01 · Automated testing
Control tests that run themselves
A test exercises a real system and turns what it saw into evidence, so a requirement moves without anyone uploading a file.
- Connected systems, from AWS and Microsoft Entra ID to GitHub, Jira and Cloudflare, are collected on schedule, read-only.
- A TLS test actually offers each protocol version, and a payment page test records every script a real browser runs.
- Failures publish evidence like passes do. Keeping only the passes would be lying by omission.
Why it matters
Evidence stays current on its own, and your team spends its time on judgement, not screenshots.
check:tls-posturePassingHigh
11
Yes
| Result | Test | When (UTC) | Failing |
|---|---|---|---|
| Pass | Payment page scripts | Mon 03:00 | 0 |
| Pass | TLS posture on public endpoints | 1 Oct 04:00 | 0 |
02 · Risk
Risk tracked as it moves
A failing result opens a gap with a severity and an owner, and the next passing one closes it. When a document changes or falls due, what was judged against it is marked for review.
- A high or critical gap holds its requirements at non-compliant until it is closed, in every framework it touches.
- Needs review is never the same as failing. The status says which one you are looking at.
- Evidence warns you before it lapses, and a renewal request opens ahead of time.
Why it matters
You hear about a problem the day it appears, and it is closed long before an auditor could find it.
03 · One record
One place for security and compliance status
One dashboard shows where each programme stands, what needs you, what falls due and the one step that moves the most. Everyone reads the same record.
- Readiness, open gaps, lapsed evidence, days to target and failing checks, all on one screen.
- Every programme moves from Exploring through In progress to Audit ready, and Maintaining after that.
- When the auditor arrives, a report on compliance is approved under a named person and downloads as Word.
Why it matters
No more status meetings to assemble the picture. You know where you stand today, not at the last audit.