GRC Automation Tool
TrustGrid: One Control Library, Evidence Collected Once, Mapped Across ISO 27001, SOC 2 and PCI DSS
TrustGrid is SecureRoot's governance, risk and compliance platform. It holds one control set mapped across every framework you are pursuing, so a single piece of evidence answers ISO 27001, SOC 2 and PCI DSS at once, and your team can see what is open, what is due and what an auditor will ask for next.
At a Glance
- Used on
- SecureRoot ISO 27001, SOC 2, PCI DSS and vCISO engagements
- Core idea
- One control library, many framework mappings
- Also covers
- Third-party risk assessments and internal audit tracking
- Status
- SecureRoot's own platform; not a certification body or an auditor
One control set, scored against every framework you hold.
In One Paragraph
In One Paragraph
TrustGrid is SecureRoot's governance, risk and compliance platform. It keeps one control library mapped across ISO 27001, SOC 2 and PCI DSS so that a single piece of evidence is collected once, owned, renewed on a calendar and exported in the shape each auditor expects. SecureRoot uses it on its own compliance and vCISO engagements; it is not a certification body or an auditor.
The Problem
Three frameworks, one security team, and the same evidence requested three times.
An organisation holding ISO 27001 and pursuing SOC 2 and PCI DSS is running three control sets that overlap by most of their length. Without a mapping, each audit cycle asks the same engineers for the same access review, the same backup test and the same policy, in three formats, on three dates.
The evidence then lives in a shared drive and a spreadsheet, where nobody can see which items have expired, who owns the renewal, or what the next audit will ask for first.
TrustGrid was built on engagements where that busywork was eating the client's week. It keeps one control library, maps each control to every framework it satisfies, and tracks the evidence once.
Capabilities
What TrustGrid Does
The capabilities below are the ones SecureRoot uses on its own engagements and the ones this site has described since the platform was first listed.
01
One control library, many frameworks
Each control is written once and mapped to the clauses of ISO 27001, the SOC 2 Trust Services Criteria and the PCI DSS requirements it satisfies, so a control's status is scored against every framework at once.
02
Evidence collection with ownership
Every evidence item has an owner, a collection date and a renewal date. The platform asks for the renewal before the evidence expires, not after the auditor notices.
03
Audit-ready exports
Control status, evidence and the mapping export in the shape an auditor expects for each framework, so an audit starts from a package rather than a request list.
04
Internal audit tracking
Internal audits, findings and corrective actions are tracked in the same place as the controls they test, which is what ISO 27001 clause 9.2 and the management review expect to see.
05
Third-party risk assessments
Vendor assessments, questionnaires and the evidence vendors return sit beside your own controls, so third-party risk is managed with the same ownership and renewal discipline.
06
A readiness view for the board
Readiness per framework, a trust score broken into the measures that produce it, and the failing checks named rather than averaged away.
How It Works
How TrustGrid Comes Into an Engagement
TrustGrid supports the consulting; it does not replace the judgement. Here is where it enters a typical compliance programme.
01
Load the frameworks
The frameworks you hold or are pursuing are loaded, and the control library is mapped to each. Overlaps are made visible before any evidence is requested.
02
Assign and collect
Controls and evidence items are assigned to owners with due dates. The first collection cycle usually shows where the real gaps are, as distinct from the paperwork gaps.
03
Test and remediate
SecureRoot's consultants test the controls and raise findings in the platform. Remediation is tracked to closure with evidence, and internal audits are scheduled from the same view.
04
Audit and renew
The audit package is exported per framework. After the audit, the renewal calendar keeps the evidence current, so the next cycle starts from a maintained state rather than a scramble.
Workflow
The Evidence Lifecycle in TrustGrid
How one piece of evidence travels from request to audit package, and why it is only ever collected once.
- 01
Map
Each control in the library is mapped to every clause, criterion or requirement it satisfies across the frameworks in play.
- Owner:
- SecureRoot consultant
- Record:
- Control-to-framework mapping
- 02
Assign
The control and its evidence items get an owner, a collection date and a renewal date.
- Owner:
- Control owner
- Record:
- Assignment with due dates
- 03
Collect
The owner attaches the evidence once. It is scored against every framework the control maps to.
- Owner:
- Control owner
- Record:
- Evidence item with date
- 04
Test
The consultant tests the control, raises a finding where it fails, and tracks remediation to closure with evidence.
