Show where you stand before the auditor asks
A standard here is not a tick on a list, it is a switch with consequences. Activate it and OdySecure derives risks, measures and processes from it, showing you in figures what is already covered and what is missing.
Why activating is more than ticking
In most tools a standard is a checklist. Here it governs what the system derives for you.
Activated standards feed the statement of applicability, the maturity score, risk derivation and measures. A standard you add changes your security picture rather than adding another column.
What appears once the security structure is extended
Risks
derived from the standard
New measures
still missing
Measure deltas
changes to existing ones
Covered
what you already meet
Processes
that are affected
Part of OdySecure
Evidence management is not a separate product. It is the view where what the modules deliver comes together: controls from the ISMS, evidence from assessments, records from day-to-day operations.
See OdySecureNo CISO of your own?
In a vCISO mandate, your vCISO works with OdySecure and the platform is included. From €3,600/month.
Standards have a state, not just a tick
Four states, and one of them is what audits need.
Not installed
The standard is in the catalogue but not set up in your tenant.
Available
Set up and ready, but not yet affecting your derivations.
Active
Feeds statement of applicability, maturity, risks and measures.
Suspended
Temporarily without effect, without deleting and rebuilding it later.
Your own requirements too
Beyond the catalogue you import your own standards via OSCAL. Group policies, customer requirements and sector rules are then treated like any norm: with requirements, coverage and evidence.
What counts for one standard often counts for the next
The Navigator proposes equivalences between frameworks, with visible progress. Before a mapping counts it passes a manual review. A machine may propose here, it may not decide.
Four tabs, not forty views
The area was deliberately consolidated rather than giving every question its own page.
Standards
The hub: activate, extend, requirements and evidence.
Reports
One entry for every report type instead of four separate registers.
Findings
What is open from audits, in one place.
Statement of Applicability
The ISO 27001 classic, including export.
The question “what does another standard cost me” no longer has its own menu entry. It is answered when you add the standard, not in a view you have to find first.
Frequently asked questions
Can we model our own standards, or only those from the catalogue?
Your own as well. The import runs via OSCAL, and imported standards are treated like norms: with requirements, coverage and evidence.
What happens when we no longer need a standard?
You suspend it. It then stops affecting derivations while its history is preserved. Deleting is possible too, but final.
Does an additional standard create duplicate work?
Usually not to the degree people fear. Much is already covered through equivalences. How much, you see when adding it, before you commit.
Who decides whether a requirement counts as met?
A person. The Navigator proposes mappings, the manual review is a separate step and cannot be skipped.