Book a demo
Governance & ISMS

Clause by clause, not binder by binder.

The management-system core every ISO standard shares: context and interested parties, measurable objectives, management review, your Statement of Applicability, and the certification cycle. Scroll through it one clause at a time.

Book a demo Watch the tour
  1. 4ContextIssues, interested parties, scopeContext register
  2. 5LeadershipPolicy, roles, commitmentPolicies · RBAC
  3. 6PlanningRisks, objectives, SoARisks · Objectives
  4. 7SupportCompetence, awareness, documentsTraining · Docs
  5. 8OperationControls running day to dayControls · Vendors
  6. 9PerformanceMonitoring, audit, reviewAudits · Mgmt review
  7. 10ImprovementNonconformity and correctionNCRs · CAPA

Clauses 4 to 10 are shared by ISO 27001, ISO 9001 and ISO 42001. CompliLens has a home for every one.

4.1–4.3Context & Interested Parties

Define what shapes your program

A short, structured description of your organization's situation: what influences your security program, who cares about it, and what the program covers.

ISO standards begin here (clauses 4.1–4.3). An auditor's first question is usually "What is in scope and why?"

Internal issuesRapid hiringLegacy ERP without MFA
External issuesNew DPDP RulesCustomers ask for SOC 2
Interested partiesCustomers: yearly evidenceRegulator: 6-hour reportsStaff: clear rules
How it works
  1. Add internal issues (for example "rapid hiring," "legacy systems") and external issues (for example "new privacy laws," "customer demands").
  2. Add interested parties such as customers, regulators and employees, along with what each expects from you.
  3. Optionally link each item to related controls, policies and risks.
  4. Write the scope statement (what the program covers) and the exclusions (what it does not, with reasons).
  5. Pick which regulations apply (for example GDPR, RBI, SEBI). This turns on the matching regulation features across the product.
  6. Add a security contact email, which appears on your public Trust Center page.
Example
Northwind lists "Customers require ISO 27001" as an external issue and "Supermarket chains" as an interested party with their expectations.

Who uses itCompliance managers.

6.2Objectives & KPIs

Goals that measure themselves

Measurable goals for your security and compliance program, tracked automatically.

Standards require you to set objectives and show you measure them. Numbers beat opinions.

Achieved
Open critical risks below 5Now 3 · target 5
At risk
Training completion 95%Now 94% · target 95%
On track
Overdue CAPAs under 10%Now 8% · target 10%
At risk
Incidents resolved in 24hNow 31h · target 24h
How it works
  1. Create an objective, for example "Keep open critical findings below 5," and set a target value and target date.
  2. Choose where the number comes from. Most come live from your data: open risks, how fast incidents are resolved, training completion, NCR aging, overdue corrective actions, open connector findings, policy acknowledgement, vendor-evaluation coverage. Or enter a number manually.
  3. CompliLens calculates the current value itself, and sets the status automatically: On Track, At Risk, Missed or Achieved.
  4. A progress bar and a Refresh button show the latest value.
Example
"Complete evaluations for 90% of active vendors." If only 40% are done, it shows At Risk.

Who uses itCompliance managers, leadership.

9.3Management Review

Management review, prepared before you sit down

A digital record of the formal leadership meeting required by ISO (clause 9.3).

Missing management reviews is one of the most common serious audit findings. This module makes the meeting easy to run and easy to prove.

app / management-reviews / MR-003
Meeting overview · last 6 monthsLive data
Objectives achieved4/9
NCRs raised22
Incidents12
Vendor evaluations5
Major NCRs10
Minor NCRs5
Observations7

Nine Clause 9.3 sections · notes per item · locked minutes as PDF

How it works
  1. Schedule a review with a date, chair and attendees.
  2. Open the Performance tab. A Meeting Overview shows live numbers for the last six months: objectives, NCRs, incidents, completed audits, vendor evaluations and interested parties.
  3. Click any tile to see the actual list. Click an item to open it in a new tab, then come back, and your meeting notes are still there.
  4. Press Generate from live data to auto-write the performance summary.
  5. For each item discussed, type a short note and conclusion.
  6. Fill in the nine required sections (previous actions, context changes, performance, feedback, risk results, improvement opportunities, resource needs, objective changes, decisions).
  7. Press Create Action Item Task to turn a decision into a tracked task.
  8. When finished, Finalize. The review locks so it cannot be altered later, and you can download the minutes as a PDF.
Example
The chair clicks "NCRs: 22 raised" in the meeting, sees the list, notes "vendor-related findings need tighter onboarding," and assigns a task.

Who uses itCompliance managers and leadership.

Annex AStatement of Applicability & Controls

A Statement of Applicability that stays current

The master checklist of safeguards from a standard, showing how each applies to you and how complete it is. In the app this page is called Controls.

This is the heart of an ISO 27001 program. Auditors read it first.

app / controls / iso-27001
ISO/IEC 27001:2022 · Annex A93 controls
Implemented71
In progress15
Not started6
Not applicable1
RefControlStatusMaps to
5.15Access controlImplementedSOC 2 CC6
8.24Use of cryptographyImplementedGDPR Art. 32
5.23Cloud services securityIn progressRBI
8.30Outsourced developmentNot applicableJustified
How it works
  1. Choose a framework from the dropdown at the top (for example ISO 27001).
  2. If it has not been used yet, click Activate. CompliLens creates one editable control for each requirement in the standard (ISO 27001 has 93).
  3. For each control, set Applicable / Partial / Not applicable, write a justification, set the implementation status (Not started, In progress, Implemented), and name an owner.
  4. Open a control to link policies, vendors, assets, risks and evidence to it.
  5. The Frameworks tab inside a control shows which other frameworks this same control helps satisfy (the crosswalk).
  6. Use Scope segments to say which assets and vendors are in scope for the framework.
  7. Four KPI tiles show mapped controls, control completion, evidence completion and asset readiness. A gap callout lists requirements with no matching control.
  8. Use Import / Bulk Update to update many controls from a spreadsheet at once.
  9. Domain sections can be collapsed, so a large list stays easy to scan.
Example
One "Encryption" control also counts toward SOC 2 and GDPR, so you do the work once and get credit in all three.

Who uses itCompliance managers; auditors (read-only).

CertCertifications

Never be surprised by a surveillance audit

A tracker for your certificates (ISO 27001, ISO 9001, and so on).

Certificates need renewal checks at fixed times. Missing one can cost you the certificate.

ISO/IEC 27001 certification cycleCertified
✓
Stage 1

Documentation review · done

✓
Stage 2

Implementation audit · done

✓
Certified

Certificate recorded

•
Surveillance 1

Due in 24 days · reminder sent

3
Surveillance 2

Next year

4
Recertification

Year three

How it works
  1. Add a certification: framework, certification body, certificate number, scope and exclusions.
  2. Enter key dates: Stage 1 audit, Stage 2 audit, initial certification, surveillance audits, recertification due.
  3. A visual timeline shows what is done, what is coming within 45 days, and what is still ahead.
  4. The status moves through a sensible order and prevents impossible jumps (for example going straight from "planned" to "certified").
  5. CompliLens reminds your managers 30 days before each surveillance or recertification date.

Who uses itCompliance managers.

ISO 27001, ISO 9001 and ISO 42001 share the same clause skeleton. Set up context, objectives and management review once, and every management system you run uses them.