Audit readiness workspace
BlueArc Cert gets your business ready for ISO 27001, SOC 2, GDPR, NIST CSF and the Essential Eight in one place. Every control, policy and piece of evidence has an owner, a date and a record.
ISO 27001 | SOC 2 | GDPR | NIST CSF | Essential Eight
Screens show a sample organisation, Tallowood Analytics.
Why accreditation is hard
Many of the controls may already be in place. The proof sits across inboxes, shared drives and spreadsheets with no clear owner.
ISO/IEC 27001 alone has 118 controls and clauses, each needing a policy, an owner and current evidence.
A quarterly access review that was current in March is out of date by July, and nobody notices until the auditor asks.
Leaders cannot see how close they are, so the audit date drives a last minute scramble.
They want to see who approved what, when, and that files were not changed after review.
Paying someone to chase spreadsheets adds cost without adding security.
One effort, many standards
Map a policy once and reuse it across ISO 27001, SOC 2, GDPR, NIST CSF and the Essential Eight. Work done for one counts toward the others where controls overlap.
Control wording in BlueArc Cert is preparation guidance. Confirm wording and scope against the official standard.
| Standard | Version | Controls and requirements |
|---|---|---|
| ISO/IEC 27001 | 2022 | 118 |
| NIST Cybersecurity Framework | 2.0 | 106 |
| SOC 2 Trust Services Criteria | 2017 | 38 |
| GDPR | Regulation (EU) 2016/679 | 38 |
| Essential Eight | November 2023 | 24 |
How it works
BlueArc Cert covers everything up to the audit itself. Your accredited certification body then reviews and certifies.
Step 1 Know where you stand
The Overview answers the question every leader asks: how ready are we?
Business benefit. Leaders see progress in seconds and the team knows exactly what to do next.
Step 2 Set your scope
Decide which controls apply to your business and why. Each decision is recorded with its reason and flows into your Statement of Applicability, the document auditors read first.
Business benefit. No control is forgotten, every gap has an owner and your scope decisions are documented the way an auditor expects.
Step 3 Collect evidence
The Evidence library holds the reports, minutes, training records and screenshots that prove each control works.
Business benefit. No more hunting for files the week before the audit, and no surprises when the auditor checks dates.
Step 4 Write your policies
You do not start from a blank page. Open a template and your company details are filled in for you.
Business benefit. Policies are written faster, approved properly and reused across standards, which cuts effort and consultant time.
Step 5 Manage risk
Registers hold the records an auditor asks for, in the same place as your controls and evidence.
Business benefit. Risk and supplier management, which every standard asks for, sits alongside your controls instead of in separate spreadsheets.
Step 6 Run the day to day work
Accreditation becomes part of normal work, spread across the team, rather than one person's side project.
Business benefit. Owners can check and act on the go, and overdue work is flagged before it becomes a delay.
Step 7 Be audit ready
Freeze the audit when its evidence is reviewed. The audit pack is a fixed record of the audit and every accepted file, with each file's hash so anyone can prove nothing changed afterwards.
Business benefit. You hand the auditor a complete, tamper evident record instead of a folder of attachments, so the audit runs on facts rather than follow up requests.
Overview
See the seven steps on screen, from first sign in to a frozen audit pack.
Security and trust
A compliance tool holds your most sensitive records, so BlueArc Cert is built with the same care it asks of you.
Every member needs an authenticator app, and each browser tab signs in on its own.
Your data is hosted in Sydney.
Each organisation's records are separated in the database itself. In testing, a signed in user from another organisation saw zero rows across 100 tables.
Uploaded files cannot be overwritten. A change is a new version, and every version needs its own independent review.
A frozen audit pack records each accepted file's hash.
Uploads that are not what they claim to be are quarantined and removed automatically.
Auditor access is read only and granted per audit. Internal notes are never shown to them.
Every action records who did what and when. The site runs on HTTPS only with HSTS and a strict content security policy.
Pricing
Invite your whole team and assign owners from day one. The price is per organisation, so a bigger team does not cost more.
Pick a standard, apply templates and watch your readiness score rise.
BlueArc Cert
$1,999AUD per year
Per organisation, including GST. Start with a 14 day free trial, no card needed.
Everything works during the trial except Export everything. Add payment when you are ready, and Stripe takes it securely. The plan renews yearly and you can cancel any time from Settings.
Your accredited certification body performs the audit and issues the certificate. BlueArc Cert gets you ready for it and gives the auditor a clear, trustworthy record.
ISO/IEC 27001:2022 (118 controls and clauses), NIST Cybersecurity Framework 2.0 (106), SOC 2 Trust Services Criteria 2017 (38), GDPR (38) and the Essential Eight, November 2023 (24). Work done for one counts toward the others where controls overlap.
AUD 1,999 per organisation per year, including GST. There is one plan with every feature, and the price is per organisation, not per person.
Every new organisation gets 14 days free with no card. Everything works except Export everything, which unlocks when you subscribe. Invite your team, assign owners, pick a standard, apply templates and watch your readiness score rise.
An owner or administrator subscribes from inside the app, and Stripe takes payment securely. If the trial ends without a subscription, the organisation becomes read only. Nothing is deleted.
Yes, at any time from Manage billing in Settings. Cancelling stops the next yearly renewal, and access continues until the end of the year you have paid for.
Your data is hosted in Sydney. Each organisation's records are separated in the database itself, and every member signs in with two factor authentication. Auditors receive read only access to the audits you grant them.
Yes. Auditors get their own read only access, granted per audit, so they see exactly what they need. Their questions arrive on the control itself, and your internal notes are never shown to them.
Yes. BlueArc Cert works on a phone, with a bottom menu for Home, My work, Evidence, Controls and More, so owners can check and act on the go.
Yes. Open a template and your company details are filled in. Edit it in the app, save each change as a new revision, and download it as a Word file or print it to PDF. Approved versions stay as they were approved.
The control wording in BlueArc Cert is preparation guidance. Confirm wording and scope against the official standard.
No card needed. Pick a standard, apply the templates and see your readiness score from day one.