Documentation
Learn AssureLoom by doing an assessment
Short guides for the first day, and a detailed method for assessing each framework with the evidence to capture and how it is checked.
Getting started
- 1
Sign in. Open app.assureloom.com. Enter your company name, your email and your password, then the 6-digit code if two-step sign-in is on.
- 2
Choose a framework. Compliance management, then Framework library. Select the framework you want to assess.
- 3
Add your people. