Compliance.
Finally at home.

See the whole programme in one glance

Readiness by framework, KPI tiles, multi-framework overlap, posture donuts and the control-family spider web. Every framework is scored the way its assessor scores it: SPRS points for CMMC, percentage of Annex A controls for ISO.

• Framework cards with assessment-objective progress and the exact blocker, for example a missing SSP.
• Spider-web coverage per control family (AC, IA, SC, A.5, A.8) so thin spots are visible at a glance.
• Board report in one click: a four-page executive PDF, every export logged in the audit trail.

Assess the way the assessor does

Every requirement is a control card with family, priority, SPRS weight, owner, linked policies, evidence count and status. Filters by framework, family and status keep 200 plus controls manageable.

• NIST SP 800-171A objectives per CMMC practice: tick [a] to [f] and the status suggests itself.
• Official SPRS scoring (5, 3 and 1 point deductions, 3.12.4 handled correctly) so your number matches the DoD's.
• Cross-framework reuse: one implemented control satisfies its ISO, SOC 2 and CMMC equivalents at once.
• No silent edits: saving stamps the review date and writes the audit trail.

Write once. Approve once. Branded PDF, every time.

A department-wise structure, a generate-from-template library and an approval workflow that produces client-branded PDFs. For ISO clients the Statement of Applicability is a live view, not a spreadsheet export.

• Org tree (Company-wide, HR, IT and Security, Engineering, Finance, Operations) filters documents and shows controls owned per department.
• 29 client-neutral templates merged with your name, logo and tagline, plus estate-specific hardening SOPs generated from your inventory.
• Write, preview, send, approve: the approver gets an email, the portal records who approved what, when, at which version.

Risk register and evidence, mapped to controls

A unified register for enterprise, vendor and third-party risks with 5×5 scoring, mitigation tracking and control mapping. Evidence lives in a versioned document library with a freshness clock per file.

• Clickable heatmap (likelihood × impact) that filters the register; high risks without a mitigation plan trip a continuous check.
• Upload once, map to many: the same file satisfies every framework the control maps to.
• Freshness clock: evidence older than 90 days flips the control amber on the dashboard, before an assessor notices.
• Automated evidence from Microsoft 365, Entra ID and Sentinel lands in the same library with the same clock.

Nothing forgotten. What to do, when, by whom.

Frameworks are lost between audits, not during them. SECORA turns every weekly, monthly, quarterly, semi-annual and annual duty into a dated task with an owner, the artefact expected and where to get it, and pushes reminders to the owner through Microsoft Graph.

• 45 recurring duties generated from your environment: SIEM triage, log reviews, stale users and devices, access reviews, restore tests, phishing, vendor check-ins, IR tabletop, pentest, management review, SSP and POA&M refresh.
• Filtered by estate: Microsoft 365 and Sentinel clients get Purview and Sentinel exports; AWS clients get CloudTrail and IAM reports.
• Why it matters: SOC 2 Type II is about operating effectiveness over a window, and CMMC assessors sample recurring practices.

Ask once. Written everywhere.

Eighty-plus questions across eleven sections: who approves offboarding, the stale-account timeline, the user toolset, the application stack, Intune coverage, backup and DR cadence, SIEM retention, incident reporting windows. Answer once and every policy and procedure is customised, automatically.

• Answers become the documents: every answer is a merge token and an "Appendix A: organisation-specific implementation" section inside each policy.
• Answers become the gap analysis: "no offboarding checklist" maps to the CMMC, ISO and SOC 2 controls it affects, ready to apply or untick.
• Answers become the source of truth for the consistency engine on the next tab.

When a policy says "annually" and the procedure says "quarterly", SECORA notices.

Twenty-four measurable parameters (retention, review cadence, password length, offboarding window, lockout, patch SLAs, encryption, TLS, backup and DR cadence) are read out of every document and compared across policies, their linked procedures and your scoping answers. Conflicts carry a red chip and appear in the board report, before an assessor finds them.

Plan it as a Gantt. Ground it in your real estate. Prove it with an append-only trail.

Engagement phases per framework with owners, status and a today marker. An inventory of cloud platforms, physical devices and SIEM that drives which policies, hardening SOPs and evidence connectors are seeded. And an immutable record of every approval, rejection, control change, evidence upload, risk update and monitoring run, shareable with your external auditor.

• 17 vendor-specific hardening SOP blocks (Fortinet, Cisco, Ubiquiti, Dell and more) generated from your inventory.
• Integrations catalogue for Microsoft 365, Azure, AWS, Google Cloud and Workspace, GitHub, Microsoft Sentinel, Wazuh, Splunk, Elastic and network devices, with manual evidence as a first-class option.

Right people. Right slice. Board-ready in one click.

Four roles (Admin, Contributor, Viewer, Auditor) and department-level scope, enforced by SharePoint groups as well as the screen. An HR contributor scoped to HR sees only HR policies, procedures and evidence. Your external assessor is an Auditor with read-only access and the power to mark evidence Verified. Multi-client workspaces partition every record by client for consultancies and MSPs.