One thread, from the requirement to the next review.
Frameworks, internal audit, remediation, risks, evidence and deliverables linked in one platform. No rebuilt spreadsheets, no permanent expert needed.
A control assessed once, several requirements covered.
Each control describes a security capability; each framework's requirements are attached to it through a traceable mapping.
- 16 framework families ready to use
- Import of your internal frameworks
- No coverage claimed without evidence
Maturity backed by evidence, not just declared.
Each control receives a score from 0 to 4, backed by evidence; gaps are qualified and kept in the history. The latest published audit is what counts.
- Control-by-control scoring, on evidence
- Qualified findings and nonconformities
- Audit report exported to PDF
The action plan no longer stops at the report.
Controls, audit findings and risks become tasks tracked in a single engine.
- Owner, due date, priority and history
- To do, In progress, To validate, Done
- Jira ticket reference on every task
Risks linked to the controls that treat them.
Risk analysis, approval by the risk owner and a treatment plan tracked with its tasks.
- Register and treatment plan
- Clear treatment statuses
- Links between risks, decisions and controls
A generated, justified and versioned statement of applicability.
Inclusions and exclusions justified from the same data as the audit.
- Mandatory justification of exclusions
- Versions kept
- PDF export ready to present
Your documents stay with you.
Evidence is referenced by link to your document spaces: no file is stored, your sources stay in your own tools.
- Referencing by URL
- Evidence freshness tracking
- Attached to controls and tasks
Several sites, subsidiaries or clients, one method.
Each scope has its own assessment; consultants run one workspace per client.
- Consolidated and detailed views
- Administrator, contributor, reader and consultant roles
- CSV exports
Your AI assistant, with your permissions.
Connect Claude, ChatGPT or Copilot to CompliKey: the assistant reads and updates audits, controls, risks and tasks. Included in every plan.
Discover the MCP server- The assistant acts with your account permissions, no more and no less
- Publishing an audit requires your approval
- Its actions are recorded in a dedicated log
What CompliKey does not do
Method and framing, not certification audits or technical implementation. CompliKey complements your security tools; it does not replace them.
- Vulnerability scanning
- Real-time monitoring
- Penetration testing
- Certification audit
- Technical implementation
- “Compliant in one click”
See the whole thread in a demo.
Audit, finding, remediation, evidence and statement of applicability on a sample NIS2 scope.