- contact@verticalserve.com
- Continuous compliance, proven every hour
Frameworks, automated testing, people, policies, vendors, risk, access reviews, audits and trust, built around one set of controls so nothing is collected twice.
Each page shows the real screen from the demo company, how the feature works underneath, and where it stops.
8 frameworks and 559 requirements mapped to 114 unified controls; scope criteria in or out with a recorded reason; custom frameworks.
Learn more65 automated tests every hour over a normalized inventory; exceptions with expiry; one issue per failing test, closed when it passes.
Learn more45 read-only connectors across cloud, identity, HR, code, devices, scanners, ticketing and monitoring; a CSV import and a push API.
Learn morePersonnel from HR or the IdP; onboarding and offboarding checked against every system; laptop posture from MDM or a small agent.
Learn moreTwenty-three policy templates with versions, approval, publishing and per-version acceptance; five built-in courses with quizzes.
Learn moreVendor inventory and reviews, SOC report evaluation with CUEC mapping, SaaS discovery from the IdP, and a 47-risk register.
Learn moreCampaigns from any identity system with automatic flags; every account decided; the review becomes evidence and revocations become issues.
Learn moreRequests generated from controls, an auditor scoped to one audit, populations with seeded sampling, findings and a downloadable package.
Learn moreThirteen editable control objectives, CUECs and CSOCs in the system description, carved-out subservice organizations monitored.
Learn moreA public page with frameworks, live control status by domain, subprocessors, FAQs and NDA-gated documents behind expiring links.
Learn moreQuestionnaires answered from approved answers, published policies and live control health, with citations; Ask Assure about your own program.
Learn moreA workspace per client, consultant roles in each, auditors invited per audit, and a portfolio of every client’s readiness.
Learn moreEvery monitor reads normalized resource types, so it works with whichever tool supplies them.
| Area | Monitors | For example |
|---|---|---|
| Identity & access | 8 | MFA is enabled for everyone in the identity provider; MFA is enabled on every system account (source control, cloud, SaaS); Administrators use MFA… |
| Cloud accounts & logging | 10 | Cloud root accounts have MFA; Cloud password policy requires 12+ characters; Cloud audit logging is enabled… |
| Data stores | 9 | Storage buckets are not public; Storage buckets are encrypted at rest; Storage buckets keep versions… |
| Network | 3 | SSH and RDP are not open to the internet; Only web ports are open to the internet; Load balancers serve HTTPS only |
| Source code & changes | 10 | Default branches are protected; Merges need at least one approving review; Merges need passing CI… |
| Vulnerabilities | 4 | Critical vulnerabilities are fixed within SLA; High vulnerabilities are fixed within SLA; Medium vulnerabilities are fixed within SLA… |
| Devices | 7 | Devices have full-disk encryption; Devices lock within 15 minutes; Devices run anti-malware / EDR… |
| People | 6 | Every person has a monitored device; New personnel have a completed background check; Security awareness training is current… |
| The program itself | 5 | Policies are approved, published and reviewed within a year; Critical and high-risk vendors were reviewed in the last 12 months; Subservice organizations' SOC reports are current… |
| Operations | 3 | Security incidents are resolved within 30 days; Production monitoring alerts someone; An on-call rotation is configured |
Every resource the integrations found, by normalized type, with an in-scope toggle that requires a reason. Deleted resources are kept, marked.
One remediation queue: issues from failing monitors, audit findings, access reviews and vendor reviews, with severity-based due dates; push to Jira, Linear or Asana.
Files, links, statements and frozen monitor snapshots, each linked to the controls it proves, with a collection date and an optional validity period.
Onboarding windows, the offboarding SLA, the access-review cadence and vulnerability SLAs by severity: the rules the monitors hold you to.
Policies to accept, reviews coming due, audit requests due and evidence about to expire, in the in-app bell, once a day.
A side panel on every screen: ask about your own controls, people, vendors and audits; answers cite the policies and controls they come from.
