StravayaContact us
Stravaya Labs

The products we build

Each product is built to stand on its own: its own name, address and accounts. They share one library of controls, and one rule: people decide, the software prepares.

CONTROLREGISTRYOne control, written once,serving each frameworkthat asks for it.ISO 27001A.5.18SOC 2CC6.2NIST 800-53AC-2CC-ACC-003User AccessProvisioninga common control
ControlRegistry

The governed control library

Each framework it carries, every control, and the common controls between them. One control, written once, serving each framework that asks for it. Each mapping is a candidate with its reasoning; whether it satisfies your auditor is your auditor's decision.

Free for organisations, by approval.

Visit controlregistry.io →
ASSUREDESKBeta by invitationWorked once.Judged per requirement.Decided by people.REQUIREMENTS · USER ACCESS PROVISIONINGAccess review recordsSupportedAcceptedJoiner and leaver logPartialOpenPrivileged access listMissingOpen
AssureDesk Beta by invitation

The workspace for certification

Every framework your organisation is held to, in one workspace shared with your auditor. The work is done once, on common controls; each framework's evidence requirements are judged on their own, and a person accepts each one.

Request a beta invitation →
13frameworks carried
1,522controls
137common controls
1,854candidate mappings

From the ControlRegistry library, release 1.4.0. Read from the published release when the site is built.

How the evidence rating works

The software prepares. People decide.

THE EVIDENCE RATINGRead. Rated. Thenaccepted by a person.ReadSupportedPartialMissingNot checkedRated, with reasonsAccepted by a person
Runs on its ownReading and ratingEach document is read against each evidence requirement and given a word: Supported, Partial, Missing or Not checked, with its reasons.
Needs a personAccepting and approvingA person accepts each requirement, and an approver signs off each control. Nobody approves their own work.
Never automatedThe audit conclusionWhether your organisation meets a standard is your auditor's decision, and only theirs.

See an example First Review report →

AssureDesk beta

Who the beta suits today

A good fit
  • Preparing for ISO 27001 or SOC 2, or both
  • A named owner for security and compliance
  • Ready to share evidence with your auditor in one place
Not yet a fit
  • Frameworks the library does not carry yet
  • Connectors that collect evidence automatically
  • Installation on your own servers, planned after the first release