Esta página también está disponible en español.
Compliance · Governance, risk and compliance (GRC)
Every audit asks for the same evidence again, under another name. In Almenara you upload a piece of evidence once and it counts for every control and every framework that asks for it; when it is about to expire, you are warned in all of them at once.
One control, one piece of evidence, every framework that asks for it
Every framework is mapped to a set of common controls. The evidence is linked to the common control and, from there, to every framework that asks for it. If it expires, the control goes from “demonstrated” to “declared” in all of them at once: you still do it, but you can no longer show it. Try letting one expire.
Illustrative example
Your systems lead · valid for 12 months
Counts for 5 frameworks
Your security lead · every six months
Counts for 5 frameworks
Your HR lead · every year
Counts for 4 frameworks
Your supplier lead · every year
Counts for 5 frameworks
The small codes are the requirement in each framework that asks for the evidence. Each framework may ask for more, and the platform tells you what.
A public-sector customer asks you for Spain’s National Security Framework (ENS). You do not start from scratch: Almenara shows you what you have already proven with current evidence and leaves you only what is specific to the ENS.
Illustrative example
Framework catalogue
We have studied the frameworks and the markets in depth, and every framework in the catalogue is mapped to the common controls. All of them are available: you answer them and attach evidence from day one.
From Spain, the European Union and beyond: laws and regulations, certifiable standards, good-practice frameworks and technical configurations.
Each framework is mapped to the common controls only once. That is why what you prove for one already counts for the others.
If your framework is not there or you have your own, you create it in Compliance and map it to the same controls.
Whoever runs the system works on the control; whoever audits it sees the same thing read-only, with the trail of every change. That is what changes on audit day. Here, the backup control in October.
Sample data
Head of systems
Almenara does not certify: accredited certification bodies do. And we don’t run the internal audit of a system we manage ourselves.
Assets, threats, valuation and treatment, linked to the controls that treat them. MAGERIT methodology for the ENS, with import from PILAR. When a control changes, you see which risks move.
The platform gathers the inputs for the management review: audits, nonconformities, risks and objectives. Management decides, and the decision goes in the minutes.
The SoA, the evidence and each control’s history in one export, ready for the visit.
When a customer sends you their security questionnaire, the answers come from the controls, policies and evidence you have already documented.
Tests, access reviews and training land in their owner’s calendar before the evidence expires.
Demo
In the last step of the case, the incident’s evidence is stored once and every framework that asks for it lights up.
Walk through the caseFramework catalogue
Every framework in the catalogue, with its publisher and version. All of them are available in Compliance.
See the framework catalogueWith the module, your team does the work and the platform organises it, reminds you and keeps it with its evidence. If you’d rather delegate part of it, our team does it as a fixed-scope service, contracted separately.
Gap analysis against a frameworkOnce
We measure where you stand against ISO 27001, the ENS or DORA and what you still need to comply.
Risk assessmentEvery year
The annual risk assessment of your security system, with MAGERIT and PILAR when it is for the ENS.
Internal auditEvery year
The annual internal audit of your security system, by someone who did not implement it.
Pre-certification auditEvery year
We audit your system the way the certification body would, so you can fix things before the real audit.
Virtual CISOEvery month
An external security lead for your organisation. The scope is agreed with you in the proposal.
What happens in this module reaches the others without being entered again.
And the same evidence works for ISO 27001, Spain’s National Security Framework (ENS), DORA, NIS2, a customer’s questionnaire or any other framework in the catalogue.
Ask for information or a meeting: in 60 minutes we load a sample of your data and you see it working.