de.iterate is an Australian GRC platform for cyber security and IT risk management. It gives your information security management system (ISMS) a single home. Assets, cyber risks, controls and incidents all link to each other, with control libraries for ISO 27001, NIST and the major government cyber security standards.
Instead of managing policies in one place, risks in another, evidence in folders, and audits through a last-minute scramble, de.iterate connects the whole system. That means better visibility, clearer ownership, stronger assurance and less time lost to manual admin. The current platform spans policies, assurance tasks, registers, evidence, reporting, Trust Centre capabilities, auditor access and support for multiple frameworks.
We help you get your ducks in a row.
212 laptops, or 240?
The asset register says 212. Intune says 240. Your Statement of Applicability was last updated when someone had a spare afternoon, and your incident response plan was written before ransomware payment reporting became law.
Larger organisations have an ISMS platform, and three certificates to run through it. Each business unit holds its own scope, its own Statement of Applicability and its own version of the incident response plan, drafted at different times by different people. The asset count comes from four tools: Intune says 240, Jamf says 61, the CMDB says 318, and the ISMS register was reconciled by hand before the last surveillance audit and not since. The ISMS manager knows every control. IT operations owns the assets, legal owns the incident plan, and the three meet twice a year, in the fortnight before the auditor arrives.
None of it is anyone’s fault. It’s what happens when an ISMS lives in a folder on SharePoint, or in a platform only one person opens.
An ISMS is in good shape when the risk register, the Statement of Applicability, the asset list and the incident plan all describe the same organisation on the same day. de.iterate keeps them connected. Cyber risks link to the assets they affect and the controls that treat them, the SoA updates as control status changes, the asset register is checked against the tools that actually manage your devices, and every framework you hold draws on the same mapped controls and the same evidence.
Record information security risks and threats in a dedicated cyber risk register, with ISO 27001 and NIST control libraries built in. Each risk links to the assets it affects and the controls that treat it.
Manage applicability, exclusions and implementation status for every control in one place, so your Statement of Applicability is ready whenever your auditor asks for it.
de.iterate can compare your asset register across your platforms like Microsoft Intune, Jamf, CrowdStrike, Microsoft Defender and SentinelOne, and alerts you when they drift out of tolerance.
Log incidents, near misses and breaches in de.iterate's Incident Register, with actions and follow-up, and link each one to the risks it relates to and the controls that should have prevented it. Your incident history then informs your risk scores, and the reporting trail is ready.
Manage more than one ISMS scope in de.iterate, each with its own SOA, risk treatment plan and audit history, while sharing the controls and evidence that apply across all of them. One business unit’s audit no longer means rebuilding what another unit already proved.
Manage ISO 27001, SOC 2, Essential Eight, the ISM, NIST, CIS v8, SMB1001, DISP and Cyber Essentials in one platform. Controls are mapped across them, so evidence collected once counts wherever it applies.
A risk register with a pulse, with inherent and residual scoring, heatmaps and risk appetite.
Every obligation traced to the evidence that meets it, across 25+ frameworks.
Plain-English policies, clear approvals and proof your staff have read them.
Scheduled controls testing, with the evidence ready before your auditor asks.
ISO 42001, AI impact assessments and an inventory of the AI in your business.
Find your personal information, see where it goes and keep your privacy policy current.
ISO 9001, ISO 14001 and ISO 45001, running alongside everything else you manage.