- Owner:
- SecureRoot consultant
- Record:
- Finding and closure evidence
- 05
Export
Control status, evidence and the mapping are exported per framework in the shape the auditor asks for.
- Owner:
- TrustGrid
- Record:
- Audit package
- 06
Renew
The renewal calendar asks for fresh evidence before the old item expires, so the next cycle starts from a maintained state.
- Owner:
- Control owner
- Record:
- Renewed evidence
Inside the Product
Inside the Product
One Control Set, Scored Against Every Framework
This is the board TrustGrid keeps current: 100 unified controls across 7 frameworks, 63 of them implemented, and the 11 failing checks named rather than averaged away.
A flat product screenshot of TrustGrid, a compliance automation platform, shown in its dark product interface. The left sidebar carries the TrustGrid mark, the line "Powered by SecureRoot Risk Advisory LLP", and grouped navigation: Overview holding Dashboard, Automation and Tasks with 23 outstanding; Compliance holding Frameworks, Controls, Applicability, Evidence, Policies and Audits; Risk holding Risk register, Third parties and Incidents; Privacy and AI holding Privacy and AI governance; Organisation holding People and access, Integrations, Trust centre, Reports and Settings. Header: compliance posture for SecureRoot Risk Advisory LLP, 7 frameworks in scope, 100 unified controls, with a button to run automated checks. Five headline figures: overall readiness 63 percent, being 63 of 100 controls implemented; 11 failing checks, from 22 passing and 7 warning out of 40; 23 open remediation and implementation tasks; 12 third parties, 2 of them overdue for reassessment; 4 rights requests, 1 past its statutory deadline. Posture trend, recorded once per day when the automated sweep runs, shown for the quarter with trust score selected: 74, 71, 69, 73, 75, 74, 72 on 06-04, 07-02, 07-30, 08-21, 08-25, 08-29, 08-30, so the trust score stands at 72 of 100 and has moved -2 points over the quarter. Trust score, a weighted blend shown broken down so it is never a black box: control readiness scores 66 at 45 percent weight, 63 of 100 controls implemented; automated checks scores 55 at 25 percent weight, 22 of 40 passing; operational hygiene scores 91 at 20 percent weight, 8 of 85 dated items overdue; risk exposure scores 100 at 10 percent weight, 0 of 11 open risks are critical. Those four weighted scores total 71.65, which rounds to the headline 72. Open findings by severity, covering failing checks, vendor findings and remediation tasks: 5 critical, 19 high, 34 medium, 15 low, which sum to the 73 open at the centre of the donut. Illustrative snapshot of a typical programme, not a named client.
A flat product screenshot of TrustGrid, a compliance automation platform, shown in its dark product interface. The left sidebar carries the TrustGrid mark, the line "Powered by SecureRoot Risk Advisory LLP", and grouped navigation: Overview holding Dashboard, Automation and Tasks with 23 outstanding; Compliance holding Frameworks, Controls, Applicability, Evidence, Policies and Audits; Risk holding Risk register, Third parties and Incidents; Privacy and AI holding Privacy and AI governance; Organisation holding People and access, Integrations, Trust centre, Reports and Settings. Header: compliance posture for SecureRoot Risk Advisory LLP, 7 frameworks in scope, 100 unified controls, with a button to run automated checks. Five headline figures: overall readiness 63 percent, being 63 of 100 controls implemented; 11 failing checks, from 22 passing and 7 warning out of 40; 23 open remediation and implementation tasks; 12 third parties, 2 of them overdue for reassessment; 4 rights requests, 1 past its statutory deadline. Posture trend, recorded once per day when the automated sweep runs, shown for the quarter with trust score selected: 74, 71, 69, 73, 75, 74, 72 on 06-04, 07-02, 07-30, 08-21, 08-25, 08-29, 08-30, so the trust score stands at 72 of 100 and has moved -2 points over the quarter. Trust score, a weighted blend shown broken down so it is never a black box: control readiness scores 66 at 45 percent weight, 63 of 100 controls implemented; automated checks scores 55 at 25 percent weight, 22 of 40 passing; operational hygiene scores 91 at 20 percent weight, 8 of 85 dated items overdue; risk exposure scores 100 at 10 percent weight, 0 of 11 open risks are critical. Those four weighted scores total 71.65, which rounds to the headline 72. Open findings by severity, covering failing checks, vendor findings and remediation tasks: 5 critical, 19 high, 34 medium, 15 low, which sum to the 73 open at the centre of the donut. Illustrative snapshot of a typical programme, not a named client.
