ISO 27001:2022 · ISO 22301:2019 · ISO 42001:2023 · NIS2 · DORA

The auditor asks a question. You have the answer in ten seconds.

Fifteen tabs in a spreadsheet, three versions of the same file sitting in someone’s inbox, and nobody knows which one counts. Certatix keeps your controls, your answers and your evidence in one place, and turns them into a dated, frozen pack you hand to your auditor read-only.

Hosted in the European Union · sign in with Google or Microsoft · two-factor authentication for everyone · your evidence stays with you

62%

Audit readiness38 of 61 applicable controls at target+7 pts over 30 days

A.52.4 / 3.0
A.63.1 / 3.0
A.71.8 / 3.0
A.82.2 / 4.0

A.8.16Monitoring activitiesCritical1 / 4
A.5.30ICT readiness for business continuityCritical0 / 3

On audit day

What you show when the auditor asks for evidence

Show me how you handle security patches.

The auditor, day one

In Certatix, on one screen

Control

A.8.8Management of technical vulnerabilities

Question

Is there a documented technical vulnerability management procedure specifying the roles, the timeframes and the prioritisation criteria?

Computed maturity

3 / 4

one level short of target

Evidence attached

Vulnerability management procedure

A link to your document, on your side

Answer: Handled
Attached on: March 12, 2026
Signed off by: C. Meunier, Head of Operations

Sample data. The control code and the question wording are the ones loaded from the ISO 27001:2022 framework.

The same question, in a spreadsheet

01
Open the file, then check it is the latest version.
02
Find the right tab, then the row for the control.
03
Dig the attachment out of an email thread from March.
04
Have no idea who signed it off, or when.

What a spreadsheet cannot do

Several people fill it in at the same time
Everyone works in the same place, at the same moment. There is one version, and it is the one everybody is looking at.
Each person sees their own area, management sees a single figure
Permissions follow the domain: legal does not see infrastructure. The board reads one completion percentage.
A list of what is missing, with the name of the person to chase
Unanswered questions and missing evidence are listed, each attached to an owner. You know who to write to, not just what is absent.
A frozen, dated version you can share read-only
The pack you hand to the auditor stops moving. It carries its date and its version number, and the change history stays available.

You are preparing your own audit, or preparing other people’s

You are preparing your certification

One team, one audit, one place

Permissions follow the domain: who fills in, who signs off, who sees nothing.
Your director follows progress from a phone, without chasing anyone.
Every status or evidence change is written to a log the auditor can read.

Company plans →

You support several clients

A client portfolio, one workstation

Every client in one view: dated engagements, assigned consultants, target audit dates.
You step into a client’s workspace without switching account. A banner says where you are, at all times.
Each consultant has a scope: the controls they may read, the ones they may write.
The client stays in charge: they accept the engagement, set its end date and can terminate it. The workspace and the pack remain theirs.

Firm plans →

One engine, several frameworks

The mechanics (applicability, maturity, evidence, audit pack) do not change from one framework to the next. You pick the framework at the top of the screen; your evidence and your roles stay where they are.

ISO 27001:202293 controls, 4 themesAvailable
NIS259 controls, including the 10 measures of Article 21Available
DORA64 controls, operational resilience in the financial sectorAvailable
ISO 22301:201969 controls, clauses 4 to 10 plus the BIA processAvailable
ISO 42001:202370 controls, clauses 4 to 10 and the 38 Annex A controlsAvailable
Qualiopi32 controls, 7 themes, framework in French onlyAvailable

Qualiopi: the new version of the French national quality framework will be loaded as soon as it is published.

What the French transposition of NIS2 changes

The French bill on the resilience of critical infrastructure and cybersecurity is going through adoption. ANSSI published the ReCyF framework in March 2026. Implementing decrees will name the entities in scope and set the supervision timetable. Preparation, meanwhile, is measured in months: it starts before the deadlines are known.

What we do not store

01
No passwords. People sign in with the company’s Google or Microsoft account; there is nothing here to steal.
02
No payment details. Payment happens on our provider’s hosted pages, never on Certatix.
03
No evidence files. Your documents stay where they are: Certatix keeps only the link, its label and its date. Two-factor authentication is mandatory for everyone from first access, and organisations are strictly partitioned.

controls covered, across 6 frameworks: 387
audit questions, each traceable to a piece of evidence: 2,004
maturity level, computed rather than self-declared: 0 – 4
interface and audit pack in four languages

On audit day, you have the answer. And the evidence. And the date.

Twenty minutes is enough to tell whether this fits your organisation: your framework on screen, your questions, no commitment.