Resources
Tools, guides and templates we use on engagements.
Everything here is free, needs no account, and comes from readiness work with real companies. The tools run in your browser. The guides are written to be acted on, not skimmed. Where we ask for an email it is to send you a file, nothing else.
Tools
Workspace
Your workspace
Save the explorer, the Statements of Applicability and the AI risk register to an account, share them with your team, and let statuses flow between frameworks.
Tool
Audit Simulator
Rehearse SOC 2 or ISO 27001 fieldwork with an AI auditor that probes vague answers and writes a readiness report with findings.
Tool
Security Questionnaire Helper
Paste a customer questionnaire question; get a draft answer, the control behind it and the evidence to attach.
Tool
SOC 2 Control Explorer
All 51 criteria with what the auditor tests, the common gap and the evidence per series. Mark your status, download the gap list.
Tool
ISO 27001 SoA Builder
All 93 Annex A controls with 2013 mapping and typical evidence. Decide applicability, record status, export the Statement of Applicability.
Tool
Policy Generator
Four starter policies as Word files with your company, owners, dates, systems and commitments filled in from a short form.
Workspace tool
Bulk Questionnaire Drafting
Paste or upload a whole security questionnaire and get a draft answer, control reference and evidence for every row.
Tool
AI System Register
An ISO 42001 system record with EU AI Act classification and the Annex IV documentation outline, per AI system, as a Word file.
Tool
ISO 42001 SoA Builder
The 38 AI management controls pre-selected for provider or user, plus an AI risk register worksheet on the standard’s scales.
Tool
EU AI Act Applicability Checker
Seven questions to find out which part of the Regulation an AI system falls under, and the date each obligation applies.
Tool
Compliance Calendar Generator
A 24-month calendar of control activities and audit milestones for SOC 2, ISO 27001, HITRUST and ISO 42001, as .ics or .csv.
Tool
Readiness Assessment
Fifteen to twenty questions about how you run security today; a readiness score per framework and your top priorities.
Tool
GitHub Security Spot Check
Branch protection, required reviews, Dependabot, secret scanning and 2FA across your repositories from a read-only token that never leaves your browser.
Reference
Readiness Benchmarks
How companies score on the readiness assessment by size and framework, from anonymised results.
Auf Deutsch
KI-Verordnung: Anwendbarkeitsprüfung
The EU AI Act checker in German, with a German resources hub for the rest.
Guides
Reference
Regulatory Watch
Dated changes and coming deadlines across the EU AI Act, NIS2, CRA, US state privacy, HIPAA, CMMC, PCI DSS, ISO 27001 and SOC 2, with what each means.
Workspace tool
Trust pages for clients
A hosted trust page with your certifications, practices, subprocessors and documents on request, approved from your workspace.
Guide
What SOC 2 Really Costs
Every cost component, what drives each one, the costs nobody budgets for, and a budget estimator.
Guide
50 Security Questionnaire Questions, Answered
The control behind each common question, a draft answer, the evidence that settles it, and what to say when you do not have it yet.
Guide
Vendor Risk Playbook
Inventory, tiering, a 32-question vendor questionnaire, how to read a vendor’s SOC 2 report, and CUEC tracking.
Guide
ISO 27001 Annex A Evidence Guide
The artifact that usually satisfies each of the 93 Annex A controls, for cloud-hosted companies.
Guide
Questions Your Auditor Will Ask
Twenty-two questions from real fieldwork, with what the auditor is testing and what a good answer looks like.
Guide
How to Choose an Auditor
What separates audit firms, the questions to ask in the proposal stage, and the red flags.
Guide
ISO 42001 Starter Guide
The AI management system standard explained for teams that need to start this quarter.
Reference
Compliance Glossary
Forty-six terms from bridge letter to Statement of Applicability, defined the way auditors use them.
Checklists and templates
Checklist
SOC 2 Readiness Checklist
Forty items with the evidence each one needs, in the order a readiness project runs.
Checklist
Audit Evidence Checklists
Evidence lists per framework: SOC 2, ISO 27001, HITRUST and ISO 42001, organised by control area.
Templates
Policy Starter Pack
Four audit-ready policies in Word: Information Security, Acceptable Use, Access Control, Incident Response, with framework mapping tables.
Bring your next audit into the light.
Book a free 30-minute consultation. We will map where you are, what your customers need and the fastest path to get there.