Your control environment,
audit-ready all year.
Cornerstone GRC is the system of record for controls, evidence, risk, policies, and vendors — mapped to every framework you are certified against, so audit season is a review rather than a scramble.
- One control, every framework
- Evidence that never lapses
- Gaps you can actually see
Readiness assessment
Walk into the audit already knowing the outcome
A readiness assessment maps what you have against what the framework demands — before an auditor bills you to find out. Cornerstone runs that assessment continuously: every control mapped to every criterion, every gap named, every fix tracked to done.
Map your controls to the criteria
Bring your control set — ours, your previous auditor's, or your own — and map each control to the individual criteria it satisfies across SOC 2, ISO 27001, and HIPAA at once.
See every gap, stated outright
A criterion with no covering control is listed as an explicit gap. Nothing is averaged into a blended score that hides unsatisfied requirements.
Close gaps with owners and dates
Each gap becomes tracked remediation work with an owner and a due date. Evidence attaches to the control as you close it, so the fix is audit-ready the day it lands.
- Per-criterion coverage, not one blended score
- Gaps listed, never averaged away
- Remediation with owners and due dates
The platform
Everything your compliance programme runs on
One system of record for your control environment — what each control is, who owns it, what evidences it, and whether it is holding up between audits.
Controls and evidence
Control library
Every control with its owner, test frequency, implementation detail, and current status — mapped to the framework criteria it satisfies.
Evidence management
A register of what has been collected, which controls it supports, and what is close to expiry, so nothing lapses quietly between audits.
Continuous monitoring
Controls carry a test frequency and a next-review date. Work that is coming due surfaces before it becomes an audit finding.
Integrations
Connect the systems that already hold your evidence, so collection is not a quarterly scramble.
Framework readiness
Readiness by criterion
Progress against each individual criterion rather than one aggregate percentage, so you can see exactly which requirements are unsatisfied.
Multi-framework mapping
One control can satisfy criteria across SOC 2, ISO 27001, and HIPAA at once. Evidence gathered for one certification counts toward the others.
Gap visibility
A criterion nothing covers is shown as an explicit gap, not averaged into a comfortable score.
Risk and governance
Risk register
Scored risks with treatment plans, bulk import, and linkage to the controls that mitigate them.
Policy management
Policy library with version history and per-employee acknowledgement tracking.
Vendor risk
Third-party inventory with review cadence and the evidence supporting each assessment.
People and access
Personnel records
Onboarding, offboarding, and security training completion, kept audit-ready.
Access reviews
Periodic entitlement reviews with the reviewer, date, and outcome recorded as evidence automatically.
Change management
Code and configuration change records tied to the controls that govern them.
Working with your auditor
Auditor correspondence
Evidence requests and your responses live on the control itself, so the audit trail is the conversation — not a mail thread.
Request tracking
See every outstanding auditor request in one place, with who owns it and what is blocking it.
Scoped auditor access
Your auditor sees the engagement they are assigned to, and nothing beyond it.
Risk and governance
Risks scored, owned, and tied to the controls that treat them
The risk register is not a spreadsheet to dust off before board meetings — it lives beside your controls, so treatment is a link, not a promise.
Risk register
Scored risks with treatment plans, bulk import, and linkage to the controls that mitigate them.
Policy management
Policy library with version history and per-employee acknowledgement tracking.
Vendor risk
Third-party inventory with review cadence and the evidence supporting each assessment.
Why teams choose it
Built for the audit you actually face
Not a checklist that produces a readiness percentage nobody trusts.
One control, every framework
Controls map to criteria across SOC 2, ISO 27001, and HIPAA simultaneously. Evidence gathered for one certification counts toward the others, so a second framework is an increment rather than a second programme.
Gaps stay visible
A criterion nothing covers is displayed as an explicit gap rather than averaged into a readiness score. Comfortable numbers that hide unsatisfied requirements are worse than useless before an audit.
Evidence that stays attached
Evidence, ownership, and auditor correspondence live on the control they belong to. When audit season arrives, the trail is already assembled — because it was never separate.
Your auditor works in your system
Instead of exporting a spreadsheet and reconciling it later, your audit firm reads directly from your control environment. Their working papers stay theirs; your data stays yours.
Coverage
The frameworks you are examined against
Tracked at the level of the individual criterion, so a single control can carry credit across several certifications at once.
SOC 2
Type I and Type II
All five Trust Services Criteria — Security, Availability, Confidentiality, Processing Integrity, and Privacy — down to the individual criterion.
ISO 27001
Information security management
Annex A controls with statement-of-applicability tracking and surveillance-audit support.
HIPAA
Security and Privacy Rules
Administrative, physical, and technical safeguards for organisations handling protected health information.
Custom
Your own framework
Import a control set and map it to any criteria structure your programme requires.
Audit Workspace
Fieldwork tooling for the firm conducting the audit. Most customers never touch it — it exists so your auditor can work directly against your control environment instead of a spreadsheet circulated by email.
Testing sheet as a control matrix
Preparer and reviewer sign-off
Report generation
Internal QA review
Who needs it: Audit and assurance firms, and organisations whose internal audit function runs its own testing. If that is not you, the platform stands on its own.
About the add-onSee it against your own framework
A thirty-minute working session on your actual controls — not a slide deck.