Can I load example controls and add my own?

Yes. Example controls are available to load into Implemented Controls for the frameworks you enable. You can edit those examples and add your own controls, then map them to framework requirements.

ISO 27001, SOC 2, ISO 27701 & 42001 Governance Software

ISO 27001 · ISO 27701 · ISO 42001 · SOC 1 · SOC 2

Run framework readiness, implemented controls, governance registers, control calendars, tests, and a publishable Trust Centre from one compliance view. Load example controls for the frameworks you enable, then add and map your own. Included with ISMS Pro.

In one workspace

Framework readiness
Implemented controls
Registers
Calendars & tests
Trust Centre

Start free trial ISMS Pro pricing

Frameworks you can enable

ISO/IEC 27001:2022 Information security
ISO/IEC 27701:2025 Privacy
ISO/IEC 42001:2023 AI management
SOC 1 Financial reporting controls
SOC 2 Trust Services Criteria

Frameworks available: ISO 27001, ISO 27701, ISO 42001, SOC 1 and SOC 2

Enable the frameworks your programme needs. Each one has its own readiness view, while controls, evidence, calendars, and tests stay shared so you are not maintaining a separate register for every standard.

ISO/IEC 27001

2022 · Information security

Build and show an information security management system: risk-based controls, a Statement of Applicability, and readiness for certification audits.

ISO/IEC 27701

2025 · Privacy

Extend the ISMS with a privacy information management system for personally identifiable information, including controller and processor responsibilities.

ISO/IEC 42001

2023 · AI management

Govern how AI is developed and used, with Annex A controls for accountability, data, transparency, and risk across the AI lifecycle.

SOC 1

ICFR · Service organisations

Track controls that matter to customers’ internal control over financial reporting, aligned to the COSO-style baseline used in SOC 1 examinations.

SOC 2

Trust Services Criteria

Prepare for a service-organisation attestation covering security and, where you need them, availability, confidentiality, processing integrity, and privacy.

The same workspace can also track Cyber Essentials, ISO 9001, and HITRUST CSF when those frameworks are enabled.

Compliance in one place: readiness, controls, registers, calendars, and tests

Governance & Assurance is the programme view. Framework scores, the registers you keep for a management system, and the day-to-day assurance work sit on one page instead of in separate spreadsheets. Pair it with Risk Management, Auditing, Document Management, Asset Management, Supplier Management, and Incident Management.

🗂️

One compliance view

Open Governance & Assurance and see every enabled framework’s readiness next to the registers and tools that feed it. Turn a framework on or off without rebuilding the programme.

Readiness cards for enabled frameworks
Registers and tools on the same overview
Shared controls across standards

📊

Framework readiness

Each framework has its own readiness page: clause or category coverage, mapped implemented controls, and the work still open. ISO management systems that use a Statement of Applicability keep that view with the same controls.

ISO 27001, 27701, and 42001 readiness
SOC 1 and SOC 2 category coverage
Statement of Applicability where the standard needs one
What is a Statement of Applicability? →

🛡️

Implemented controls, examples, and your own

Implemented Controls is the operational register: what you actually run, who owns it, and which framework requirements it satisfies. Example controls are available to load for the frameworks you enable. Loading examples does not lock the register — add your own controls and map them to the same requirements.

Load example controls, then edit them
Add your own controls at any time
Map one control to more than one framework
Framework statements stay visible beside what you implemented

📚

Governance registers

Keep the records a management system expects, in registers that are independent of which frameworks you have switched on.

Communications
Context of the Organisation
Interested parties
Legal, regulatory, and contractual requirements
Metrics register
Objectives

📅

Control calendars

See implementation dates, logged tests, and the next review across every implemented control. Open the organisation-wide calendar, or the calendar for a single framework.

Organisation-wide control calendar
Per-framework calendars
Jump from a date to the control

✅

Tests and evidence

Tests lists every control test in one place: overdue, due in 30 days, not yet tested, and in date, with effectiveness recorded as effective, partially effective, or ineffective. Evidence sits in its own library, with an expiry when a file should be reviewed or retired. Gap analysis shows coverage from the controls you assigned and the evidence you hold.

Overdue, due soon, and untested work
Effectiveness on each test
Evidence library with expiry dates
Gap analysis from assignments and evidence

🔗

Trust Centre

Publish a Trust Centre for customers and partners. Choose what is public, available by request, or kept off the page — policies, reports, and certificate marks — and approve or deny access. Unpublished centres stay private until you publish them.

Public page from your business name
Policies, reports, and certificate marks
Access requests you approve or deny
See ISMSVision’s published Trust Centre →

Included in ISMS Pro

Governance & Assurance is part of ISMS Pro at £60 per user per month, with a minimum of 10 licences. Pricing is public, and a free trial is available.

Free trial
Same workspace as risk, audit, and documents
View ISMS Pro pricing →

Load examples, then make the register yours

Examples are ready to load

Start Implemented Controls from example controls for the frameworks you have enabled, including ISO 27001, ISO 27701, ISO 42001, SOC 1, and SOC 2. Edit titles, statements, and mappings after they land in your register.

Add your own controls

Write controls that match how you actually operate, give them a reference, and map them to framework requirements. Examples and your own controls live in the same register.

One control, several frameworks

A control you operate once can satisfy ISO 27001 and show up in ISO 27701, ISO 42001, SOC 1, or SOC 2 readiness without a second copy of the record.

Try the workspace

Start a free trial and load examples, or compare ISMS Pro pricing.

Put ISO 27001, privacy, AI, SOC 1, and SOC 2 in one assurance workspace

Start a trial and open Governance & Assurance, or review public ISMS Pro pricing before you commit.

Start free trial View ISMS Pro pricing

Frequently asked questions

Which frameworks does Governance and Assurance support?

The main frameworks are ISO/IEC 27001:2022, ISO/IEC 27701:2025, ISO/IEC 42001:2023, SOC 1, and SOC 2. Cyber Essentials, ISO 9001, and HITRUST CSF can also be enabled in the same workspace.

Can I load example controls for ISO 27001, ISO 27701, ISO 42001, SOC 1, and SOC 2?

Yes. Example controls are available to load into Implemented Controls for the frameworks you enable. You can edit them after import. You can also add your own controls and map them to framework requirements. Examples and custom controls share one register.

What does the compliance view show in one place?

The overview shows readiness for each enabled framework together with the registers and tools used to run the programme: implemented controls, the control calendar, tests, evidence, and gap analysis.

Which governance registers are included?

Communications, Context of the Organisation, interested parties, legal, regulatory and contractual requirements, the metrics register, and objectives. Risk, documents, assets, suppliers, incidents, and internal audit connect from their own modules.

What do the control calendar and tests cover?

The calendar shows implementation dates, logged tests, and the next review, for the whole organisation or for one framework. Tests lists every control test, including overdue, due soon, and not yet tested, with an effectiveness result.

What is the Trust Centre?

It is a page you publish for customers and partners. You choose what is public or available by request — policies, reports, and certificate marks — and you approve or deny access requests. Nothing is public until you publish the centre.

Does ISO 27001 include a Statement of Applicability?

Yes. ISO 27001 readiness includes a Statement of Applicability built from the same implemented controls. ISO 27701 and ISO 42001 use that pattern where the management system needs it. SOC 1 and SOC 2 readiness is organised by their control categories.

Is Governance and Assurance a separate licence?

It is included in ISMS Pro, publicly priced at £60 per user per month with a minimum of 10 licences. A free trial is available. See ISMS Pro pricing.

Governance & Assurance for ISO 27001, ISO 27701, ISO 42001, SOC 1 and SOC 2