Dashboard
Live assurance position for this tenant. Every figure below is computed from the registers — nothing is typed into a slide the night before an audit.
Certification journey
Continuous monitoring — drift since last scan
Assurance pulse
26 weeks of compliance activity — scans, evidence, attestations, reviews and audits. Click a week to filter the Activity feed below.
Residual risk
Posture score trend
Governance
Activity
Board view
A live, presentation-ready summary — pull this up instead of screen-sharing the full console. Nothing here is editable; it always reflects the current data.
Certification roadmap
Top risks
Upcoming milestones
Control Constellation
Every applicable — and not-yet-applicable — control across your entitled frameworks, arranged one arc per framework and grouped by theme. Curved lines are the registry's own cross-framework mappings: implement one control, and everything it also satisfies lights up. Hover a control to see its whole mapped cluster; click to pin it and open full detail.
Posture scan
Reads Conditional Access, directory roles, PIM, Identity Protection, Intune, OAuth app grants and Secure Score via Microsoft Graph — read-only, inside the tenant — across Identity, Devices, Apps & Data, Monitoring, Continuity, Supplier and Governance. Failed and review-grade checks become proposed risks and actions for your approval; checks with no automatable signal show Manual — verify rather than a false pass. Nothing enters the client register without a practitioner's sign-off.
Tenant posture
Checks
Coverage
What Checkpoint can check automatically in this tenant, based on the Microsoft 365 licensing and access actually in place — not every tenant has every premium licence, and the checks that need one show as Manual rather than a guess when it's missing.
Risk register
Inherent and residual scoring, linked controls and treatment actions. Residual scores recalculate automatically as linked actions complete.
Residual risk heatmap
Every open risk plotted by likelihood × impact — where the register is actually concentrated, at a glance.
| ID | Risk | Category | Source | Inherent | Residual | Owner | Status |
|---|
Financial risk analysis
Every open risk's likelihood/impact score, translated into a simulated annual loss distribution — 10,000-trial Monte Carlo, re-run automatically whenever the risk register changes. Loss frequency and magnitude ranges are derived directly from each risk's own residual score (documented, editable assumptions below) — no separate data entry required. Treat this as a defensible order-of-magnitude view, not a measured figure: refine a risk's own numbers by hand wherever real loss history or insurance/actuarial data exists.
Loss exceedance curve
The probability that this tenant's total annual loss from open risks exceeds a given amount — read any point as "there's a Y% chance losses exceed $X this year."
Assumptions
The illustrative loss-magnitude and event-frequency ranges each residual score maps to — the only inputs this simulation runs on.
Risk ranking by simulated exposure
The same open risks as the Risk register, re-ordered by simulated financial exposure (P90 annual loss) rather than ordinal L×I — the two rankings don't always agree.
| ID | Risk | Residual band | Mean annual loss | P90 annual loss | P99 annual loss |
|---|
Actions register
Every action traces to a risk and a control. Completing an action prompts evidence capture and updates the linked risk's residual score — the audit trail builds itself. Also the home for non-conformities and observations raised during internal or external audits.
Due runway
Every open action by how far past — or short of — its due date. Where the pressure actually is on the calendar.
Status by priority
Not "how many actions are open" — whether the ones that matter most are actually moving.
| ID | Action | Type | Risk | Control | Priority | Owner | Due | Status | Evidence |
|---|
Vendor risk
Third-party suppliers with access to systems or data, reviewed on a cadence proportional to their criticality. Linked to the supplier-related controls (A.5.19–A.5.23, CC9.2, DISP.26) and to the risk register — an overdue review here is a live gap in the Statement of Applicability, not a separate spreadsheet.
Review status by criticality
A Critical or High vendor still sitting at Not started is the row that matters most — not just how many vendors exist.
| ID | Vendor | Criticality | Review status | Next review | Certifications | Owner | Questionnaire |
|---|
AI systems
Every AI system in use, its impact assessment status, and the ISO 42001 controls it evidences — the register ISO 42001 certification is actually built on, not a slide deck assembled the week before audit. EU AI Act risk tiers (Prohibited/High/Limited/Minimal) drive how much scrutiny each system gets.
Impact assessment status by risk tier
A Prohibited or High-tier system with no impact assessment started is the one an assessor asks about first.
| ID | System | Risk tier | Impact assessment | Vendor | Owner | Last reviewed |
|---|
Frameworks
Every framework Compliance365 delivers is available in Checkpoint. ISO 27001 is included as the baseline; every additional framework is unlocked by a Compliance365-issued, signed entitlement file — not a self-service toggle. Enabling a framework makes its control set appear in the Statement of Applicability immediately; nothing is deleted when a framework is switched off.
Licence
Upload or paste the entitlement file Compliance365 issued for this tenant. It's verified in this browser (Ed25519 signature, tenant match, expiry) before anything changes — nothing is sent anywhere to check it.
