Enterprise tour

Multi-headed business units,
one measure of compliance.

Pictures from the 1.8.0 build, on Blackbox Holdings, a made-up group whose business units each run their own frameworks. Click any picture to enlarge it.

Why a group buys it The group The baseline Shared controls Audits and vendors Inside a unit The board Clients

These are pictures, not a clickable mock-up. To see it move, talk to us and we will drive.

Why a group buys it

One company, several software suites, one way to gauge compliance.

Each unit can say how compliant it is. Nobody can say it for the company, because every unit is measured on its own ruler. Enterprise gives the group one.

One ruler for every unit

Each unit is read with the core's own readiness score, whatever frameworks it runs, and against one baseline of themes the group chose. A unit on SOC 2 and a unit on ISO 27001 answer the same question.

No average to hide behind

A theme is met only when the unit's weakest control in it is. A critical theme that is not met puts the unit under the floor, whatever its score, and the page names it.

Controls run once

Single sign-on, monitoring, background checks: run at group level and adopted by each unit, with signed evidence filed in the unit's own library and refreshed when the group's control changes.

Gaps excused, never hidden

A theme switched off for a unit it does not fit, or a gap excused with a reason and an end date. Both show on every screen and in the board pack.

Audits and vendors across units

One audit across several units on one screen, and the providers several units depend on, counted: in how many units, how many as critical, how many with lapsed assurance.

Units keep their own house

Each unit keeps its own workspace and frameworks. The group sees bands, scores and counts, never a document, a person or a contract, and each unit sees who at the group read its figures.

$24,900 a year. Ten business units or client workspaces included, $900 a year for each one beyond. Everything in Pro is included. Compare the editions.

The group

Every unit on one page, least ready first.

The group reads each unit with the score its own dashboard shows, and against the baseline the group set.

New in 1.8.0

Business units

Bands, scores and the floor, never an average.

The headline counts the units in each band and names the units under the floor: a unit whose critical theme is not met is under it, whatever its score. The list opens least ready first.

Open a unit to see its frameworks, its standing on each theme and exactly what the group may see of it. At summary disclosure that is bands, scores and counts; a superuser can set a unit to detail, which names the weakest control in each theme that is not met.

The Group page for Blackbox Holdings: the units counted by band, the units under the floor named, and every unit listed least ready first with its score and its baseline standing. — Every unit on one page, least ready first, with the units under the floor named.

One unit opened from the Group page: its score and band, its frameworks, its standing on each baseline theme, and what the group can see of it. — One unit opened: its frameworks, its standing on each theme, and what the group may see of it.

The baseline

One baseline, read by the weakest control.

The group picks crosswalk themes, the ones every unit can be held to whatever framework it runs.

Baseline

A strong control never hides a weak one.

Each cell is a unit's standing on a theme, decided by the weakest applicable control the unit has in it. A theme with nothing mapped reads Not covered, and a theme whose controls are all not applicable reads Excluded, so a gap cannot pass for a pass.

A theme that does not fit a unit is switched off for that unit and reads Not required. Mark a theme critical and a unit that does not meet it is under the floor.

The baseline matrix: the group's themes down and the units across, each cell the unit's standing on the theme, decided by its weakest control, with excepted and switched-off cells marked. — A theme is met only when the unit's weakest control in it is. Excepted and switched-off cells say so.

The baseline editor: the crosswalk themes the units carry, how many units carry each, a critical mark, and a switch per unit for a theme that does not fit it. — Choose the themes, mark the critical ones, and switch a theme off for a unit it does not fit.

Exceptions

Excuse a gap for a time, on the record.

A group administrator excuses one unit's gap on one theme with a reason and an end date, at most a year out. It reads Excepted while it runs, it is never deleted, and it stops excusing the day after it ends. The board pack lists the exceptions ending soon.

Exceptions: a unit's gap on one theme excused with a reason and an end date, listed with the days left. — A gap excused with a reason and an end date. It stops excusing the day after it ends.

Shared controls

Run it once at group level. Every unit gets the evidence.

The controls a group operates for everybody are answered once, by the people who run them.

