Audit prep. Every day, not every year.
Seven frameworks and 107 controls, scored per client from device, Microsoft 365 and risk evidence, plus attestations for the policies no agent can see. Know which clients need attention before the auditor asks, and show a client exactly what one fix will move.
Built for compliance from the ground up
Every control reads as compliant, near compliant, gap or not assessed, per client. Automated controls read device checks, Microsoft 365 tenant controls and open risks; organisational controls are attested by a person with the authority to say so.
NIS2: 11 controls
The Article 21 measures as eleven controls per client, from risk analysis and incident handling to cryptography and access control. The obligation-by-obligation breakdown, and the Article 23 notifications, live on the NIS2 page.
See the NIS2 breakdownISO 27001:2022: 24 controls
Annex A controls from the 2022 edition, such as A.5.24 for incident planning. Technical controls read evidence from devices, Microsoft 365 and open risks; organisational controls are attested.
CIS Controls v8: all 18
All eighteen CIS Controls, with the safeguards drawn from the same source as the CIS hardening checks on every device. A safeguard and its framework control cannot drift apart.
SOC 2: 19 controls
New. The Trust Services Criteria an MSP is most often asked to evidence, such as CC7.4 for incident response, scored from the same evidence as every other framework.
DORA: 13 controls
For financial-sector clients: ICT risk management, incident handling (Art. 17) and resilience, with continuous asset and vulnerability visibility as the technical evidence.
NIST CSF: 11 controls
Mapped with NIST CSF 1.1 category identifiers such as PR.AC, PR.IP and DE.CM, so an assessor can trace every control.
GDPR: 11 controls
New. The GDPR security and notification duties, such as Art. 33 for breach notification, next to the same technical measures the other frameworks already read.
Answers for the auditor, and for the client meeting
The half of an audit no agent can see is now part of the score, and the half it can see is graded the way an auditor would read it.
Policies count, not just telemetry
Incident response, backups, supplier risk, awareness training and governance are controls too. A client super user, the partner or Secuno staff attests compliant, nearly compliant or gap, with a note and an optional evidence file. Every attestation is kept, it lapses after its review period (a year, six months for backups), and the person who attested is reminded 30, 7 and 1 days before.
Attest once, cover every framework
An incident response plan is CIS 17, ISO A.5.24, NIS2 21.2.b, DORA Art. 17, SOC 2 CC7.4 and GDPR Art. 33. One attestation covers all of them, and only controls that genuinely are the same requirement can be linked.
Near compliant is not a gap
A control that fails on 1 device in 200 no longer wears the same red badge as one that fails on every device. At 95% or more of assessed devices and tenants passing, it reads near compliant with its pass rate: a finishing job, not a crisis. The headline percentage still counts only fully compliant controls.
One fix, several frameworks
Every control shows the controls in other frameworks that read the same evidence. Turning on BitLocker moves seven controls in seven frameworks, and the page says so, which is the argument that gets a client to approve the work.
Documents where the auditor looks
Attach the policy or the console screenshot that backs an automated control. Supporting documents sit on the control page, travel with an auditor link when you include evidence, and never change a status.
A history, not a snapshot
Every client and framework is recorded nightly, so you can show a client the trend since last quarter instead of a single reading. Checks that could not run or do not apply are never counted as a pass.
Run compliance for every client from one place
Built for a partner managing many clients, and just as useful for one organisation managing itself.
Portfolio, worst first
Every client on one framework, worst first, with the change over 30 days and the controls failing for the most clients. The dashboard adds a comparison with your own clients of the same industry and size, shown only when at least three are comparable.
Simulator
Tick the controls a client would fix and see the percentage afterwards and what moves in other frameworks. It turns a budget conversation into a concrete list, and the list into a campaign.
Campaigns
Coordinate one fix across many clients with a due date, and watch progress measured from their devices, or set by hand where no device check applies.
Calendar
Campaign deadlines, attestation renewals, scheduled reports and, for clients classified as NIS2 essential or important, the notification clocks of each open incident.
Auditor links
A read-only link for an auditor with no account: valid up to 90 days, optionally password protected, optionally with evidence files, revocable at any time and counted each time it is opened. It is shown once, and it never shows hostnames or other clients.
Framework reports
A per-framework PDF or CSV per client, previewed on the page and optionally emailed on a schedule. The compliance report in Reports reads the same frameworks, so the two never disagree about the same client.
Map a control to a rule that runs every day
Define multi-condition rules against live inventory and posture, and map each one to the framework controls it covers. When the conditions hold, a risk is raised carrying the evidence behind it.
- Conditions run against devices, Microsoft 365 users, applications and findings, and certificates, not device inventory alone
- Presets ship as versioned content rather than a copy frozen when it was pasted, and the Microsoft 365 ones arrive with their framework references filled in
- Map a rule to framework controls and it renders as coverage on the compliance report
- Escalate the severity when a rule-raised risk stays open past a threshold you set
- Preview the impact with a dry run before the rule goes live
Example rules, mapped to frameworks
BitLocker disabled on any device
NIS2 Art. 21 · CIS 3.11
Windows Defender disabled
NIS2 Art. 21 · CIS 10.1
Firewall profile set to off
NIS2 Art. 21 · CIS 4.5
Unknown account added to Administrators group
ISO 27001 A.8.2 · CIS 5.4
Unknown listening process (port > 1024)
CIS 4.8 · NIS2 Art. 21
No active antivirus product detected
CIS 10.1 · NIS2 Art. 21
Rules are evaluated on a schedule against everything in scope. When the conditions hold, a risk is raised carrying the predicate that matched and the value it actually read. Rules and thresholds are configured per client, or once across the whole portfolio.
The full rule and automation engine, including what can happen after a risk is raised
See how Secuno supports your compliance obligations
We walk you through the portfolio view, an attested control, the simulator and an auditor link, live in the platform.