Compliance management for ISO 27001, ENS and SOC 2
Getting certified in ISO 27001, ENS or SOC 2 is only the first step. Every framework asks you to define how security works in your company, prove that it works and keep proving it every year, through staff changes, new suppliers and new systems. Qalea manages that work with you. The platform holds your controls, policies, risks and evidence, and our compliance team helps you set them up, keep them current and prepare for each audit.
What we cover
Frameworks
ISO 27001, ENS, SOC 2, NIS2 and DORA, plus ISO 42001, ISO 27701, ISO 9001, GDPR and custom frameworks. Each control is mapped once and reused in every framework that requires it.
Policies and procedures
Templates for each framework that you adapt to your company: access control, incident management, onboarding and offboarding, asset classification and acceptable use. Every document has an owner, a version history, an approval and employee signatures.
Risk management
Identification, assessment and treatment of risks, with a treatment plan and an owner for each action.
Controls and evidence
Every control has an owner, a status and the evidence that proves it works. Technical evidence comes from the systems you connect, and the rest is uploaded with tasks and deadlines so nothing is missed.
Audits
A timeline from preparation to certification, the internal audit, nonconformity tracking and support during the external audit, which is run by the certification body you choose.
The problems we solve
Compliance depends on one person
When the person who ran the project leaves, the knowledge leaves with them. In Qalea, policies, controls and evidence live in one place with clear owners, so the program keeps running.
Every new framework feels like starting again
A public tender asks for ENS after you certified ISO 27001, or a US customer asks for SOC 2. Because controls are mapped across frameworks, the work you already did counts toward the next certification.
Evidence is scattered when the audit arrives
Spreadsheets, shared drives and email threads. Qalea links evidence to each control and shows what is missing before the auditor asks.
Your technical team ends up doing paperwork
Qalea drafts the documentation with your team and pulls technical evidence from your systems, so engineers stay focused on their work.
Customers keep asking for proof
Security questionnaires and supplier reviews take time. A Trust Center lets you share your compliance status and documents with the customers who need them.
What you get
Certifications you keep year after year, with the program kept current between audits
One view of every framework, with progress, owners and next steps
A compliance team that works alongside yours and answers to you
Less time from your own team on documentation and evidence
companies work with Qalea. We hold ISO 27001, ISO 42001 and ENS (category ALTA) ourselves, plus a SOC 2 report.
Choose your frameworks and Qalea loads the controls and document templates for each one, grouped by security area, with progress per framework and a timeline to the audit.
Show your compliance status in real time with trust center.
Technical evidence such as disk encryption, screen lock and MFA checks comes from Qalea's security modules, so your controls are backed by real data, not only screenshots.
trust Qalea
Frameworks you can manage in Qalea
GDPR and custom frameworks can also be managed in the platform.
Certified and kept current
We had an ISMS up and running in one month.
Qalea did their job, while our tech team didn't get distracted from their role: building product.
With Qalea platform, we successfully kept our ISO 27001 certification, with less effort.
Everything an audit ready program needs.
Evidence from the tools you use
Connect Google Workspace, Microsoft 365, AWS, Google Cloud, Azure, GitHub, GitLab and Bitbucket, so evidence for your controls comes from the systems you already run.
Compliance questions, answered
Keep learning about compliance
