From first sign-in to certified — the whole machine, in the open.

Your Microsoft account. Read-only, and you can see exactly what it asks for.

You sign in with your own Microsoft 365 account — no new password to invent, no account on our side to create. The first consent screen requests read-only Graph scopes only, each one listed in plain English with the reason it's needed. Write access to your SharePoint is a separate consent, requested later, the first time it's actually used.

Output A read-only session — nothing written anywhere yet

Your registers provision as SharePoint lists — in your tenant, not ours.

A 15-minute wizard checks what Checkpoint can read in your tenant, lets you choose which SharePoint site your records live in, and provisions every register — risks, actions, controls, evidence, audit log — as native SharePoint lists you already own. There is no database on our side to copy anything into, because there is no our side. The lists inherit your permissions, retention and versioning from the moment they exist.

Output Your compliance registers, live as SharePoint lists you own

Your live security posture — measured, not guessed from a spreadsheet.

Checkpoint reads your live tenant signals through Microsoft Graph — MFA coverage, Conditional Access, PIM usage, guest accounts, device compliance, risky OAuth grants, Secure Score — and turns them into pass / review / fail / manual results against your frameworks. Every check is honest about its limits: something Graph can't see licence-gates to a clean "manual", never a fabricated pass.

Output A scored posture snapshot + timestamped, hashed evidence filed automatically

Readiness, gaps and evidence — one board-ready pack, built from live data.

One click turns everything you've been working in into a paginated, classification-marked report — a readiness fingerprint, posture trend, control status by theme, a residual-risk heatmap and an evidence-coverage gauge. Five report types share one engine, so an Executive Summary and an Audit Readiness Report never disagree with each other. Sparse data degrades honestly to an "insufficient history" note, never a broken chart.

Output A board-ready, print-perfect PDF — and a shareable Trust Center page

Work the gaps — and the evidence collects itself as you go.

Each gap becomes an action with an owner and a due date. Checkpoint's AI drafts policy language, risk treatment notes and evidence descriptions — grounded in your own registers, never invented, and never able to take an action itself. As controls move to implemented and scans re-run, the readiness rings fill in and a projected certification date is drawn from your real velocity — not a promise made on a kickoff call.

Output A closing gap list, a rising readiness score, a projected certification date

Present live, hand the auditor a pack — and keep the rhythm after.

When it's time to prove it, Checkpoint switches to a full-screen, auto-cycling board deck built from the same live data — no screenshots, no stale slides. Your auditor gets a time-boxed Auditor Pack they can open without a licence. And certification isn't a finish line: the compliance calendar, internal-audit programme and scheduled re-scans keep the governance cadence running, so the week before a surveillance audit looks like every other week.

Output A certification you can defend — and a rhythm that keeps it