The whole management system, in one workspace
Every part of the platform serves one operating cycle: Risk → Control → Owner → Evidence → Audit → Action → Review → Assurance. Here is what each stage does and where to read more.
The operating cycle
Risk
What could stop you delivering, protecting or complying — scored, owned and reviewed on a schedule.
Risks, controls and evidence →Control
What you do about it, mapped to every clause and Annex A control it satisfies across the four standards.
Integrated management system →Owner
A named person accountable for each control and action, with due dates and email reminders.
Policies and document governance →Evidence
Proof the control operated, dated so staleness is visible — collected manually or automatically from connected systems.
Evidence vault →Audit
Internal audit programmes that test whether controls actually worked, with findings recorded against the control.
Internal audit →Action
Nonconformities and corrective actions with root cause, owner, due date and evidence of closure.
Corrective actions →Review
Management review built from live register data rather than a slide pack assembled the night before.
Management review →Assurance
The same records answer buyer questionnaires, populate a Trust Centre and support third-party risk assessments.
Buyer assurance →What else comes with it
Connected evidence automation
Microsoft 365 and Entra, Google Workspace, AWS, GitHub, Slack and Okta are read for live configuration signals that become dated evidence.
Third-party risk assessments
Send questionnaires by access code, let suppliers save and resume, chase automatically and get an AI review of every submission.
AI-assisted governance
Draft policies, explain failed controls in plain English and produce prioritised remediation plans — always with a human approving.
Service desk and ITSM integration
Push actions to Jira, ServiceNow, HaloITSM, Freshservice, TOPdesk, BMC Helix, ManageEngine or Salesforce with your own severity mapping.
Consultant and MSP workspaces
Run multiple client organisations from one login, with separated data and reusable structures.
Reporting and export
Board-ready reports, heatmaps and CSV import/export across every module so nothing is trapped in the tool.
Who it is built for
UK technology companies, SaaS businesses, managed service providers and technology-enabled professional-services firms, typically 10–250 people — plus the ISO consultants and advisers who run several client workspaces at once.
Boundaries we keep to
iso-standard.app is not a certification body, a penetration-testing provider or a vulnerability scanner. Certification is awarded independently by an accredited certification body following its own audit. AI drafts and suggestions always require a human to review and approve before they become part of your management system.
See how your existing risks, controls and evidence could become one integrated management system
A short walkthrough with a practitioner, using your current material rather than a demo dataset.
Prefer a conversation? Email hello@iso-standard.app — a practitioner responds within one business day.