The auditor asks a question. You have the answer in ten seconds.
Fifteen tabs in a spreadsheet, three versions of the same file sitting in someone’s inbox, and nobody knows which one counts. Certatix keeps your controls, your answers and your evidence in one place, and turns them into a dated, frozen pack you hand to your auditor read-only.
Hosted in the European Union · sign in with Google or Microsoft · two-factor authentication for everyone · your evidence stays with you
62%
Audit readiness38 of 61 applicable controls at target+7 pts over 30 days
A.52.4 / 3.0
A.63.1 / 3.0
A.71.8 / 3.0
A.82.2 / 4.0
A.8.16Monitoring activitiesCritical1 / 4
A.5.30ICT readiness for business continuityCritical0 / 3
On audit day
What you show when the auditor asks for evidence
Show me how you handle security patches.
The auditor, day one
In Certatix, on one screen
Control
A.8.8Management of technical vulnerabilities
Question
Is there a documented technical vulnerability management procedure specifying the roles, the timeframes and the prioritisation criteria?
Computed maturity
3 / 4
one level short of target
Evidence attached
Vulnerability management procedure
A link to your document, on your side
Answer
Handled
Attached on
March 12, 2026
Signed off by
C. Meunier, Head of Operations
Sample data. The control code and the question wording are the ones loaded from the ISO 27001:2022 framework.
The same question, in a spreadsheet
01
Open the file, then check it is the latest version.
02
Find the right tab, then the row for the control.
03
Dig the attachment out of an email thread from March.
04
Have no idea who signed it off, or when.
What a spreadsheet cannot do
Several people fill it in at the same time
Everyone works in the same place, at the same moment. There is one version, and it is the one everybody is looking at.
Each person sees their own area, management sees a single figure
Permissions follow the domain: legal does not see infrastructure. The board reads one completion percentage.
A list of what is missing, with the name of the person to chase
Unanswered questions and missing evidence are listed, each attached to an owner. You know who to write to, not just what is absent. If your team works in Jira or Trello, one click sends these gaps there as a ticket, and a ticket goes out on its own before a piece of evidence expires. In every plan.
A frozen, dated version you can share read-only
The pack you hand to the auditor stops moving. It carries its date and its version number, and the change history stays available.
You are preparing your own audit, or preparing other people’s
You are preparing your certification
One team, one audit, one place
Permissions follow the domain: who fills in, who signs off, who sees nothing.
Your director follows progress from a phone, without chasing anyone.
Every status or evidence change is written to a log the auditor can read.
The mechanics (applicability, maturity, evidence, audit pack) do not change from one framework to the next. You pick the framework at the top of the screen; your evidence and your roles stay where they are.
ISO 27001:202293 controls, 4 themesAvailable
NIS259 controls, including the 10 measures of Article 21Available
DORA64 controls, operational resilience in the financial sectorAvailable
GDPR51 articles, obligations of the controller and the processorAvailable
ISO 22301:201969 controls, clauses 4 to 10 plus the BIA processAvailable
ISO 42001:202370 controls, clauses 4 to 10 and the 38 Annex A controlsAvailable
ISO 9001:202657 controls, clauses 4 to 10 of the sixth editionAvailable
ISO 14001:202635 controls, clauses 4 to 10 of the 2026 editionAvailable
ISO 45001:201840 controls, clauses 4 to 10, 2024 climate amendment includedAvailable
ISO 50001:201829 controls, clauses 4 to 10, energy review and indicatorsAvailable
ISO 26000:201053 issues, non-certifiable guidanceAvailable
Duty of vigilance19 measures, French 2017 law and the CSDDD, applicable in 2029Available
Qualiopi32 controls, 7 themes, framework in French onlyAvailable
What the French transposition of NIS2 changes
The French bill on the resilience of critical infrastructure and cybersecurity is going through adoption. ANSSI published the ReCyF framework in March 2026. Implementing decrees will name the entities in scope and set the supervision timetable. Preparation, meanwhile, is measured in months: it starts before the deadlines are known.
What we do not store
01
No passwords. People sign in with the company’s Google or Microsoft account: no password here to steal. If you connect Jira or Trello, their access token is kept encrypted and never shown again.
02
No payment details. Payment happens on our provider’s hosted pages, never on Certatix.
03
No evidence files. Your documents stay where they are: Certatix keeps only the link, its label and its date. Two-factor authentication is mandatory for everyone from first access, and organisations are strictly partitioned.
controls covered, across 14 frameworks
692
controls covered, across 14 frameworks
audit questions, each traceable to a piece of evidence
2,691
audit questions, each traceable to a piece of evidence
maturity level, computed rather than self-declared
0 – 4
maturity level, computed rather than self-declared
interface and audit pack in four languages
interface and audit pack in four languages
On audit day, you have the answer. And the evidence. And the date.
Twenty minutes is enough to tell whether this fits your organisation: your framework on screen, your questions, no commitment.