ISO 27001 · NIS2 · DORA · +11 frameworks

The auditor asks a question. You have the answer in ten seconds.

Fifteen tabs in a spreadsheet, three versions of the same file sitting in someone’s inbox, and nobody knows which one counts. Certatix keeps your controls, your answers and your evidence in one place, and turns them into a dated, frozen pack you hand to your auditor read-only.

Book a 20-minute demo Sign up

Hosted in the European Union · sign in with Google or Microsoft · two-factor authentication for everyone · your evidence stays with you

62%

Audit readiness38 of 61 applicable controls at target+7 pts over 30 days

A.52.4 / 3.0
A.63.1 / 3.0
A.71.8 / 3.0
A.82.2 / 4.0

A.8.16Monitoring activitiesCritical1 / 4
A.5.30ICT readiness for business continuityCritical0 / 3

On audit day

What you show when the auditor asks for evidence

Show me how you handle security patches.

The auditor, day one

In Certatix, on one screen

Control

A.8.8Management of technical vulnerabilities

Question

Is there a documented technical vulnerability management procedure specifying the roles, the timeframes and the prioritisation criteria?

Computed maturity

3 / 4

one level short of target

Evidence attached

Vulnerability management procedure

A link to your document, on your side

Answer: Handled
Attached on: March 12, 2026
Signed off by: C. Meunier, Head of Operations

Sample data. The control code and the question wording are the ones loaded from the ISO 27001:2022 framework.

The same question, in a spreadsheet

01
Open the file, then check it is the latest version.
02
Find the right tab, then the row for the control.
03
Dig the attachment out of an email thread from March.
04
Have no idea who signed it off, or when.

What a spreadsheet cannot do

Several people fill it in at the same time
Everyone works in the same place, at the same moment. There is one version, and it is the one everybody is looking at.
Each person sees their own area, management sees a single figure
Permissions follow the domain: legal does not see infrastructure. The board reads one completion percentage.
A list of what is missing, with the name of the person to chase
Unanswered questions and missing evidence are listed, each attached to an owner. You know who to write to, not just what is absent.
A frozen, dated version you can share read-only
The pack you hand to the auditor stops moving. It carries its date and its version number, and the change history stays available.

You are preparing your own audit, or preparing other people’s

You are preparing your certification

One team, one audit, one place

Permissions follow the domain: who fills in, who signs off, who sees nothing.
Your director follows progress from a phone, without chasing anyone.
Every status or evidence change is written to a log the auditor can read.

Book a demo Company plans →

You support several clients

A client portfolio, one workstation

Every client in one view: dated engagements, assigned consultants, target audit dates.
You step into a client’s workspace without switching account. A banner says where you are, at all times.
Each consultant has a scope: the controls they may read, the ones they may write.
The client stays in charge: they accept the engagement, set its end date and can terminate it. The workspace and the pack remain theirs.

Book a demo Firm plans →

One engine, several frameworks

The mechanics (applicability, maturity, evidence, audit pack) do not change from one framework to the next. You pick the framework at the top of the screen; your evidence and your roles stay where they are.

ISO 27001:202293 controls, 4 themesAvailable
NIS259 controls, including the 10 measures of Article 21Available
DORA64 controls, operational resilience in the financial sectorAvailable
GDPR51 articles, obligations of the controller and the processorAvailable
ISO 22301:201969 controls, clauses 4 to 10 plus the BIA processAvailable
ISO 42001:202370 controls, clauses 4 to 10 and the 38 Annex A controlsAvailable
ISO 9001:202657 controls, clauses 4 to 10 of the sixth editionAvailable
ISO 14001:202635 controls, clauses 4 to 10 of the 2026 editionAvailable
ISO 45001:201840 controls, clauses 4 to 10, 2024 climate amendment includedAvailable
ISO 50001:201829 controls, clauses 4 to 10, energy review and indicatorsAvailable
ISO 26000:201053 issues, non-certifiable guidanceAvailable
CSRD / ESRS21 ESRS disclosure blocks, double materiality, applies from FY 2027Available
Duty of vigilance19 measures, French 2017 law and the CSDDD, applicable in 2029Available
Qualiopi32 controls, 7 themes, framework in French onlyAvailable

What the French transposition of NIS2 changes

The French bill on the resilience of critical infrastructure and cybersecurity is going through adoption. ANSSI published the ReCyF framework in March 2026. Implementing decrees will name the entities in scope and set the supervision timetable. Preparation, meanwhile, is measured in months: it starts before the deadlines are known.

What we do not store

01
No passwords. People sign in with the company’s Google or Microsoft account; there is nothing here to steal.
02
No payment details. Payment happens on our provider’s hosted pages, never on Certatix.
03
No evidence files. Your documents stay where they are: Certatix keeps only the link, its label and its date. Two-factor authentication is mandatory for everyone from first access, and organisations are strictly partitioned.

controls covered, across 14 frameworks: 692
audit questions, each traceable to a piece of evidence: 2,691
maturity level, computed rather than self-declared: 0 – 4
interface and audit pack in four languages

On audit day, you have the answer. And the evidence. And the date.

Twenty minutes is enough to tell whether this fits your organisation: your framework on screen, your questions, no commitment.