CertAssist was built by GRC and compliance consultants and auditors who wanted a tool that did the job, without the bloat and integrations that push other platforms into the thousands.
Every control sits on a single board, grouped the way the framework is structured, color-coded by status. No hunting through spreadsheets or endless tabs.
Open a control to record applicability, justification and how it's implemented, then attach the evidence. The Statement of Applicability is built for you as you go, and every change is logged.
Each control ships with a documentation checklist and an evidence checklist written by practitioners. Edit them to fit your business, tick items off, and build audit-ready evidence step by step.
Every workspace includes a library of 49 Word policy templates for ISO 27001 and SOC 2, from the Information Security Policy to access control, incident response, business continuity, privacy, a Code of Conduct and AI use. They are written by practising GRC consultants and auditors, in plain international English.
Download the ones you need, make them yours, and upload the finished policy so your auditor can review it in the same workspace.
Each template highlights exactly what you need to decide, and suggests a starting point so a small team is not left guessing: a 14 character minimum password, ten failed log-ons before lockout, a five minute screen lock. Keep the suggestion or change it, then remove the highlight.
Every assessment has its own dashboard. One number for where you are, a 90-day trend, what moved in the last week and month, and a forecast date at your current pace. Bookmark it and send the link to your board.
Risk, third party suppliers, legal and regulatory obligations, authorities and interest groups, non-conformities, and the ISO 27001 maintenance tasks that keep a certificate alive between surveillance audits. Each is a proper register with owners, review dates and overdue flags, not a spreadsheet someone forgot to update.
Give your auditor read-only access to the exact evidence they need. No email chains, no zip files, no back and forth.
Read-only access to evidence, scoped to what they need to see.
Mandatory authenticator-app MFA on every account, by default.
Generate reports and export spreadsheets for management or auditors.
Always know how close you are, control by control.
The features that push other tools into the thousands are the ones you don't need to get certified. So we left them out.
See it for yourself for a flat $225 a month.