New in 1.8.0

Shared controls

Offered by the group, adopted by the unit.

The group publishes a control from its own workspace with a statement of what a unit inherits and what it must still do, and up to ten approved documents. Nobody at the group can adopt for a unit.

The unit's own lead adopts it for the controls it covers. Conformiti files a signed record and signed copies of the documents in the unit's library, and refreshes them when the group's control changes. A refresh never lowers a unit's status, and a group control that stops being effective caps the theme at At risk in every unit that relies on it.

Shared controls: controls the group runs once, published to the units, with the themes each satisfies and how many units adopted it. — Controls the group runs once, offered to every unit, with the units that adopted each.

Inside a unit: what the group offers, with the statement of what the unit inherits and must still do, and the controls it was adopted for. — Inside a unit: the offer, what it inherits, what it must still do, and the controls it covers.

Audits and vendors

What the group could not see before: one audit across units, and its real dependencies.

Read from each unit's own records, one unit at a time, as counts and dates.

Audit scope map

Where one audit stands across every unit in scope.

An engagement names the audit, the firm, the period and the units in scope. For each unit the map shows its evidence package and status, the auditor requests open and overdue, and auditor access that has outlived the period. The group does not open a unit's package or grant access: that stays with the unit.

The audit scope map: two audits across the units, each unit's package status, open and overdue auditor requests, and auditor access that has outlived the period. — One audit across several units: each package, the requests open and overdue, and stale auditor access.

Group vendor directory

One cloud provider in five registers is one dependency.

The group keeps a directory of the providers that matter. Each unit links its own vendors to it, and the group counts the result: in how many units each provider sits, in how many as critical, in how many with lapsed assurance. A unit's own vendor names and contracts stay in the unit.

With TPRM Advanced, the units a superuser set to detail contribute to one register of information for the group.

The group vendor directory: each provider with the number of units that depend on it, how many as critical, and how many with lapsed assurance. — The providers several units depend on, counted across the group.

Inside a unit

The unit is not policed. It is told.

Each unit sees the same baseline the group sees, its own standing on it, and a record of who at the group looked.

A unit's own view

What is required, where it stands, and who read it.

The Group page inside a unit lists what the group requires of it and how it stands on each theme, with the shared controls on offer and the vendors to link. The reads list names every person at the group who opened the unit, and when.

Inside a unit: what the group requires of it, its own standing on each theme, and who at the group read its figures and when. — What the group requires, the unit's own standing, and who at the group read it.

The board

One file for the board.

Frozen when it is made, carrying no more than its reader may see.

Group board pack

Least ready first, then everything a board asks next.

The pack lists the units least ready first, the baseline, the exceptions ending within sixty days, the audits in progress and the vendor concentration, as one self-contained page you print to PDF.

The group board pack, opened: four headline figures, the units least ready first and the baseline matrix. Below them the file lists the exceptions ending soon, the audits and the vendor concentration. — One file for the board, frozen when it was made: the top of the pack.

Clients and the platform

The rest of Enterprise.

For the firms that serve many clients, and for the platform team that runs the installation. The line by line comparison is on the editions page.

Multi-client console

For firms that serve many clients.

A consultancy reads every client's readiness, with the same score the client's own dashboard shows, overdue work and auditor access on one screen, through a partner role that is not a superuser. White-label puts the firm's brand on the sign-in page, the app, every email and every report.

The client portfolio for a consultancy: every client with its readiness score and band, overdue work and auditor access, ranked by what needs attention. — For firms that serve many clients: every client's readiness and overdue work on one screen.

The roster

Who is in the group is a superuser's decision.

Which workspaces are units, how much each discloses, and who at the group may read or write: all set by a superuser, never by the group itself. That friction is the control.

The roster, a superuser's tab: the group's home workspace, its units with their disclosure, and the members with their roles. — Who is in the group, which workspaces are its units, and what each member may do.

TPRM Advanced

Vendors scored, ranked and checked for concentration.

Questionnaire scoring, exposure ranking, fourth parties shared by several vendors and the DORA register of information.

Multi-headed business units,one measure of compliance.