SOC 2, ISO 27001, NIS2, ISO 14001 and ISO 45001 come ready-made. Write each control once, keep the policy behind it approved, and follow every gap until it is closed. We run our own SOC 2 programme this way.
A control is something your organization actually does, like reviewing who has access every quarter. In 21RISK it exists once. The requirements it meets, the policy that describes it, the evidence that it happened and the findings against it all link to that one control.
Filter your policies and findings by a control to see everything that stands behind it.
Most compliance work is not hard. It is scattered, and every audit starts with putting it back together.
One spreadsheet tab per framework, with the same controls copied between them. Change a control and every other tab is out of date.
The document is there. Who approved it, which version was in force in March and when it is due for review is somewhere else.
The access review happened. The proof is a screenshot in an email, and next quarter someone has to remember to do it again.
Start from the framework, describe what you actually do, and keep the record up to date as the year goes.
Add SOC 2, ISO 27001, NIS2, ISO 14001 or ISO 45001 with its requirement tree and suggested controls, or build your own from a customer’s or an insurer’s requirements. Mark what does not apply, with the reason.
Give it an owner and map it to every requirement it meets, in any framework. Adopt a second framework and the controls you already have are linked to it, not written again.
Approve the policy behind each control, on record. Set evidence tasks that come back every quarter and cannot be completed without a new file. A finding stays open until it is fixed.
Map each control to every requirement it meets, mark what does not apply with the reason, and see the gaps per framework.
POLICIESEach policy with its owner, the controls it covers, a recorded approval and a review date that does not get forgotten.
FINDINGSEvidence tasks that return every quarter and need a new file each time, and audit findings followed until they are fixed.
Auditing each site against a checklist, in its own language? That is site audits, under Safety.
Each page shows the framework as it looks in 21RISK, what the suggested controls cover, and what 21RISK does not do for that standard.
The trust services criteria, evidence for every quarter of a Type 2 period, and how we run our own.
ISO 27001Clauses 4 to 10 and Annex A, with exclusions kept on record and the controls you can reuse for NIS2.
NIS2The directive’s requirements, the controls you already run for ISO 27001, and the gaps left.
ISO 14001One environmental management system across many sites, with every finding linked to its clause.
ISO 45001 comes ready-made too, and you can build a framework of your own. See frameworks and controls.
Vendor reviews, a risk register, audit findings and change requests are boards you set up yourself. Every item has an owner, a due date, a status and a history, and links to the controls it affects. Click a board to see what is on it.
21RISK has held a SOC 2 Type 2 report since 2024. Since October 2026 the whole programme runs in 21RISK: the frameworks, every control and its owner, every policy with its approval, the evidence for each quarter, vendor reviews, the risk register and our auditor’s findings. The boards in the picture above are modelled on our own.
Our reports and certificates are on the certifications page.
Your security lead, your EHS manager and your risk manager work with the same sites, the same people and the same access. A finding from a site walk and a finding from the ISO 27001 audit are followed up the same way.
The management side of your compliance work: the frameworks you answer to, the controls you run, the policies behind them with their approvals, recurring evidence, and the findings from audits followed until they are fixed. It works for information security (SOC 2, ISO 27001, NIS2) and for environment and health and safety (ISO 14001, ISO 45001).
SOC 2 (Trust Services Criteria 2017), ISO/IEC 27001:2022, NIS2 (Directive 2022/2555 with Implementing Regulation 2024/2690), ISO 14001:2015 and ISO 45001:2018. Each comes with its requirement tree and suggested controls, and stays editable. You can also build your own framework, for example from a customer’s security requirements or an insurer’s.
No. 21RISK shows which requirements have a control, which policies are approved and which evidence is in. Whether a control works is for your audit to show, and a certificate or a SOC 2 report comes from your auditor. That is why 21RISK says “has a control”, not “compliant”.
No. 21RISK does not connect to your cloud provider, code host or identity provider. People attach the evidence, or your own scripts do it through the REST API. An evidence task can require a new file in every period, so a quarter cannot be closed with last quarter’s screenshot.
Yes, as boards you set up yourself. A vendor, a risk or a change request is an item with an owner, a due date, a status and a history, and it can be linked to the controls it affects. No ready-made board ships for them, so you choose the statuses and fields that fit how you work.
Yes. Invite the auditor as a user and open the boards they need. They see the controls, policies with their approvals and each evidence task with its files, period by period.
Site audits are checklists that each of your sites answers, for example a fire safety standard at 40 plants. Compliance describes what your organization does once, centrally, and which requirements that covers. Many groups use both, and they share the same sites, people and access.
Yes. Frameworks, controls and policies are available to the AI chat in 21RISK and to assistants such as Claude through the MCP server. Ask which requirements have no control, or which policies are due for review. In the chat, a change the assistant proposes waits for your approval before it is made.
It is not a security tool and not an audit firm. It does not scan systems, collect logs or test controls for you, and it does not issue reports or certificates. Employees cannot sign in 21RISK that they have read a policy.
No. Compliance is part of 21RISK, at the same price per user as the rest. There is no charge per framework, control or policy.
Adopt a framework, link the controls you already run, and see what is missing.