ISO-STANDARD.app

Find the misconfiguration, explain it, and fix it — across Microsoft, Google, AWS, GitHub, Slack and Okta

Most compliance platforms are happy to tell you a control failed and leave the rest to you. ISO-STANDARD.app reads the live configuration of the systems you actually run, reports 25 concrete checks in plain English, and applies the fix on your approval — with a full history and one-click undo.

Detection without remediation is just a longer to-do list

Legacy authentication still enabled. A root account without MFA. An S3 account-level public access block that was never switched on. Repositories where any member can push to main. Dormant guest accounts nobody owns. These are the findings that turn into incidents, and they are all settings — not projects.

Every one of them can be checked automatically and, in most cases, corrected in seconds. That is what the posture engine does.

How it works

1. Connect your systems

Microsoft reuses the tenant you already connected for evidence automation. Others take a service account, IAM key or org token — with read-only scopes if you prefer.

2. Scan on demand or on schedule

Each scan reads the live configuration and records a pass, warning or failure for every applicable check.

3. Work the findings inbox

Findings are ordered by severity, with what was checked, why it matters and the exact place in the admin console it lives.

4. Apply a fix in one click

Where the change is safe and well defined, the platform makes it for you and tells you precisely what it will change beforehand.

5. Undo anything reversible

Fix history keeps the before-state, so a change can be rolled back without digging through a portal.

6. Turn results into evidence

Results are mapped to ISO 27001, SOC 2 and Cyber Essentials controls and can raise risks or corrective actions with an owner.

Coverage at a glance

25
Automated configuration checks
6
Cloud, identity and SaaS systems
1-click
Remediation with before/after detail
Undo
Reversible fixes kept in history

What gets checked, system by system

This list is generated from the live check catalogue in the product, so it always matches what a scan will actually do.

Microsoft 365 / Entra

Identity · 6 checks

Conditional access, legacy authentication, guest accounts, app consent and tenant sharing settings.

  • Legacy authentication is blockedcritical
  • Users cannot consent to third-party appshigh
  • Only admins can register applicationsmedium
  • Dormant guest accountshigh
  • Global administrator count is proportionatehigh
  • SharePoint and OneDrive anonymous linkshigh

Google Workspace

Identity · 4 checks

2-step verification coverage, super-admin sprawl and dormant accounts.

  • 2-step verification coveragecritical
  • Super administrator count is proportionatehigh
  • Administrators all use 2-step verificationcritical
  • Dormant user accountsmedium

Okta

Identity · 3 checks

Password policy strength, MFA enrolment policies, admin count and dormant accounts.

  • Password policy meets baselinemedium
  • MFA enrolment policy is activecritical
  • Dormant Okta accountsmedium

Amazon Web Services

Cloud · 5 checks

Account password policy, unused access keys, S3 public access, root MFA and CloudTrail.

  • Root account has MFA enabledcritical
  • IAM password policy meets baselinemedium
  • Unused IAM access keyshigh
  • Account-level S3 public access blockcritical
  • CloudTrail logging is onhigh

GitHub

Developer · 4 checks

Organisation 2FA, default member permissions, branch protection and public repositories.

  • Organisation requires two-factor authenticationcritical
  • Default member repository permission is readhigh
  • Default branches are protectedhigh
  • Unexpected public repositoriesmedium

Slack

SaaS · 3 checks

Two-factor coverage, workspace admin count and guest account review.

  • Two-factor authentication coveragehigh
  • Workspace admin count is proportionatemedium
  • Guest accounts are reviewedlow

Safe by design

  • Scans are read-only; write permissions are optional and granted per connection.
  • No fix is ever applied automatically — each one is approved by a person, on a specific finding.
  • Every fix states in plain English what it will change before you confirm it, including where the setting lives.
  • Changes that cannot be made safely are marked manual, with a direct link to the right admin console page.
  • Fix history records who applied what and when, with undo for reversible changes.

The artifacts buyers actually ask for

Every artifact below is generated inside the workspace, versioned, timestamped and shareable via a signed link — no last-minute PDF assembly, no "wait, which version did I send them?"

