Frameworks and controls
Answer a control once, evidence it once, and have it count everywhere.
Frameworks and control trees
Subscribe to a framework and get its full control tree. Work down it assigning owners, recording answers and attaching the evidence that supports each one. Progress rolls up the tree, so "where are we on ISO 27001" has a number rather than a meeting.
Key capabilities
- Hierarchical control trees with progress rolled up at every level
- Per-control status, response, owner and due date
- Evidence attached once, reused across every control it supports
- Pre-mapped controls carry responses and evidence between frameworks, one control at a time
- Statement of Applicability generated from the tree
- Custom frameworks and questionnaires for your own obligations
Evidence register
Evidence is uploaded once and linked to every control it satisfies. Each item carries its capture date, so a reader can tell a control that passed from one that passed eleven months ago. Nothing is deleted: evidence is withdrawn with a reason, and the record of what an auditor saw survives.
Key capabilities
- One artefact, many controls: no duplicate uploads
- Capture date and expiry tracking on every item
- Withdrawal with a mandatory reason, never deletion
- Upload validation and encrypted object storage
- Retention policy applied across the register
Certificates
Record each certificate with its number, scope, issuing body, issue and expiry dates. Expiry is swept automatically, and each certificate carries a public verification handle a customer, tender evaluator or insurer can check without an account.
Key capabilities
- Certificate register with scope, issuing body and validity dates
- Automatic expiry sweep and notification
- Public verification on a twelve-character handle
- Recording, correcting and withdrawing held as its own permission
Proof point
Private comments are their own permission, not a convention. An internal note about why a control is weak is a different kind of text from the response an auditor reads, and the platform treats it that way.
Questions about this
What does “one control library” mean?
Each control is mapped once to every framework requirement it satisfies, so evidence collected for SOC 2 also counts toward ISO 27001, ISO 42001, HIPAA and GDPR.
How much carries over between frameworks?
SOC 2 to ISO 27001 about 70 to 80 percent; ISO 27001 to ISO 42001 about 60 to 70 percent; SOC 2 or ISO 27001 to HIPAA about 65 to 75 percent.
Is there a fee per additional framework?
No. Certifyi is priced on scope, and adding a framework reuses the existing record.
Which frameworks are in the library?
SOC 2, ISO 27001, ISO 42001, HIPAA, GDPR, NIS2, DORA, EU AI Act, NIST AI RMF, PCI DSS, CMMC, Cyber Essentials, Essential Eight and HITRUST CSF.