Compliance framework management in one place: adopt SOC 2, ISO 27001, ISO 14001 or ISO 45001 ready-made, write each control once, map it to every requirement it meets, and see which requirements still have a gap. Keep the policies behind them approved and reviewed.
SOC 2 CC7.3 has no control yet, so it shows up as a gap.
Access reviews, incident response and policy approval show up in more than one standard. A spreadsheet makes you write them down for each.
One tab per standard, one row per requirement, and control names copied between tabs. Change a control and every tab that mentions it is out of date.
A quarterly access review counts for SOC 2 and for ISO 27001. Described separately for each, the two descriptions drift apart.
Which requirements have no control at all? Answering means reading the whole matrix, row by row, before every audit.
Describe what your organization actually does once, and let each framework show what it covers.
Add SOC 2, ISO/IEC 27001, ISO 14001 or ISO 45001 with the full requirement tree, or build your own from an insurer’s or your group’s requirements.
A control is something you actually do, like a quarterly access review. Map it to every requirement it meets, in any framework. 21RISK suggests controls when you adopt a framework, already mapped.
Coverage per framework and per section shows which requirements have a control and which have none yet, so you know where to start.
SOC 2, ISO/IEC 27001, ISO 14001 and ISO 45001 with the full requirement tree, plus suggested controls. Everything stays editable.
Mark a requirement or a section as not applicable, with the reason on record. It leaves the coverage count.
Give each control an owner, and let the board's User Access decide who sees and who edits, by user or by group.
Upload each policy, give it an owner and link the controls it covers. Approving it records who approved it and when, the first thing an auditor asks for.
Each policy is valid for a year after it is approved, or for the interval you choose. When it expires, it moves to Needs review by itself.
Upload a revised policy and its history records the one it replaced, so you can show which version was in force when.
Running one environmental management system across many sites? See how findings link to their clause in ISO 14001 software.
SOC 2 (Trust Services Criteria 2017), ISO/IEC 27001:2022, ISO 14001:2015 and ISO 45001:2018, each with its full requirement tree. Everything stays editable after you add it, and you can build your own framework from scratch, for example from an insurer’s requirements or a group policy.
Yes, that is the point. Map a control to requirements in as many frameworks as it meets. When you adopt a second framework, the suggested controls you already have are linked to its requirements instead of being created again.
Yes. Upload each policy, such as your Information Security Policy. Give it an owner, link the controls it covers and approve it. 21RISK records who approved it and when, and the history records each earlier version and each change to its controls. A policy moves to Needs review when it is due again, every year unless you choose another interval.
Yes. A policy can link any control, from any of your frameworks. Filter the policies table by a control, such as your quarterly access review, to see every policy that covers it. That is the mapping an auditor asks for.
Yes. In a findings board’s settings, pick the frameworks the board works with. Each finding can then be linked to the controls it affects, requirement by requirement. The Controls column shows and filters them, and every link and unlink is in the finding’s history.
Mark it, or a whole section, as not applicable and give the reason. It stays on record with that reason and no longer counts toward the framework’s coverage.
No. Coverage tells you that every applicable requirement has a control. Whether each control works is still for your audit to show, which is why 21RISK says “have a control”, not “compliant”.
Frameworks and Controls is a board, so it works like the rest of 21RISK. It sits under Boards in the sidebar, and under Settings › User Access you decide who can see it and who can edit it, by user or by group. Give your IT, EHS or quality team the access they need.
Compliance standards are checklists your sites answer in audits. Frameworks and Controls describes what your organization does once, centrally, and which requirements of each standard that covers. Policies link to those controls, so each policy shows the controls it covers.
Frameworks and controls on the same platform as your sites, audits and findings.