Scan history per connected system with pass, warn and fail counts
Finding detail with severity, control references and remediation steps
Fix log showing who applied each change, when, and the previous value
Cyber Essentials answers backed by live configuration evidence
Risks and corrective actions raised automatically from failed checks
Regression trail showing a control that passed and later failed

Who it's for

IT lead running Microsoft 365 and AWS alone

Pain: Nobody has time to audit tenant settings, so drift is found during an incident.

With ISO-STANDARD.app: A scheduled scan surfaces the drift and fixes most of it in a single sitting.

Startup preparing for SOC 2 or ISO 27001

Pain: Evidence for access and configuration controls is screenshots taken by hand.

With ISO-STANDARD.app: Configuration evidence is produced by the scan and mapped to the control.

MSP managing several client tenants

Pain: Baseline settings differ per client and nobody can prove which are compliant.

With ISO-STANDARD.app: Same check catalogue across every client workspace, with per-client fix history.

Answers buyers, procurement and auditors want

Which systems are covered?+

Microsoft 365 and Entra ID, Google Workspace, AWS, GitHub, Slack and Okta. Each connection is read-only unless you explicitly grant the write permissions needed for one-click fixes.

Will it change my production settings without asking?+

No. Scans are read-only. A fix is only applied when you click apply on that specific finding, and every applied fix is written to a history log with an undo where the change is reversible.

How is this different from a compliance checklist?+

A checklist tells you a control failed. This reads the live configuration of your tenant or cloud account, explains what is wrong in business language, and can correct it in place.

Does it help with Cyber Essentials?+

Yes. Many checks map directly to Cyber Essentials questions — MFA on cloud services, admin account separation, password policy and leaver handling — so answers come from live evidence rather than memory.

What happens to the findings?+

Findings carry severity and control references, feed evidence against the mapped ISO 27001, SOC 2 and Cyber Essentials controls, and can raise a risk or corrective action with an owner and due date.

How often does it scan?+

Scan on demand at any time, and on a recurring schedule so regressions are caught rather than discovered at the next audit.

Related

Go deeper on Microsoft 365 evidence automation, see compliance automation and the evidence vault, or use it to answer Cyber Essentials questions. For your suppliers, see third-party risk assessments.

See what your live configuration actually says

Connect a system, run a scan, and work a findings inbox that fixes things instead of listing them.

Get started See pricingTalk to us

Prefer a conversation? Email hello@iso-standard.app — a practitioner responds within one business day.

← Browse guidesPricing →
AI-enabled — privacy-respecting

AI does the drafting. You keep the control — and the data.

How we handle data →

  • AI that assists — not replaces

    Assisted drafting for policies, risks, controls and buyer questionnaires. Every AI suggestion is reviewed and approved by you before it lands in the record.

  • Opt-in, workspace-scoped

    AI features run only when you invoke them, only against the workspace you're in. We never mine your data to answer someone else's prompt.

  • Your data stays yours

    Prompts routed via the AI Gateway to model providers whose API terms exclude your content from model training. Nothing is sold or shared for advertising.

  • Isolated by design

    Row-level security enforces workspace boundaries at the database. MFA, SSO, audit logs and least-privilege roles govern who sees what.

We never sell personal information, never share it for advertising, and never use your workspace content to train third-party models. Full sub-processor list and Acceptable Use Policy on the Trust page.

MM
Michael McCarroll
Founder · 25+ years
IT governance · Information security · AI
Why this platform exists

Enterprise-grade governance — built for the SMEs and consultants enterprise GRC forgets.

I've spent 25 years in corporate governance — aligning technology, controls and compliance with what the business is actually trying to do. Time and again, the same pattern: the organisations that win new clients aren't the ones with the biggest GRC budget. They're the ones who can demonstrate trust on demand. This platform is the tool I wanted for the SMEs and consultants I've worked with — institutional-grade governance without an institutional price tag, built on the way audits and buyer reviews actually happen.

Read the founder story ·See plans built for SMEs and consultants