Everything you need to pass. Nothing you don’t.

A precise set of policies, registers, and guides built in live audits and used to pass ISO 27001:2022 and SOC 2. Follow the End‑to‑End Implementation Guide (Waves 0–5), adapt to your stack, capture evidence, ship.

Auditor‑friendly. Founder‑practical. Formats you already use (DOCX, Markdown, Google Sheets, CSV).

A quick tour of the assets

Policy library

120+ documents, versioned and cross‑referenced to ISO & SOC clauses.

  • Access, cryptography, vendor, backup, DR and more
  • Editable in DOCX and Markdown
  • Cloud‑first, GDPR/HIPAA variables pre‑inserted

Statement of Applicability (SoA)

Pre‑mapped matrix for ISO 27001:2022 and SOC 2 TSC cross‑walk.

  • Dropdown justification codes
  • Links to each supporting policy
  • Gap flags for items needing action

Risk register & evidence tracker

The single source of truth we used with TÜV and a Big 4 audit team.

  • 300+ pre‑modelled risks with suggested mitigations
  • Owners, frequencies, artefacts, and deadlines
  • Dashboard shows audit‑day readiness%

RoPA & DPIA templates

Record of Processing Activities and DPIA aligned with GDPR Articles 30 & 35.

  • Logic checks to surface missing fields
  • Sample healthcare entry included

Control‑policy map

Every ISO clause and SOC 2 TSC mapped to policies, records, and tooling.

  • CSV and diagrams.net (draw.io) export
  • Import‑ready for common GRC tools

End‑to‑End Implementation Guide (Waves 0–5)

A wave‑based plan — practical steps, not textbooks.

  • Week‑by‑week timeline (~30 days) with roles and owners
  • DoD per wave and evidence paths (folders, screenshots, tickets)
  • Optimized order to minimize rework across risk, SoA, CI/CD, and vendors

Audit‑interview scripts

Short Q&A your team can rehearse before sessions with TÜV or Big 4 reviewers.

  • Lead auditor intro and evidence walkthrough
  • 15 edge‑case questions with concise answers

Board‑ready deck

20‑slide template to explain posture, risks, and next steps.

  • Example formulas to pull KPIs from the tracker
  • Speaker notes for non‑security execs

Slack & email snippet pack

Pre‑written messages for policy roll‑out, vendor due diligence, and incident drills.

  • Founder‑friendly tone for startups and scale‑ups
  • Reduces pushback when introducing controls

AI compliance portal 12 months

Privacy‑focused LLM that answers questions across your policies, SoA, and registers, and guides your team through preparation.

  • Plain‑English answers with inline citations back to your docs
  • Next‑step checklists you can copy into the tracker
  • Unlimited users; private workspace for your company

Which pack includes what?

Asset ISO 27001 Pack SOC 2 Pack Dual bundle
Full policy library✔︎✔︎✔︎
ISO 27001 SoA✔︎—✔︎
SOC 2 control matrix—✔︎✔︎
Risk register & evidence tracker✔︎✔︎✔︎
RoPA & DPIA templates✔︎—✔︎
End‑to‑End Implementation Guide (Waves 0–5)✔︎✔︎✔︎
Audit‑interview scripts✔︎✔︎✔︎
Board‑ready deck—✔︎✔︎
Slack & email snippet pack✔︎✔︎✔︎
Unified control‑policy map✔︎✔︎✔︎
AI compliance portal — 12 months, unlimited users✔︎✔︎✔︎

Compatibility & formats

You still need to operate the controls and keep records. The packs make that work straightforward and auditable.

Included value — AI portal access

What’s not included (so you don’t waste time)

Choose your pack →

Frequently asked

Do auditors accept documentation that started from templates?
Yes. Auditors look for suitability, completeness, and evidence of operation. You adapt the policies to your environment and attach records that show the controls run as described.
How long to reach “audit‑ready”?
Most small teams follow the End‑to‑End Implementation Guide (Waves 0–5) over ~30 days. With tight scope and focus, many reach audit‑ready in 2–4 weeks.
Type I vs Type II for SOC 2?
Type I attests to design at a point in time; Type II covers operating effectiveness over a period. The control map and evidence tracker support both paths.
Is support included?
DIY packs include Slack Q&A for 30 days (60 days with the bundle) for practical, implementation‑level questions.