What GRC software is suitable (in features and prize) for a small organization (5-30 employees)?

I have had a look at a few softwares but compared to other sass tools these are quite expensive. Which one is the cheapest? It seems that many of them are targeting larger organizations so I might not need all features anyway. My goal is to use it for compliance with a framework like CIS first hand.

cybersecurity employees features goal grc grc software organization organizations prize software suitable targeting tools