Ostendio

Ostendio, headquartered in Arlington, Virginia, was founded in 2013 by Grant Elliott to help small and mid-sized organizations manage information security compliance without the overhead of a large GRC team. Its flagship product, MyVCM (My Virtual Compliance Manager), is a cloud-based platform that operationalizes ongoing compliance work — policy management, risk assessment, vendor risk, asset management, incident management, and security awareness training — and maps it against a large library of industry frameworks, with particularly deep, purpose-built support for HITRUST CSF and HIPAA.

That healthcare depth shows up in Ostendio’s customer base: the American College of Cardiology selected MyVCM for compliance management, and MedStar Health adopted the platform to help vet the security posture of the startups and IT vendors it works with — both independently confirmed, named enterprise customers rather than anonymous case studies. Ostendio raised an undisclosed Series A round led by Osage Venture Partners (with Sean Dowling joining its board), its first significant outside venture capital since founding, following years of bootstrapped growth.

MyVCM’s differentiation within the crowded GRC space is breadth combined with healthcare specificity — supporting well over a hundred frameworks while going deeper than generalist GRC tools on the standards that matter most to healthcare and life sciences organizations. It is a mature, decade-plus-old platform rather than an emerging one, which is reflected in its steady rather than explosive growth trajectory.