maturity":"strong","confidence":"high","source_url":"https://www.archerirm.com/enterprise-operational-risk","business_capabilities":[{"id":"BC-130.40.10","name":"Key Risk Indicator Monitoring"},{"id":"BC-130.40.30","name":"Loss Event Analysis"}]},{"id":"PC-780.30","name":"Regulatory & Corporate Compliance Management","description":"Regulatory news gathered from feeds into one library, laws and standards broken down to the clause and linked to the policies and controls that answer them, and the impact of each change reviewed with findings raised from the same record.","business_capability_ids":["BC-140.10.10","BC-140.10.20","BC-140.40.30"],"maturity":"core","confidence":"high","source_url":"https://www.archerirm.com/reg-corp-compliance-management","business_capabilities":[{"id":"BC-140.10.10","name":"Obligation Inventory"},{"id":"BC-140.10.20","name":"Regulatory Change Monitoring"},{"id":"BC-140.40.30","name":"Compliance Issue Remediation"}]},{"id":"PC-780.40","name":"Policy Management","description":"Policies written, reviewed, approved and published to the people they apply to, with exceptions recorded alongside their justification.","business_capability_ids":["BC-120.30.20","BC-120.30.30","BC-140.20.10"],"maturity":"strong","confidence":"high","source_url":"https://www.archerirm.com/reg-corp-compliance-management","business_capabilities":[{"id":"BC-120.30.20","name":"Policy Authoring & Approval"},{"id":"BC-120.30.30","name":"Policy Publication & Access"},{"id":"BC-140.20.10","name":"Compliance Policy Development"}]},{"id":"PC-780.50","name":"Linked Control Library","description":"Each control written once, mapped to every standard it satisfies and tested once, with the result reported against each control set.","business_capability_ids":["BC-130.30.30","BC-140.40.20","BC-160.40.10"],"maturity":"strong","confidence":"high","source_url":"https://www.archerirm.com/reg-corp-compliance-management","business_capabilities":[{"id":"BC-130.30.30","name":"Control Library Maintenance"},{"id":"BC-140.40.20","name":"Compliance Testing"},{"id":"BC-160.40.10","name":"Key Control Testing"}]},{"id":"PC-780.60","name":"IT & Security Risk Management","description":"Technology and security risks, the controls over them and open issues kept together, with Evolv agents that keep watch on them and put the most pressing first.","business_capability_ids":["BC-760.10.20","BC-710.50.30"],"maturity":"strong","confidence":"medium","source_url":"https://www.archerirm.com/","business_capabilities":[{"id":"BC-760.10.20","name":"Security Risk Assessment"},{"id":"BC-710.50.30","name":"Technology Risk Reporting"}]},{"id":"PC-780.70","name":"Third-Party Governance","description":"Third-party risk reviews that Evolv agents can carry out in full, with watch kept on each vendor until its next assessment.","business_capability_ids":["BC-640.40.10","BC-640.40.20","BC-760.60.10"],"maturity":"strong","confidence":"medium","source_url":"https://www.archerirm.com/","business_capabilities":[{"id":"BC-640.40.10","name":"Supplier Risk Tiering"},{"id":"BC-640.40.20","name":"Continuous Risk Monitoring"},{"id":"BC-760.60.10","name":"Supplier Security Assessment"}]},{"id":"PC-780.80","name":"Audit Management","description":"Audit engagements that open with evidence and earlier findings already collected by Evolv agents, which also mark where the auditor should look first.","business_capability_ids":["BC-160.20.20","BC-160.30.10"],"maturity":"partial","confidence":"medium","source_url":"https://www.archerirm.com/","business_capabilities":[{"id":"BC-160.20.20","name":"Fieldwork & Testing"},{"id":"BC-160.30.10","name":"Finding Register"}]},{"id":"PC-780.90","name":"Resilience Management","description":"Business impact analysis, continuity and IT recovery plans, incident and crisis handling and scenario tests on one dependency map of critical processes.","business_capability_ids":["BC-830.10.10","BC-830.10.20","BC-830.20.20","BC-830.40.10","BC-830.50.10"],"maturity":"strong","confidence":"high","source_url":"https://www.archerirm.com/resilience-management","business_capabilities":[{"id":"BC-830.10.10","name":"Process Criticality Assessment"},{"id":"BC-830.10.20","name":"Dependency Mapping"},{"id":"BC-830.20.20","name":"Continuity Plan Development"},{"id":"BC-830.40.10","name":"Crisis Team & Activation"},{"id":"BC-830.50.10","name":"Exercise Program"}]},{"id":"PC-780.95","name":"Archer Evolv","description":"A family of AI products (Foundation, Compliance, Risk and agent Operators) that adds AI to an existing risk program, either on its own or next to Archer GRC, in the customer's data center or as a service.","business_capability_ids":["BC-140.10.10","BC-140.40.20","BC-130.40.20"],"maturity":"emerging","confidence":"medium","source_url":"https://www.archerirm.com/","business_capabilities":[{"id":"BC-140.10.10","name":"Obligation Inventory"},{"id":"BC-140.40.20","name":"Compliance Testing"},{"id":"BC-130.40.20","name":"Risk Reporting"}]}],"page_url":"https://catalog.mikereams.com/products/PR-780"}}