Per-framework configuration — the maturity level or reporting shape each framework is being worked towards. Only the frameworks entitled on this tenant appear.
Settings
How Checkpoint behaves for this tenant — reporting and branding, the automation cadences, posture thresholds, optional features, and the organisation profile generated documents fill themselves in from. Framework licensing and per-framework targets live in the Frameworks view.
What generated reports and policy documents carry — the client's own name, logo, accent colour and classification marking.
The facts ISO 27001 expects this organisation to be specific about — its scope boundaries (Clause 4.3), its interested parties and their requirements (Clause 4.2). Answered once here, then filled into every generated document that needs them, instead of being retyped into each one. Left blank, documents generate with generic wording exactly as before.
How often Checkpoint expects work to happen, and who it tells when it hasn't. The scheduled monitor (SETUP.md § Continuous monitoring) acts on these unattended once deployed.
Posture-scan pass/review/fail thresholds, tunable per client. Each falls back to the default shown if left blank.
Optional dashboard and workflow additions — switch any of these off per client without losing data. Turning one back on picks up exactly where it left off.
Step back through the tenant capability check, site selection and framework picks, then re-provision and re-scan. Safe to run again — nothing already in your registers is deleted.
Every register can also be exported as a flat CSV file from its own view — see the "Export CSV" button at the top of Risks, Actions (plus its own progress-log export), the Statement of Applicability, Vendor risk, Internal audits, Management review, the Compliance calendar and the Audit log. The client's data always stays in their own SharePoint lists regardless — this is a portable copy alongside it, for offboarding, an offline backup, or handing a snapshot to an auditor who wants a spreadsheet.
Every register's CSV in one download, built entirely in this browser — nothing is uploaded anywhere to produce it.
Statement of Applicability
One control set per purchased framework, cross-mapped to the others so shared evidence is never duplicated. Essential Eight is assessed by maturity level (ML1-ML3) per strategy against your target level, set in Frameworks — every other framework's full published control set ships ready to use.
Status by theme
Implementation mix across this framework's own theme/category grouping — bar length reflects how many controls sit in each theme.
| Control | Title | Applicable | Status | Also satisfies | Owner | Verified | Evidence |
|---|
Documents
Real evidence storage in this tenant's SharePoint — the ISMS manual, policies, risk treatment plan, training records. Upload here, or upload directly in SharePoint and paste the link when linking evidence to a control or action. Files over 4 MB: upload in SharePoint directly, then paste the link.
Interpret evidence with AI
Paste the text of an assurance artefact you already hold — a supplier's SOC 2 report, a penetration test summary, an access review sign-off, a backup job report — and get a draft of which of your controls it evidences, the period it covers, and, just as usefully, what it does not cover. Nothing is linked to a control until you say so.
Policy template library
Starter policies and management-system documents, written for a Microsoft 365 environment and grouped by the frameworks this tenant is licensed for. Personalise, generate a print-ready document, and save a copy straight into Policies & Procedures below — registered as DRAFT with its owner and review date until a practitioner approves it.
Upload a document
Document control register
ISO 27001 clause 7.5.2/7.5.3 — every controlled document carries an owner, a version, an approval and a next-review date. These are real SharePoint columns on the library, so the same register is visible natively in SharePoint too.
| Document | Owner | Version | Status | Next review |
|---|
Policy attestation
ISO 27001 A.5.1 requires policies to be communicated to — and acknowledged by — relevant personnel, and A.6.3 expects the same of awareness material. An auditor samples individuals, so this records one row per person per policy version, with the date they acknowledged it. Employees see only their own outstanding items.
My attestations
Campaigns
| Campaign | Policy | Launched | Progress | Outstanding |
|---|
All attestation records
| Person | Policy | Version | Assigned | Acknowledged | Status |
|---|
Training
ISO 27001 A.6.3 and clause 7.2/7.3 expect awareness and competence to be delivered and demonstrated, not just offered — and an auditor samples individuals. Each course ends in a short comprehension check, and completion is recorded per person against that course version. Phishing simulation is deliberately not duplicated here; Microsoft Defender's Attack Simulation Training does that job.
My training
Course catalogue
Filtered to the frameworks this tenant is licensed for. Anyone can read a course at any time — completion is only recorded against an assignment.
