Compliance stops being a project and starts being a number
Most teams run compliance as a scramble: a spreadsheet per framework, an evidence folder per audit, a fresh panic every renewal. NorthIron replaces that with one control library, one evidence store, and one audit readiness figure that tells you where you stand today.
What this looks like today
You are doing the same work twice
ISO 27001 asks for an access review. SOC 2 asks for an access review. Without a mapping layer your team collects that evidence twice, files it in two places, and answers the same auditor question two ways.
Nobody can tell you if you are ready
Ask five people how close you are to certification and you will get five answers, all of them adjectives. Mostly there. A few gaps. Boards and buyers do not act on adjectives.
The second framework costs almost as much as the first
Teams get through SOC 2, a customer asks for ISO 27001, and the programme restarts from zero because nothing was built to be reused.
One control set, and one number that comes out of it
Atomic controls, not framework silos
Source controls from each standard resolve to a single library of atomic controls, which then project back out to every framework that needs them. You implement the atomic control once and it satisfies the requirement everywhere it maps.
- 144 atomic controls, mapped from 966 source controls
- 93 of 93 ISO 27001 Annex A controls covered
- ISO 27001 and SOC 2 are live on the control layer today
- Add a framework later and you see the delta, not the whole programme again
One figure: audit readiness
Every atomic control is scored on a binary basis. It is satisfied by current evidence or it is not. There is no partial credit, because partial credit is how a programme convinces itself it is ready and then fails fieldwork. What comes out is one readiness figure per framework, with the exact list of what is holding it back.
Policies that stay attached to controls
Policy templates arrive pre-linked to the atomic controls they support, with version history and a comparison between versions. When a policy changes you can see which controls, and which frameworks, moved with it.
Evidence that knows its own age
Every artefact carries its collection date and its refresh cycle. Stale evidence is flagged before an auditor finds it, not after.
Two frameworks. One control set.
ISO 27001 and SOC 2 resolve to the same atomic controls underneath. Evidence attaches to the control, not the framework, so one collection counts for both.
ISO 27001 · Annex A
- A.5.1Information security policies
- A.5.9Inventory of assets
- A.5.15Access control
- A.6.3Awareness training
- A.8.5Secure authentication
- A.8.13Information backup
- A.8.15Logging
- A.8.24Use of cryptography
- … 93 controls
Two frameworks
Same control, both frameworks
Collect once, count twice
Coverage
93 / 93
Annex A controls covered
SOC 2 · Trust services
- CC1.2Board oversight
- CC6.1Logical access controls
- CC6.7Data transmission
- CC7.2System monitoring
- A1.2Recovery and backup
Audit readiness is one number
Every control is pass or fail. No partial credit. The number recalculates when your environment changes, and it drills down: number, then control, then missing evidence.
Audit readiness
87%
Recalculated as the environment changes. Pass or fail per control. No partial credit.
- A.5.1Information security policies
- A.5.9Inventory of assets
- A.5.15Access control
- A.5.19Supplier relationships
- A.6.3Awareness training
- A.8.5Secure authentication
MFA disabled on one admin account
Missing: MFA enrolment evidence · Microsoft Entra ID
- A.8.9Configuration management
- A.8.13Information backup
- A.8.15Logging
- A.8.16Monitoring activities
- A.8.24Use of cryptography
Built for an Indian buyer, not adapted for one
Compliance platforms built for the United States market treat Indian regulation as an afterthought. NorthIron was built the other way around, and it runs in AWS Mumbai, so your evidence never leaves the country. If your buyer is in Mumbai or your regulator is in Delhi, that matters more than another logo on a framework list.
What changes once this is running
- A single control library serving every framework you hold or plan to hold
- An audit readiness figure you can put in a board pack without qualifying it
- Evidence collected once and reused across audits
- A clear delta view when you take on a new standard
- India data residency by default
Questions we are asked about this
How is atomic control mapping different from a framework crosswalk?
A crosswalk tells you that an ISO 27001 control resembles a SOC 2 criterion. It stops there, and your team still does the work twice. Atomic mapping goes further: the two source controls resolve to one implementable control holding one piece of evidence. You satisfy it once and both frameworks are covered.
Which frameworks does NorthIron support today?
ISO 27001 and SOC 2, Type I and Type II, are live. Further frameworks are in development and resolve to the same control layer when they ship.
How long does it take to see a readiness figure?
Connect your cloud accounts and your identity provider and the automated part of the score populates on the first scan. The manual part depends on how much of your documentation already exists.
See it against your own programme
The call opens the product, not a deck. A practitioner walks you through this capability with your situation in front of them.