For ISO 27001 consultants and virtual CISOs
Multi-client for consultants and outsourced CISOs: each client is its own organization with separate records, ISO 27001, NIS2 and the CRA sit in the same account, and the recurring work is scheduled so the year between your visits does not go quiet.
You know how the engagement goes. The system you build is sound on the day you hand it over, and eleven months later the client rings because the surveillance audit is in three weeks and nobody has touched the risk register since you left. StandardOS is the part of the job that keeps running after you do: one account, every client, each one's records kept apart, and the recurring work scheduled so the year does not go quiet.
Referral partners earn 20% of every payment for twelve months per client they bring and, once the client accepts, are named inside that client's product as the officer to call. Resellers bill the client themselves at a 30% margin. No white label: the brand is the trust. The terms are on the partners page; bringing one client is still the way to start.
Partner programme7 questions about the client produce a draft scope, risk criteria, a starter risk register, a Statement of Applicability across all 93 Annex A controls with a justification on each, and the policy set. You spend the first meeting correcting drafts with the client rather than typing them, which is where your judgement is worth the fee.
You belong to each client's organization and switch between them from the sidebar. Every register, document and evidence entry is filtered to the organization on screen, enforced in the database rather than in the interface, so a screen never shows one client another client's risks. Your client's own people work in the same organization you do, with the roles you give them.
Every control, risk, supplier, document and certificate carries a review date. Overdue items surface in one inbox and in a digest, to the client and to you. Evidence expires and says so. When the surveillance audit is three weeks out, the question is not what happened this year but which of the dated records to show first.
12 read-only integrations read the client's systems on a schedule: GitHub, Microsoft Entra ID, Okta, Google Workspace, Personio, Amazon Web Services, Microsoft Azure, Google Cloud, Snyk, Kandji, Jamf Pro, and Microsoft Intune. A passing check keeps an evidence entry fresh; a failing one lets it expire, so a regression shows up in the inbox rather than in the audit. No agent on anyone's laptop, ever, which is a conversation you no longer have to have with the client's engineers or works council. What each one reads.
When a client's customer sends the forty-question spreadsheet, paste the questions in. Each answer is drafted from that client's own Statement of Applicability, approved policies, evidence and integration checks, and cites them by name and date, so the customer's security team can check it. Nothing is invented: a control still in progress is drafted as in progress, and a question the ISMS has nothing on says so. The client confirms each answer, and confirmed answers are reused on the next questionnaire. The question-to-control map, published.
Every record sits on an append-only, hash-chained audit log. The export is organised by Annex A reference, and the chain can be verified with a published script by the certification body, by the client, or by you. Your work is shown by records with dates on them, which is what an auditor samples and what a client remembers you for.
€249 /mo · excl. VAT
€249/mo excl. VAT, flat per organization, every feature, unlimited people. Each client organization is its own subscription, paid by the client or by you, whichever your engagement prefers. Your own seat costs nothing extra in any of them: there are no seats. The 7-day trial needs no card, so a client can be set up and shown the system before anyone pays anything.
The certification audit is paid to the certification body, as it always was. The consulting is paid to you, as it always was. What the product replaces is the spreadsheet, the shared drive and the eleven-month silence, not either of those.
Those are the judgement you are paid for. The product drafts and records; you decide.
Your client sees StandardOS, and sees you inside it as the person running their system. We think that is the honest arrangement and it is the only one on offer.
ISO 27001, ISO 42001, ISO 9001, ISO 27701 and ISO 14001. Not SOC 2, not TISAX, not the 75-framework catalogue. Where two of them share a clause, a client running both keeps one set of records. The clause-by-clause coverage is published, gaps included.
Yes. Each client is its own organization; you belong to each and switch in the sidebar. The separation is enforced by the database, not the interface: a screen never shows another client's risks.
ISO 27001 is the management system; NIS2 and the CRA are frameworks of their own in the same account, beside ISO 42001, ISO 9001, ISO 27701 and ISO 14001.
Yes. Each client has its own review dates, anything overdue lands in an inbox and in a digest to the client and to you, and the surveillance audit starts with dated records instead of a search.
€249/mo excl. VAT, flat per client organization, every feature, unlimited people. Your own access costs nothing in any of them, and the 7-day trial takes no card.
Yes: as a referral partner 20% of every payment for 12 months per client, as a reseller 30% margin. No white label. The terms are on the partner page.
Bring one client
Write to support@getstandardos.com with the client's size and where they are in the cycle, and we will set them up with you on a call. If you would rather look first, the trial is open and needs no card.