Training campaigns
| Campaign | Course | Assigned | Completion | Outstanding |
|---|
All training records
| Person | Course | Version | Assigned | Completed | Score | Status |
|---|
Internal audits
ISO 27001 clause 9.2 requires the organisation to run its own internal audit programme, independent of any external certification audit. Schedule audits per framework, record the outcome, and raise findings straight from an audit — each becomes a non-conformity or observation in the Actions register, linked back to the audit, with nonconformities flowing into the corrective-action (Clause 10.1) loop.
| ID | Framework | Scope | Auditor | Planned | Status |
|---|
Incident register
ISO 27001 clauses A.5.24–A.5.28 require a planned, documented approach to information security incidents — not just the ones Microsoft Defender can see. Log anything from a phishing click to a laptop left on a train here; a Defender-detected incident can be logged too (set "Discovered via" to Defender alert) so this register is the single record an auditor is shown. Incidents involving personal information are flagged for a privacy-breach assessment, tracked against a 30-day default clock in line with the Privacy Act 1988 Notifiable Data Breaches scheme — check your own jurisdiction's actual deadline; this is a sane default, not legal advice.
| ID | Title | Category | Severity | Detected | Status | Privacy assessment |
|---|
Management review
ISO 27001 clause 9.3 requires top management to review the ISMS at planned intervals. Recording a review here captures its inputs structured against the seven clause 9.3.2 sub-clauses (a–g) — the measurable ones (performance, risk status, prior actions) pre-filled from live data, the rest prompted for — alongside attendees and the decisions agreed. A minuted record an auditor can inspect.
| ID | Date | Attendees | Next due |
|---|
Compliance calendar
Every recurring ISMS activity in one place — access control reviews, BCP/DR and backup restore tests, supplier reviews, awareness training, the external surveillance audit cycle and certificate expiry. Complete an item and, if it recurs, its next due date rolls forward automatically.
| ID | Activity | Category | Frequency | Owner | Next due | Last completed |
|---|
Audit log
An append-only, read-only record of who changed what and when — control status changes, evidence links, verifications, risk approvals, action/audit/review/calendar activity and framework toggles. Evidence for ISO 27001 A.8.15 (logging) and SOC 2 CC7.2, distinct from the plain-English Activity feed on the Dashboard.
| When | Actor | Action | Target | Before | After |
|---|
Audit reports
Generated from the live registers, in Compliance365 brand. What used to be a fortnight of assembly is a button.
Statement of Applicability
Full SoA with applicability justifications, implementation status and evidence references. The document your certification auditor opens first.
Risk register snapshot
Complete register with heatmap summary, treatment decisions, movement since the last snapshot and Monte Carlo financial analysis.
Risk treatment plan
Every risk mapped to its treatment decision, the controls and actions treating it, its residual score and documented owner acceptance — the artifact an auditor cross-checks against the SoA.
Audit readiness report
Per-framework readiness: control implementation, open critical risks, overdue actions, evidence coverage — and what the auditor will ask about.
Management review pack
Quarterly KPI trends, top risks, action throughput and recommendations — satisfies the management review requirement directly.
Executive summary
One page: score with trend arrow, implementation %, high/critical risk count, next milestone, top 3 risks. Built for a five-minute board update.
Self-test
Pure-logic regression checks — registry integrity, scoring math, residual calculation, entitlement verification, the six report charts, and CSV escaping. Demo-mode-only diagnostics: this is not a substitute for the manual acceptance pass in ACCEPTANCE.md, which is the only thing that ever touches a real tenant.
| Result | Group | Check | Detail |
|---|
Trust Center
A public, read-only page — certifications held, high-level posture, Statement of Applicability summary and (optionally) your sub-processor list. Generated as a single self-contained HTML file into this tenant's own Documents library. Publishing it is a normal SharePoint sharing action you take yourself — Checkpoint generates the file and never makes anything public on its own.
What's shown
Sub-processors listed publicly
Only appears on the page if "Sub-processor list" above is switched on. Choose which vendors from the Vendor risk register are named.
Auditor pack
Assembles the current Statement of Applicability, an evidence index, a recent audit log excerpt and the latest management review record into one file an external auditor can open via a SharePoint sharing link — no Checkpoint licence needed. Time-boxing and access control are enforced by SharePoint's own sharing-link expiry when you create that link, not by Checkpoint.
AI assistant
A drafting aid grounded in your own compliance registers — policy language, evidence descriptions, risk treatment notes, report commentary. Runs against your own Azure OpenAI resource in your own tenant (see AI-SETUP.md) — nothing is sent to Compliance365 or any third party, and the assistant can only read what you choose to include below and only ever returns text for you to review. It never writes to any register, and every response carries a visible "AI-assisted draft — review before use" label.
Questionnaire assistant
Paste a security/compliance questionnaire (one question per line) and get a draft answer for each, grounded in your Statement of Applicability and latest scan — with a confidence level and what to verify before sending. Every answer is a draft; review each one before it leaves this app.
Mock auditor
Generates 10 interview questions an external auditor might ask, targeting your CURRENT gaps — unevidenced implemented controls, failing posture checks, overdue actions — with an honest model answer for each, including where the honest answer is "we have a gap". A rehearsal tool, not a substitute for the real audit.
Evidence request simulator
Generates a realistic evidence request list — the artefacts an external auditor would ask to see for your Implemented controls — and flags which ones you already have evidence for versus which are missing. Ready/Missing is read directly from your own register, never guessed by the model. A rehearsal tool, not a substitute for the real audit.