RSA Archer Suite review
A broad IT risk and controls suite for enterprises, with cloud and self-hosted deployment.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Archer, formerly RSA Archer Suite, is an IT and security risk management offering for large, regulated, and multi-entity organizations. It brings together an IT risk register, asset catalog, control assessment, vulnerability remediation, security policy mapping, and incident workflows. Its focus is governance and oversight of technology risk, making it relevant to enterprise teams that need these activities connected rather than handled as isolated tasks.
The suite spans several related security processes: risk assessment uses organizational and asset context; control testing and assessment sit alongside vulnerability prioritization and remediation; and incident workflows cover escalation, investigation, and closure. Security policy and framework mapping includes ISO 27000 series, COBIT 5, NIST 800 series, and PCI DSS. Regulatory-change tracking for IT obligations, risk dashboards, and reporting extend the scope from operational workflows to oversight. Qualys, Tenable, and Rapid7 are listed integrations for vulnerability-related data and workflows.
Deployment is available as cloud or self-hosted software, and the product is positioned for enterprise use. That flexibility may suit organizations with different hosting requirements, though it also means buyers should assess which deployment model fits their environment. According to the vendor's published description, pricing is not public and prospective customers are directed to request a demo; published plan-by-plan costs therefore do not provide a basis for comparison. Archer is a stronger fit for teams prioritizing IT risk, controls, assets, vulnerabilities, and incidents than for buyers seeking a broad GRC scope beyond those areas. Documentation is listed as a support channel, so organizations should consider whether that support model fits their needs.
RSA Archer Suite pros and cons
- Where it wins
- Connects IT risks to organizational and asset context.
- Combines control testing, vulnerability workflows, and incident management.
- Maps policies to frameworks and tracks regulatory changes.
- Where it doesn't
- Pricing requires contacting the vendor.
- The offering centers on IT and security risk rather than full GRC.
- Implementation choices are limited to cloud or self-hosted deployment.
RSA Archer Suite fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update