CyberLentera MSCD
ID Sign in Request a demo
Product Frameworks Deployment Security Bahasa Indonesia
Sign in Request a demo

Management System Compliance Dashboard

Prove compliance from context to evidence.

One traceability chain for ISO/IEC 27001, ISO 9001, ISO 22301 and ISO 37001. When a link breaks, you see it before the auditor does.

Request a demo See how it works
  1. 01Issue
  2. 02Risk
  3. 03Control
  4. 04Document
  5. 05Evidence
  6. 06Finding

Traceability test

Pick any risk. See the auditor's question answered link by link.

Every record sits on one chain, from the issue that raised a risk to the evidence that proves its control works. A link that is not ready names the person who holds it and the date it is due.

  • Ready The link exists and its evidence is from this cycle.
  • Pending Assigned to a named person and due before the audit.
  • Broken Overdue, missing, or a required link is absent.
R-014 Unauthorised access to customer records

  1. IssueCI-02

    Customer data handled by outsourced IT support

    Ready

  2. RiskR-014

    Unauthorised access to customer records

    Pending

    Annual reassessment held by the risk owner, due before the audit

  3. ControlA.5.15

    Access control

    Ready

  4. DocumentPRC-07

    Access control procedure

    Broken

    Review date passed. Every control it implements is held back

  5. EvidenceEV-0280

    Quarterly access review

    Pending

    Next evidence due before the audit, held by the control owner

Named accountability

What is still pending, who holds it, and when it is due.

Each management system keeps one list of open work, grouped by the person who holds it.

  • A named person on every pending item

    Each item is held by one person and has a due date. A role on its own never holds work.

  • Reminders sent and logged by the platform

    Remind one holder or every holder at once, by email and in the app. Each reminder is logged.

  • An after-audit flag that follows the audit date

    Items due after the audit date are flagged. When the audit date moves, the flags are recalculated and the holders are told.

One engine, four standards

Harmonized Structure as the backbone.

The four standards share clauses 4 to 10. MSCD models them once, so an organisation with several certificates stops doing the same work four times.

  • ISO/IEC 27001:2022Information security
  • ISO 9001:2015 and 2026Quality
  • ISO 22301:2019Business continuity
  • ISO 37001:2025Anti-bribery, in beta
Harmonized StructureClauses 4 to 10, modelled once for every standard
  1. Issue
  2. Risk
  3. Control
  4. Document
  5. Evidence
  6. Finding

New editions of a standard install side by side and become active when you decide.

Three working areas

Build the system. Run the audit. Keep the certificate.

Implementation

Build and maintain

  • A phase board whose checkpoints hold back work that is not ready
  • Controls and requirements with their status and evidence
  • A document register with owners and review dates

Audit

Run the audit

  • Audit readiness and the traceability test on one screen
  • Pending items per person, each with a due date
  • Findings and corrective actions, verified by someone other than the implementer

Surveillance

Keep the certificate

  • The three-year certification cycle on one timeline
  • Evidence age counted from the date the evidence was produced
  • Items due after the audit date flagged the day they are created

Deployment and data

Your cloud or your data centre. Your files stay where they are.

SaaS and on-premise run the same release with the same features. What differs is who operates it and where the data sits.

SaaS

Operated by CyberLentera

  • A separate database schema for each organisation, with row-level security as a second layer
  • Sign in with your own identity provider
  • Updates in announced maintenance windows

On-premise

Operated by your team

  • Docker Compose on one server, or Kubernetes with Helm
  • Runs in air-gapped networks from a signed offline bundle
  • Licence checked offline, updates on your schedule

Pass-through

A file uploaded through MSCD goes on to your repository. The checksum is computed on the way and nothing is stored in between.

Link

Pick a file that already exists in your repository. MSCD records the reference, pins the version and checks it on a schedule.

Your repository

SharePoint Online, OneDrive for Business or Google Drive. A managed vault is there if you prefer one.

Security

Built to stand up to the people who audit it.

MFA for every user

Local accounts use an authenticator app. Company sign-in can require your identity provider's own MFA.

Company sign-in

SAML 2.0 and OpenID Connect, for example with Microsoft Entra ID.

Roles per management system

A person can manage the information security system and only read the quality system.

Separation of duties

Nobody verifies their own corrective action or accepts the risk they treated.

Append-only audit trail

Every change is recorded with who made it, what changed and when. Entries are only ever added.

Access for your auditor

Read-only guest access for an external auditor, limited to between 1 and 30 days.

Start with one management system

Walk into the certification audit already prepared.

Bring one management system onto the chain first. Add the others when you are ready.

Request a demo Sign in to MSCD

Or write to cyberlentera@gmail.com