Compliance documents
The documents the auditor asks for, generated from the work you have already done. On your company's letterhead, not ours.
Time is lost in proving, not in doing
Anyone who has been through a certification knows it: you need procedures with a traceable revision history, a Statement of Applicability that explains control by control what applies and why, an approved management review record and a well-ordered evidence file. They are usually put together by hand the week before the visit.
Dottor Box produces them from the data you have already entered in the Compliance and GRC module: they are not templates to fill in, but documents that reflect the actual state of your tasks, procedures and audits. They come out in PDF, with your company's header.
The Statement of Applicability does not start from a blank sheet: it comes already filled in from the work done on the tasks, and you step in only where you want to decide differently.
The most laborious document in an ISO 27001 certification
From the procedure to the audit report
All in PDF, all built on the data in the Compliance module.
Procedure document
An ISO-style cover page with code, revision, author, approver, reference framework and signature. The printed TLP classification states who may receive it. The revision log fills itself in: every saved version becomes a line. It can also be exported to Markdown.
Statement of Applicability (SoA)
For each control in Annex A of ISO/IEC 27001: applicable or not, justification and implementation status. Your decision always prevails; without it, applicability is inferred from the linked tasks, and anything not decided stays "To be assessed".
Management review minutes
The minutes required by clause 9.3 of ISO 9001 and ISO 27001, with participants and input and output sections. Empty sections are marked, not hidden. They close with approval by a person, and from that moment cannot be changed.
Evidence file per standard
A single PDF with all the evidence for a framework: for each task its name, status, reference requirements and controls, and attached documents. It is the file to hand to the auditor at the start of the visit.
Audit findings report
Cycle, period, framework and lead auditor, with the list of items checked and their type, status and notes. It closes the internal audit and is the point from which nonconformities are raised.
On your letterhead
The company header is uploaded once in the settings and appears at the top of every document. Whoever receives it sees your organisation.
Proof that obligations have been met
Documents that serve to show you have done something, not to present a result.
| Document | Format | What it is for |
|---|---|---|
| Access log | CSV | Domain, user, outcome and date of each login: the order of the Garante (the Italian Data Protection Authority) on system administrators |
| Training register | CSV | A matrix of people by quiz with dates and scores, evidence for GDPR, NIS2 and ISO 27001. Downloaded with an administrator account |
| List of compliance tasks | XLSX | Progress status to share or work on outside the platform |
| List of nonconformities | XLSX | Review and follow-up of nonconformities |
| CSIRT report and event report | The response team and the incident documentation, for notifications and records | |
| Supplier questionnaire report | The outcome of the qualification, which can be handed to the supplier itself | |
| Entra ID and Google Workspace posture reports | Evidence of how your cloud identities are configured |
The score with its reasons. The two posture reports also contain the acceptances section: the items you have declared acceptable, each with its justification. Whoever reads the score sees the decisions behind it, instead of a number with no explanation.
GDPR forms filled in for your people
Choose a template and the people from your records: the platform fills in the company name, VAT number, contact person, certified email address (PEC) and date, and gives you back a ZIP archive of documents in editable DOCX or PDF.
- Appointments, authorisation letters and instructions for authorised persons
- Privacy notices and appointments of external processors
- CSV templates for importing employees and suppliers, including from a TeamSystem export (Italian payroll and accounting software)
- The appointment of Dottor Marc as data processor, ready in the settings
Your documentation is not held captive
Your company documentation can be exported at three levels, page, chapter or whole book, to PDF, HTML, Markdown and plain text, and the complete book to a ZIP archive too.
We say so openly because it is a legitimate question: if one day you stop the service, you take your content away in an open format. No supplier lock-in hidden in the files.
Which standards it supports
Compliance documentation for management systems and for legal obligations.
Where these documents come from
Compliance and GRC
Policies, procedures, audits and evidence for eight frameworks: one piece of work that counts for several standards.
Learn more GovernRecords of processing
The GDPR Article 30 register, with processing activities suggested by an analysis of your Drive.
Learn more ProveCyber Risk Report
The periodic report in PDF, presentation and Excel, with the chapters you choose.
Learn moreDo you know what someone looking for a target can see of your company?
In a demo on your real systems we show you what is exposed, how much it matters and where to start. Then, if you need it, a tailored proposal.