How it works
How Certifyi works, from setup to audit
Your controls, evidence, risks and vendors are kept in one workspace, and auditors get their own scoped access to it. This page walks through setup, day-to-day work and the run-up to an audit.
The short version
You pick your frameworks and map each control once. Evidence is attached to the controls it supports. When the audit comes, the auditor gets read-only access to the evidence for their engagement.
Step 1
Set up your workspace
Start by choosing the frameworks you need from the catalogue, for example ISO 27001, GDPR, HIPAA or DORA. You map each control once, and every framework you add later reuses that mapping.
If your controls, policies and evidence are in spreadsheets or another GRC tool, the onboarding team helps you bring them across.
- Choose one framework or several from the catalogue
- Bring across existing controls, policies and evidence with the onboarding team
- Connect the tools you use, such as AWS, Azure, Auth0, Bitbucket or Jira
- Invite your team and give each person a role
- Review the gap analysis to see where you stand
Step 2
Run your compliance programme day to day
Day to day, your team works on controls, evidence and risks in one place. Each control has an owner, and the evidence for it sits against it.
Your auditors and your vendors each get their own access, so you are not passing files back and forth by email.
- Controls with owners and the evidence that supports them
- A risk register with likelihood, impact, treatment and owner, plus heatmaps
- Vendor risk assessments, with vendors answering through their own portal
- AI-drafted questionnaire answers for your team to review before they are sent
- Incidents logged and triaged, then followed until they are closed
Step 3
Prepare for audits
Because evidence is kept against each control through the year, audit preparation is mostly review. You check what is there and close the gaps the gap analysis shows.
When the audit starts, your external auditor gets scoped, read-only access to the evidence for their engagement, and can propose findings there for your team to review and track in Certifyi.
- Evidence kept beside the controls it supports, with every change recorded in the tamper-evident activity log
- Scoped, read-only auditor access for each engagement
- Gap analysis showing which controls need attention before the audit
- Statement of Applicability set per control
- Auditor findings proposed, reviewed and tracked in one place
Step 4
Keep going after the audit
After the audit you keep working in the same workspace. When you add a framework, the controls you have already mapped carry over, so you start from what you have.
- Plan your internal audit calendar for the year
- Management reviews for ISO 27001 clause 9.3
- Risk reviews and treatment plan updates
- Repeat vendor assessments through the vendor portal
- Add a framework and reuse the controls you have already mapped
Design decisions that affect your work
Choices in how Certifyi is built that you will notice when you use it.
-
A database for each customer
Each customer’s workspace has its own database. Your records do not share a database with anyone else’s.
-
Records that show their history
Every action goes into a tamper-evident activity log. If someone edits a record after the fact, that can be detected.
-
Controls mapped once
Map a control once and each framework you add reuses the mapping, so the second starts from the work you did for the first.
-
Auditors get their own access
Auditors see the evidence for their engagement and nothing else. They do not need access to your shared drives.
Questions
Questions about how it works
How long does implementation take?
It depends on how many frameworks you adopt, how much data you bring across and which tools you connect. We agree a timeline with you at scoping, and the onboarding team works through setup with you.
Do I need training to use Certifyi?
The onboarding team shows your people around during setup. For larger teams, they also run training sessions.
Can I migrate from spreadsheets?
Yes. The onboarding team helps you bring across controls, policies and evidence from spreadsheets and CSV files, and maps them to Certifyi’s control structure.
Can I migrate from another GRC platform?
Yes. The onboarding team works with you to map the data in your current tool to Certifyi.
What integrations are available?
Certifyi has adapters for AWS, Azure, Cloudflare, Kubernetes, Auth0, Duo, Bitbucket, Datadog, Grafana, CrowdStrike, Defender, Jamf and Jira. The integration hub lists each one.
How does the auditor portal work?
External auditors get their own login with read-only access to the evidence, controls and findings for their engagement. They can propose findings, which your team reviews.
See it with your own frameworks
Book a demo and we take your team from setup to audit day, using your frameworks and the tools you already run.