de.iterate is an Australian GRC platform with controls management and controls testing built in. Writing a control down takes five minutes. Showing it has operated every month for three years takes a system. de.iterate links each control to what it protects, schedules the testing and keeps the evidence together.
Instead of managing policies in one place, risks in another, evidence in folders, and audits through a last-minute scramble, de.iterate connects the whole system. That means better visibility, clearer ownership, stronger assurance and less time lost to manual admin. The current platform spans policies, assurance tasks, registers, evidence, reporting, Trust Centre capabilities, auditor access and support for multiple frameworks.
We help you get your ducks in a row.
A control owner finds out they own a control when the auditor asks for evidence. Testing happens in one frantic burst. The screenshot that proves it all is in someone’s inbox, and that someone left in March.
Larger organisations have a controls library, and the problem has scaled with it. Four hundred controls sit in the GRC platform, each with an owner assigned during implementation, and a third of those owners have since moved roles. Testing runs to a calendar, so the same control is tested in March for ISO, in June for SOC 2 and in September by internal audit, with three sets of evidence filed in three places by three teams who don’t compare notes. The control owner answers all three requests with the same screenshot and starts to wonder why anyone needs it.
Either way, the evidence exists and nobody can find it when it counts.
A control is only worth having if someone owns it, it gets tested often enough to be trusted, and the evidence lives somewhere other than an inbox. de.iterate builds controls that way. Each control is mapped once across every framework it satisfies, testing is broken into scheduled tasks with named owners, evidence stays attached to the control it proves, and integrations with your security tooling check that what the control says matches what the systems show.
Link any control to multiple risks, obligations, assets and policies. Start from a control library that's already mapped across frameworks, so one control can count towards ISO 27001, SOC 2 and Essential Eight together.
Assurance Tasks break testing into scheduled activities, each with an owner and a due date. Scheduling rules set how often each task falls due, and de.iterate sends the reminders.
Document each control's design, then assess its design and operating effectiveness with evidence attached. Assurance Checklists turn repeatable reviews into checklists you can send to colleagues or third parties.
de.iterate enriches your asset register with integration data from your technology vendors like Microsoft Intune, Jamf, CrowdStrike, Microsoft Defender and SentinelOne, and can alert when providers views drift.
Attach evidence to the control it proves, with the date and the person who collected it. Every framework that relies on that control draws on the same evidence, so one screenshot answers the ISO auditor, the SOC 2 assessor and internal audit without three separate requests.
When a test shows a control isn’t working, de.iterate raises a finding, assigns a corrective action and tracks it to closure. Because control effectiveness feeds residual risk, the risks that depend on that control update at the same time, so the register reflects the gap until it’s fixed.
A risk register with a pulse, with inherent and residual scoring, heatmaps and risk appetite.
Every obligation traced to the evidence that meets it, across 25+ frameworks.
Plain-English policies, clear approvals and proof your staff have read them.
ISO 42001, AI impact assessments and an inventory of the AI in your business.
Find your personal information, see where it goes and keep your privacy policy current.
ISO 9001, ISO 14001 and ISO 45001, running alongside everything else you manage.
