COMPLY
Platform

Purpose-built Workbenches that help COMPLY practitioners deliver defensible outcomes.

COMPLY connects requirements, controls, evidence, governance, and audit conclusions in one reusable model. The Workbenches primarily support COMPLY practitioners during client engagements; client-facing access is defined by the engagement need.

Representative practitioner views

How the Workbenches support the engagement.

COMPLY practitioners use the Workbenches to structure assessment and readiness work. Depending on the engagement, clients may receive reports, exports, representative screenshots, selected views, or controlled access.

Practitioner Workbench
COMPLY WORKBENCH
Representative view
Engagement scopeStep 1
Control and evidence linksStep 2
Review statusStep 3
Client-ready outputStep 4

Illustrative screen treatment – not live portal access.

COMPLY-RISK

Supports ISO-aligned risk assessments by connecting assets, vulnerabilities, threats, evaluations, risk treatment, ownership, and evidence context.

Practitioner use

COMPLY practitioners use it to structure assessment work and turn risk decisions into a clear client roadmap.

Client-facing output

Depending on the engagement, clients may receive a risk register, treatment plan, findings summary, or selected controlled views.

View practitioner workflow
Practitioner Workbench
COMPLY WORKBENCH
Representative view
Engagement scopeStep 1
Control and evidence linksStep 2
Review statusStep 3
Client-ready outputStep 4

Illustrative screen treatment – not live portal access.

COMPLY-UCF

Creates a unified control framework for the client’s defined compliance scope by mapping obligations, framework controls, applicability, and local control intent.

Practitioner use

COMPLY practitioners use it to rationalize overlapping requirements and create one defensible control backbone.

Client-facing output

Clients receive the agreed control framework, mapping rationale, applicability decisions, and engagement-specific exports or reports.

View practitioner workflow
Practitioner Workbench
COMPLY WORKBENCH
Representative view
Engagement scopeStep 1
Control and evidence linksStep 2
Review statusStep 3
Client-ready outputStep 4

Illustrative screen treatment – not live portal access.

COMPLY-SSA

Supports security-stack assessments by connecting client context, engagement scope, frameworks, technologies, control coverage, and assessment findings.

Practitioner use

COMPLY practitioners use it to evaluate whether the security stack supports the controls the business needs to operate.

Client-facing output

Clients may receive a security-stack assessment, coverage findings, ownership actions, and prioritized improvement recommendations.

View practitioner workflow
Practitioner Workbench
COMPLY WORKBENCH
Representative view
Engagement scopeStep 1
Control and evidence linksStep 2
Review statusStep 3
Client-ready outputStep 4

Illustrative screen treatment – not live portal access.

COMPLY-DOCS

Provides a governed Compliance Evidence Repository for organizing documents and evidence artifacts, mapping them to controls, and managing review status.

Practitioner use

COMPLY practitioners use it to keep engagement evidence structured, traceable, reviewable, and reusable across frameworks.

Client-facing output

Clients may receive evidence registers, audit-ready packages, selected repository views, or controlled access when the engagement calls for it.

View practitioner workflow
Connected delivery model

A connected model for practitioner delivery.

Within the engagement, COMPLY connects frameworks, controls, audit criteria, evidence, client assessments, assets, vulnerabilities, threats, risk treatment, obligations, and security tooling so practitioners can produce clearer, more defensible client outputs.

44

Base tables

114

Table occurrences

85

Relationship links

167

Operational layouts

255

Workflow scripts

98

Value lists

Unified control backbone

Framework obligations flow into local controls with categories, applicability, guidance, and mapping rationale.

Evidence and criteria layer

Audit criteria define what evidence must prove, while artifacts show whether controls are operating effectively.

Risk and treatment loop

Assets, vulnerabilities, threats, evaluations, treatments, and treatment controls keep compliance tied to real risk.

Governance and reporting layer

Reviews, exports, registers, and management reporting create oversight and audit-ready visibility.

Traceability

Requirement -> Framework Control -> Local Control -> Evidence -> Report

Requirement to Audit-Ready Output

01

Requirement

Capture the obligation, from law, contract, customer demand, policy, or framework, that drives every downstream decision.

02

Framework Control

Translate the obligation into recognized framework expectations and map overlaps so controls can be reused.

03

Local Control & Criteria

Define how the organization meets the expectation, including applicability, ownership, guidance, and review criteria.

04

Evidence Artifact

Link supporting proof to controls and criteria so evidence quality, completeness, and reuse can be assessed.

05

Audit / Report

Show what was assessed, what supports the conclusion, and where remediation or governance action remains.

Governance

Ownership, accountability, review cycles, and oversight.

1

COMPLY UCF Workbench

Frameworks, local controls, categories, mapping rationale, applicability, and guidance.

2

Audit criteria and evidence

Criteria, compliance artifacts, client evidence, and document-to-control relationships.

3

COMPLY Security Stack Assessment Workbench

Clients, engagements, assessment scope, frameworks, assessment assets, and ownership.

4

Risk treatment oversight

Assets, vulnerabilities, threats, evaluations, treatments, review state, and treatment controls.

5

Management reporting

Risk register, asset register, SoA, audit criteria, mappings, engagement, and artifact reports.

Workflow

Risk-to-control-to-evidence workflow.

Asset

Assessment assets, categories, subcategories, and asset classes establish business context.

Vulnerability

Known weaknesses are linked to assets and used to structure exposure analysis.

Threat

Threat scenarios connect to vulnerabilities so risk is grounded in credible events.

Evaluation

Likelihood, impact, risk level, owner, acceptance, review, and status are recorded.

Treatment

Reduce, accept, avoid, or transfer decisions become accountable treatment records.

Control

Treatment controls link risk decisions back to the control library and evidence model.

Reporting

Audit-ready registers, reports, and workflow outputs.

COMPLY supports practical operating workflows: selection cards, linked records, review states, evidence packaging, reporting, and exports.

Available reporting outputs

Risk RegisterAsset RegisterStatement of ApplicabilityAudit CriteriaEngagementsFramework ControlsControl MappingsComply Artifacts Register

Operational workflows

  • Card-window selection for controls, assets, vulnerabilities, threats, treatments, artifacts, requirements, and audit criteria.
  • Search, sort, navigation, record creation, review, reporting, and export workflows.
  • Picker-driven linking between requirements, controls, evidence, assets, vulnerabilities, threats, risks, and treatments.
  • Register-style reporting for risk, assets, applicability, criteria, engagements, framework controls, mappings, and artifacts.