Every figure on these product boards is illustrative sample data from one example programme. No screenshot here shows a named client.
Who It Is For
Who TrustGrid Is For
Security and compliance teams carrying more than one framework, or about to.
SaaS and technology companies
ISO 27001 for the enterprise buyer, SOC 2 for the North American one, and the same engineers answering both.
Payment and fintech businesses
PCI DSS alongside ISO 27001 or SOC 2, with evidence that both assessors will accept.
vCISO clients
Organisations where SecureRoot's vCISO runs the programme and TrustGrid is the working record of it.
Groups managing vendor risk
Teams that need third-party assessments tracked with the same rigour as their own controls.
Regulatory Mapping
Frameworks TrustGrid Maps
The mapping is what makes one piece of evidence count more than once. Each row names the framework and what the platform holds for it.
- What it requires
- An information security management system, the Annex A controls selected in the Statement of Applicability, internal audits and management review.
- What TrustGrid does
- Annex A controls in the library, the Statement of Applicability derived from the mapping, and internal audit tracking in the same place as the controls.
- What it requires
- Controls designed and operating against the Trust Services Criteria over a period, with evidence an auditor can sample.
- What TrustGrid does
- Controls mapped to the criteria, evidence with dates and owners so period-of-time sampling has a trail, and an export in the shape the auditor asks for.
- What it requires
- The twelve requirements across the cardholder data environment, with evidence of each control and the quarterly and annual cadences the standard sets.
- What TrustGrid does
- Requirements in the library with their cadences on the renewal calendar, and the overlap with ISO 27001 and SOC 2 made explicit so evidence is not collected three times.
Third-party risk
- What it requires
- Due diligence on vendors that process your data, proportionate to the risk, repeated on a cycle, and evidenced.
- What TrustGrid does
- Vendor assessments and returned evidence tracked with owners and renewal dates alongside your own controls.
TrustGrid also carries SecureRoot's control mappings for ISO 27701, ISO 22301, ISO 42001, HIPAA, NEN 7510 and the EU AI Act on the engagements that need them.
Plainly Stated
What TrustGrid Is Not
It is not a certification body, an auditor or a QSA. TrustGrid prepares the evidence and the mapping; the certificate, the SOC 2 report and the PCI DSS attestation are issued by the independent bodies this site describes on its guide to who can sign your security report.
It does not replace the judgement in a compliance programme. SecureRoot's consultants decide which controls apply and whether evidence is sufficient; the platform keeps the record of those decisions and the evidence behind them.
Pricing
Pricing
TrustGrid is included in SecureRoot's compliance and vCISO engagements rather than licensed on a public price list. The engagement scope, which is the frameworks in play, the number of entities and the depth of control testing, is what sets the price, and we put it in writing after a scoping call.
Do we have to buy TrustGrid to work with SecureRoot?
No. TrustGrid is the platform SecureRoot uses to run compliance engagements, and it is included in them. An organisation that already runs another GRC tool can keep it; the consultants work in whichever system holds your evidence.
Which frameworks does it map?
ISO 27001, SOC 2 and PCI DSS are the three the platform was built around. SecureRoot also uses it on ISO 27701, ISO 22301, ISO 42001, HIPAA, NEN 7510 and EU AI Act engagements, where the control library carries those mappings as well.
Does one piece of evidence really satisfy three frameworks?
Where the controls genuinely overlap, yes. An access review, a backup restoration test or an approved policy is collected once and scored against every clause, criterion or requirement it maps to. Where a framework asks for something the others do not, the mapping shows that as its own control, so nothing is assumed to be covered that is not.
Can TrustGrid issue our ISO 27001 certificate or SOC 2 report?
No, and neither can SecureRoot. Certificates come from accredited certification bodies, SOC 2 reports from a licensed CPA firm and PCI DSS attestations from a QSA. TrustGrid prepares the evidence package those bodies audit.
Does TrustGrid handle vendor and third-party risk?
Yes. Third-party risk assessments, questionnaires and the evidence vendors return are tracked in the same platform, with owners and renewal dates, so vendor due diligence runs on the same calendar as your own controls.
Services
Where It Fits in the Work
The services SecureRoot delivers with TrustGrid, read from the catalogue.
Ready When You Are
Tell us what is due and who is asking. You will leave the call with a written scope, a timeline and a fixed price, and an honest answer if we are not the right firm for it.