A standard here is not a tick on a list, it is a switch with consequences. Activate it and OdySecure derives risks, measures and processes from it, showing you in figures what is already covered and what is missing.
In most tools a standard is a checklist. Here it governs what the system derives for you.
Activated standards feed the statement of applicability, the maturity score, risk derivation and measures. A standard you add changes your security picture rather than adding another column.
Risks
derived from the standard
New measures
still missing
Measure deltas
changes to existing ones
Covered
what you already meet
Processes
that are affected
Four states, and one of them is what audits actually need.
The standard is in the catalogue but not set up in your tenant.
Set up and ready, but not yet affecting your derivations.
Feeds statement of applicability, maturity, risks and measures.
Temporarily without effect, without deleting and rebuilding it later.
Beyond the catalogue you import your own standards via OSCAL. Group policies, customer requirements and sector rules are then treated like any norm: with requirements, coverage and evidence.
The Navigator proposes equivalences between frameworks, with visible progress. Before a mapping counts it passes a manual review. A machine may propose here, it may not decide.
The area was deliberately consolidated rather than giving every question its own page.
The hub: activate, extend, requirements and evidence.
One entry for every report type instead of four separate registers.
What is open from audits, in one place.
The ISO 27001 classic, including export.
The question “what does another standard cost me” no longer has its own menu entry. It is answered when you add the standard, not in a view you have to find first.
Evidence management is not a separate product. It is the view where what the modules deliver comes together: controls from the ISMS, evidence from assessments, records from day-to-day operations.
See OdySecureYour own as well. The import runs via OSCAL, and imported standards are treated like norms: with requirements, coverage and evidence.
You suspend it. It then stops affecting derivations while its history is preserved. Deleting is possible too, but final.
Usually not to the degree people fear. Much is already covered through equivalences. How much, you see when adding it, before you commit.
A person. The Navigator proposes mappings, the manual review is a separate step and cannot be skipped.