Every audit and every control carries a framework. Fifteen of them ship with a complete control set, test procedures included: create an audit on one of them and the checklist arrives already filled in, and ISO 27001 controls are picked from a catalogue of clauses and Annex A. For the rest, bring your control set from Excel or CSV in minutes.
Management-system clauses 4 to 10 and all 93 Annex A controls, each with the text of its control statement, so an audit reads like your Statement of Applicability.
Every sub-requirement across all twelve requirements, each with its testing procedures.
India's Digital Personal Data Protection Act and the final DPDP Rules 2025 as 56 testable obligations, each referenced to its section or rule.
The Security Rule's administrative, physical and technical safeguards, plus the Privacy Rule, the Breach Notification Rule and the definitions and enforcement provisions that apply to them.
The AI management system standard: clauses 4 to 10 and the 38 Annex A controls, in plain-language wording with a test procedure for each.
The privacy information management standard: 25 clauses plus Annex A for controllers (31), processors (18) and both (29).
Regulation (EU) 2016/679 as 48 testable obligations from Articles 5 to 49, in plain language, grouped by chapter.
All 106 subcategories across the six functions: Govern, Identify, Protect, Detect, Respond and Recover.
Seven sets for regulated entities, each broken into testable controls with a test procedure: SEBI CSCRF 2024 (31), RBI IT Governance 2023 (32), RBI Cyber Security Framework 2016 (37), RBI IT Outsourcing 2023 (29), RBI Digital Lending 2025 (20), IRDAI Cyber Security 2023 (37) and CERT-In Directions 2022 (9).
Choose PCI DSS, DPDP, HIPAA, ISO 42001, ISO 27701, GDPR, NIST CSF 2.0 or an Indian regulator's set when you create an external audit and every control arrives on it, marked Open and ready to assign. Delete the audit and its controls go with it.
These are ready to tag audits and controls. Import your control set from Excel or CSV with a full preview, and it works exactly like the built-in ones.
This is a PCI DSS audit moments after it was created, and the ISO 27001 catalogue you pick from. Click either picture to see it full size.
Every requirement arrives on the audit as Open, with its test procedure, ready to assign.
Search the Annex A catalogue, filter by group, tick what applies and add them in one step.
GRC Owl ships 142 common controls in 17 domains (access management, logging, vendor risk, incident response and more), each mapped to the requirements of 16 frameworks. Open one and see every requirement it satisfies.
A quarterly access review can serve ISO 27001, SOC 2 and PCI DSS at once. Link the related controls and the work is visible wherever it counts.
Download the template, fill in Control ID, description, test procedures, framework and frequency, save it as Excel or CSV, and preview every row before importing. Up to 2,000 controls per file.
Talk to us about your frameworks
GRC Owl