The division of labour
The platform stores the evidence. Someone still has to produce it.
Most teams buy a platform, connect the integrations, and then find the completion percentage stops moving. What is left is the part that needs judgement rather than an API key.
What the platform does
- Holds your policies, evidence and control mappings in one place.
- Connects to your cloud, identity provider and code repositories, and collects technical evidence automatically.
- Flags controls that have drifted, and tracks tasks against a framework.
- Gives your auditor a single window into the evidence at audit time.
What Hael does
- Decides which framework and which scope actually answer your customers' questions.
- Writes the policies, risk assessments, statements of applicability and procedures the standard requires.
- Builds the controls the platform cannot collect for you: governance, training, supplier assurance, management review.
- Runs the internal audit, closes the gaps, and manages the certification body through Stage 1 and Stage 2.
- Answers the customer security questionnaires and sits on the buyer calls with you.
How the engagement runs
Four steps, inside the tool you already pay for.
01
We start from your platform, not a blank page
We take read access to what you already hold — control mappings, connected integrations, policy drafts, open tasks — and assess it against the standard rather than against the platform's own progress bar.
02
We close the evidence the platform cannot collect
Automated collectors cover technical configuration well. They do not produce a risk assessment, a statement of applicability, a supplier assurance process, a management review record or training evidence. We write and operate those with your team.
03
We load the artefacts back into the platform
Everything we produce lands in the tool you already pay for, mapped to the controls it tracks, so the audit window your certification body opens shows one coherent set of evidence.
04
We manage the audit
We select and brief the certification body, prepare your people for interview, run the internal audit ahead of Stage 1, and hold the corrective actions through to the certificate.
Platform-agnostic
We have no commercial relationship with any of them.
We do not resell, licence, refer or earn commission on compliance software. We have worked inside all of the platforms below, and we will work inside whichever one you have chosen.
- Vanta
- Drata
- Secureframe
- Sprinto
- Tugboat Logic
- Thoropass
- In-house evidence libraries
Product names are the trade marks of their respective owners and are used here only to describe the tools our clients run. No partnership, endorsement or affiliation is implied.
Straight answers
The four questions we are asked every time.
Does a compliance platform get us certified?
No. A platform organises evidence. Certification is granted by an accredited certification body after it audits your management system against the standard. The platform is not the auditor and cannot issue the certificate.
Do we still need an advisor if the platform gives us a policy library?
The templates give you a starting point. An auditor tests whether the policies describe what your organisation genuinely does, whether risk has been assessed on your own terms, and whether management has reviewed the outcome. That work is judgement, and it is where readiness projects usually stall.
Will you make us change platform?
No. We do not resell, licence or earn commission on any compliance platform. If you already have one, we work inside it. If you do not, we can run the engagement without one.
Can you audit us as well?
No, and neither can your certification body's consultancy arm. ISO/IEC 17021-1 requires certification to be independent of the consultancy that built the system. We do the readiness, implementation and internal audit; an accredited body external to us certifies.
Next step
Bring us the platform. We will bring the certification.
A scoping call establishes which framework your customers are actually asking for, what your platform already covers, and what remains before an accredited body can audit you.