# Secure iQube Compliance: Right compliance starts with the right questions > One integrated workspace for ISO management systems, SOC 2, privacy laws, ESG reporting and supplier risk: discovery, controls, policies, risks, audits and actions in plan, do, check, act order. Tell us how your business works. We recommend the standards and laws that apply, then build one integrated workspace with the controls, policies, risks, audits and evidence to get you audit-ready and keep you there. ## How it works - **Tell us about your business**: Answer plain-language questions, each with the reason it is asked, or describe the business in your own words and review the suggested answers. - **Choose your standards**: Accept our recommendations or pick your own. Two or more ISO standards become one integrated management system. - **Get a complete workspace**: Controls, policies, risk register, audit programme and management review are built for your scope and departments. - **Run the cycle every year**: Plan, do, check, act, with owners, due dates, evidence and dashboards that show where you stand. ## Capabilities (plan, do, check, act) ### Plan - **Discovery**: Plain-language questions about how you work, each with the reason we ask it. - **Recommended standards**: Standards and laws marked required, expected or recommended, with the reason for each. - **Risk register**: One method across every discipline, with heat maps before and after controls. - **Policies and procedures**: Drafted for the controls in scope and approved with version control. ### Do - **Integrated control library**: Each control is built once and mapped to every standard it serves. - **Guidance for owners**: How to implement, the question an auditor will ask and the evidence they expect. - **Suppliers**: Due diligence questions, criticality, certificates and review dates. - **ESG data**: Metrics with owners and sources, mapped to GRI and SEBI BRSR. ### Check - **Internal audit**: Risk-based programme with checklists built from the controls in scope. - **SOC 2 readiness**: Readiness by Trust Services Criteria and the system description. - **Dashboards**: Readiness by standard, department and plan, do, check, act phase. ### Act - **Findings and CAPA**: Correction, root cause, corrective action and a check that it worked. - **Management review**: The inputs every ISO standard asks for, filled in from the workspace. - **Continual improvement**: Overdue actions and repeat findings surface before the next audit. ## One control, many standards Each control is built once and mapped to every standard it serves. For example, incident and breach management serves ISO/IEC 27001, SOC 2, India's DPDP Act, GDPR, HIPAA, Saudi PDPL, NCA ECC and ISO/IEC 27701 from one procedure, one log and one set of evidence. ## Coverage - ISO management systems: https://securei3.com/standards/iso-27001.md, https://securei3.com/standards/iso-27701.md, https://securei3.com/standards/iso-42001.md, https://securei3.com/standards/iso-9001.md, https://securei3.com/standards/iso-14001.md, https://securei3.com/standards/iso-45001.md, https://securei3.com/standards/iso-22301.md, https://securei3.com/standards/iso-37001.md - Attestation: https://securei3.com/standards/soc-2.md - Privacy and cyber laws: https://securei3.com/standards/india-dpdp.md, https://securei3.com/standards/gdpr.md, https://securei3.com/standards/ksa-pdpl.md, https://securei3.com/standards/nca-ecc.md, https://securei3.com/standards/hipaa.md - ESG reporting: https://securei3.com/standards/esg-reporting.md, https://securei3.com/standards/india-brsr.md Compliance is broad. Other standards and laws can be added with their mapping to existing controls. ## Why it is different - **Useful on the first day**: Built-in controls, guidance, policies and audit checklists. No months of configuration before anyone sees value. - **Made for the people who do the work**: Department owners see only what is theirs, in plain language, with the evidence to collect. - **Guidance, not just storage**: Every gap comes with how to close it and what good evidence looks like. - **Integrated from the start**: Several standards run as one management system: one policy set, one risk method, one audit programme, one management review. - **Your data stays yours**: Export your registers at any time. No lock-in. - **Backed by consultants**: Run it yourselves, or with Secure iQube as a managed compliance service. ## Who signs in - **Client teams**: Your compliance lead and department owners see your organisation’s dashboard, controls, policies, risks, audits and actions, and nothing from any other client. - **Department owners**: See only what is theirs, in plain language: what to do, the question an auditor will ask and the evidence to keep. - **Secure iQube**: Our consultants set up each client workspace, run internal audits and keep the programme moving between certification audits. ## Your data - **A separate workspace for each client**: Every record belongs to one client workspace, and no client can see another’s. - **Access by role**: Consultant, client administrator, department owner and read-only auditor roles, each with the least access the job needs. - **Audit trail**: Who changed what and when is recorded for controls, policies, findings and approvals. - **Hosting region**: Agreed with you to meet data residency needs such as India’s DPDP Act and Saudi Arabia’s PDPL. - **Leaving is simple**: Export your registers and evidence at any time. At the end of the contract your workspace is deleted and we confirm it in writing. - **Built to the controls we teach**: The platform is run against the same ISO/IEC 27001 and SOC 2 control set it gives you. Independence: Secure iQube prepares organisations. Accredited certification bodies certify them, and licensed CPA firms issue SOC reports. ## Pricing Pricing depends on the standards and laws in scope, the number of entities or sites, the number of users, and whether you run the workspace yourselves or with Secure iQube as a managed compliance service. Contact info@securei3.com, +91 90435 37131, https://securei3.com/contact/ ## Frequently asked questions ### Does using the platform mean we are certified? No. The workspace prepares you and keeps you ready. Accredited certification bodies carry out certification audits, and licensed CPA firms issue SOC reports: a Secure iQube partner firm or your own. ### We need three standards. Do we need three systems? No. Each control is built once and mapped to every standard it serves, so your team writes one procedure, keeps one log and answers every auditor from the same evidence. ### Our standard or law is not in the list. Can you add it? Compliance is broad. If you need something not listed, such as SAMA CSF, RBI directions, PCI DSS or IATF 16949, ask us and we will add it with its mapping to the controls you already run. ### Can we run it without consultants? Yes. Your team can run the workspace, with guidance on every control. Many clients prefer Secure iQube to run internal audits and management reviews with them as a managed compliance service. ### Can we take our data with us? Yes. Export your registers and evidence at any time. At the end of the contract your workspace is deleted and we confirm it in writing.