ISO 27001 & SOC 2 compliance automation
for Microsoft 365
Certvik automates the operational side of compliance — evidence collection, scheduled reassessments, approval workflows and security monitoring — so your team can focus on the work that actually matters.
Invite-only early access · 14-day free trial · Reply within 1 business day
Works with your existing Microsoft stack
Up and running in minutes
No lengthy onboarding, no consultants needed to get started. Connect your Microsoft 365 tenant and Certvik does the rest.
Connect Microsoft 365
Sign in with your Microsoft account. Certvik scans your M365 environment automatically — no manual data entry.
Get your compliance picture
See exactly where you stand against ISO 27001 or SOC 2. Every gap is identified, prioritised and explained.
Stay audit-ready automatically
Evidence is collected on a schedule, approvals are routed to the right people, and reassessments are triggered automatically.
How the data flows
Microsoft 365
Your tenant
Certvik Scan
Automated, scheduled
Gap Analysis
ISO 27001 · SOC 2
Evidence
Auto-collected
Audit Ready
Year-round
See what's inside
A real look at the platform — click through the tabs to explore the dashboard, controls table, and evidence center.
Compliance Dashboard
Contoso Ltd · Last scan: Today 02:00 UTC
Compliance Score
74%
+6 pts this month
Secure Score
61%
Microsoft benchmark
MFA Coverage
88%
22 / 25 users
Open Findings
5
2 high severity
Score breakdown
Active findings
MFA not enforced for 3 admin accounts
Enable MFA via Conditional Access
Guest access unrestricted in SharePoint
Restrict external sharing to verified domains
14 devices not enrolled in Intune
Enforce device compliance policy
Audit log retention below 90 days
Extend retention to 180 days in Purview
2 inactive accounts enabled over 90 days
Disable or remove stale accounts
Scan history
Everything compliance — in one place
Replace the spreadsheets, shared drives and email reminders with a single platform that keeps your compliance program running automatically.
Automated evidence collection
Certvik pulls evidence directly from your M365 environment on a schedule. No more chasing people for screenshots.
Reminders & reassessment scheduling
Controls have review dates. Certvik reminds the right people when something needs attention — before it becomes a finding.
Approval workflows
Evidence goes through a structured approval process. Your auditor gets clean, timestamped documentation — not a folder of files.
M365 security hardening
M365 AutoSecure scans your tenant and enforces security policies in one click via the Graph API — no manual configuration required.
Executive reports in seconds
Generate branded Word and PDF compliance reports for your board, auditor or enterprise customer — on demand.
Continuous compliance monitoring
Your compliance posture is checked on every scan. Drift from your baseline triggers alerts before your next audit.
What changes when you use Certvik
Before Certvik
- Spreadsheet with 200+ rows updated manually
- Evidence collected by chasing people on Slack
- Review deadlines missed until audit day
- Auditor requests cause last-minute scrambles
- No visibility between annual audits
With Certvik
- Controls mapped automatically from M365 config
- Evidence pulled from your tenant on a schedule
- Review dates assigned and reminders sent automatically
- Auditor gets a clean, timestamped evidence pack
- Live compliance score updated on every scan
Built for companies that are growing fast
Your first enterprise customer asked for ISO 27001. An investor wants SOC 2. You don't have a compliance team. That's exactly who Certvik is for.
SaaS companies
Enterprise customers and investors increasingly require ISO 27001 or SOC 2. Get certified without hiring a compliance team.
FinTech & HealthTech
Regulated industries need continuous compliance, not just a one-time audit. Certvik keeps you covered between certifications.
Scale-ups entering new markets
Expanding into the EU or US often triggers compliance requirements. Get ahead of them before they block your deals.
What customers say
“We went from a folder of spreadsheets to audit-ready in 6 weeks. The automated evidence collection alone saved us days of work.”
Head of IT, SaaS company, Netherlands
“Our ISO 27001 auditor was impressed by how clean the evidence pack was. Everything was timestamped, approved and in one place.”
CTO, FinTech startup, Germany
Start with M365 security. Add frameworks as you need them.
Pay only for what you use. Every plan includes unlimited users and scans.
Founding Member Offer
Lock in M365 base at $199/mo — for life
0 of 25 founding spots remaining
Lock in your price for life — normal pricing shown crossed out.
M365 Scan
Full Microsoft 365 security posture scan with executive reports. The base layer — included in every framework plan.
Founding Member — save $50/mo · locked for life
- Full M365 security posture scan
- Executive reports (PDF + Word)
- Scheduled scans & unlimited users
- Compliance score & findings dashboard
- M365 scan included in all framework plans
ISO 27001
Full ISO 27001:2022 certification readiness. M365 scan included.
Founding Member — save $100/mo · locked for life
- All 93 ISO 27001:2022 controls mapped
- Gap analysis & compliance score
- Evidence centre with approval workflows
- Audit-ready control documentation
- Word templates for all 93 controls
- Compliance roadmap
- M365 security posture scan included
SOC 2
SOC 2 readiness tracking. Stack with ISO 27001 or use standalone. M365 scan included.
Founding Member — save $100/mo · locked for life
- SOC 2 Trust Services Criteria mapped
- Continuous control monitoring
- Evidence centre with approval workflows
- Auditor-ready reports
- Word templates per control
- Risk register
- M365 security posture scan included
M365 AutoSecure
One-click policy enforcement. Add-on to any framework plan. M365 scan included.
Founding Member — save $100/mo · locked for life
- One-click policy enforcement
- Continuous configuration drift detection
- Hardening recommendations
- Partial & manual evidence collection
- M365 security posture scan included
Free resources
Free compliance checklists
Start with a practical checklist for Microsoft 365 compliance or ISO 27001 evidence readiness.
Microsoft 365 Compliance Checklist
Review MFA, Conditional Access, guest users, privileged accounts, Secure Score, and evidence readiness.
- MFA and Conditional Access
- Guest user governance
- Privileged access review
- Microsoft Secure Score
ISO 27001 Evidence Checklist
Understand the evidence auditors commonly expect across policies, access reviews, risk treatment, suppliers, assets, and review records.
- Policies and responsibilities
- Access reviews
- Risk treatment evidence
- Review dates and approval records
Stop managing compliance in spreadsheets.
Invite-only early access. We review every request and send your invite within 1 business day.
Already have an invite? Sign in →
Not ready for software yet? Book a Microsoft 365 Security Assessment