Compliance and GRC
Procedures, evidence, audits, nonconformities, management review and the Statement of Applicability. Across eight standards, with work that counts only once.
From assessment to certification
The gap analysis tells you how compliant you are. The Compliance module is there to help you become compliant and prove it: it is where the work of a management system lives.
Getting to certification means writing and maintaining dozens of procedures, collecting evidence, running internal audits, managing nonconformities and taking everything to the management review. Here, procedures are written and keep their revision history, evidence is uploaded once and counts for every standard that requires it, and audits start from a checklist built on the standard itself.
Where the platform already has the data, such as the risk analysis, the records of processing or the courses completed by staff, the evidence appears by itself.
- ISO/IEC 27001
- ISO/IEC 27017
- ISO/IEC 27018
- ISO 9001
- NIS2
- GDPR
- AI Act
- EN 18031-1
What you get
One piece of work, several standards
The same task can count for several frameworks and point to several requirements and controls. You do it once, and it counts wherever it is needed.
Procedures with a history
An editor in the platform, versions, comparison between two revisions and an ISO-style cover page with TLP classification.
Real internal audits
Cycles run according to ISO 19011, with a checklist generated from the standards and nonconformities raised from the findings.
SoA and review in PDF
The Statement of Applicability and the management review minutes, ready when you need them.
Evidence that expires
Recurring tasks reopen by themselves when they fall due: evidence approved once does not count for ever.
No double entry
Risk assessment, records of processing, data breaches and training appear as evidence without uploading them again.
The building blocks of a management system
Each component follows what the standard requires, not a shortcut.
Evidence and procedure tasks
Each task has a six-status life cycle and versioned documents. A file uploaded with the same name creates a new version: it never overwrites the previous one.
Procedures written in the platform
Document code, current revision, written by, approved by and when, a revision log that fills itself in, your company's header. Export to PDF and Markdown.
Audit cycles according to ISO 19011
The checklist is built from the requirements and controls of the standards in the cycle. For each item: conforming, nonconforming with severity, observation, not applicable.
Nonconformities with their own life cycle
They are raised from the findings and follow their own path through to the effectiveness check. A nonconformity with the outcome "not effective" cannot be closed.
Management review, §9.3
The minutes required by ISO 9001 and ISO/IEC 27001, with the inputs and outputs set out in the standard. It always ends with approval by a person, and from that moment it cannot be changed.
Statement of Applicability
For standards with controls. Your decision on an individual control always prevails; where you have not decided, applicability is inferred from the status of the linked tasks.
AI proposes, a person decides
Administrators have artificial intelligence features that run on a private model: your documents do not end up in a public service.
- Drafting a procedure
- Checking the evidence uploaded to a task
- Proposing an audit checklist
- Filling in the empty sections of the review
The output of the AI features is always a proposal, marked as such. Review and approval remain human.
It is the same logic as the management review: a compliance document is valid when a person approves it, not when a system generates it.
Five compliance documents, on your letterhead
They are not templates to fill in: they are built on the data you have already entered. The documents in detail.
| Document | What it is for |
|---|---|
| Procedure | ISO-style cover page, TLP classification and a verifiable revision log |
| Statement of Applicability (SoA) | Control by control: applicable or not, justification and implementation status |
| Review minutes | The approved management review; sections not filled in are flagged, not hidden |
| Evidence file | All the evidence for a standard in a single PDF, to hand to the auditor |
| Findings report | The outcome of an internal audit cycle, from which nonconformities are raised |
Which standards it supports
The module directly manages eight frameworks. ISO 9001, the AI Act and EN 18031-1 are covered within the module; below are the standards that have a dedicated page.
Frequently asked questions about compliance and GRC software
What is GRC software?
GRC stands for Governance, Risk and Compliance. It is the tool that brings together the policies and procedures, risk analysis, evidence, audits and nonconformities of a management system. Instead of shared folders and spreadsheets you have a single versioned archive, showing who did what and when.
Does the Compliance module issue ISO 27001 certification?
No. Certification is issued by an accredited body after an external audit. The module prepares and maintains what that audit checks: procedures, the Statement of Applicability, internal audits, nonconformities and the management review. ISO/IEC 27001 with Dottor Box.
Can I upload the documents and procedures I already have?
Yes. Existing documents are uploaded as evidence on the tasks, and every new upload with the same name becomes the next version. If you prefer, you can move the procedures into the platform editor to get a cover page, a revision log and comparison between versions. The task list and the list of nonconformities can also be exported to Excel.
How can one control count for several standards?
Each task is linked to requirements and controls from different frameworks. An access management procedure, for example, can address ISO/IEC 27001, NIS2 and GDPR at the same time: you write it and approve it once, and it shows up as evidence in all three.
What is the Statement of Applicability?
It is the document required by ISO/IEC 27001 that lists the Annex A controls and states which ones apply to the organisation, why, and whether they are implemented. In Dottor Box the decision on each control is yours; where you have not made it, applicability is derived from the status of the linked tasks. Statement of Applicability.
Does the module help with NIS2 compliance?
Yes. NIS2 is one of the module's eight frameworks: the policies and procedures the directive requires are written and versioned here, recurring evidence reopens when it falls due, and the incident register appears as evidence. The full path is on the NIS2 compliance page.
Often activated together
Risk Assessment
Risk analysis based on ISO/IEC 27005, with a treatment plan and residual risk.
Learn more GovernDocumentation
Your company documentation in a dedicated wiki, exportable in open formats.
Learn more ProveCompliance documents
SoA, management review minutes, evidence files, audit reports and registers.
Learn moreDo you know what someone looking for a target can see of your company?
In a demo on your real systems we show you what is exposed, how much it matters and where to start. Then, if you need it, a tailored proposal.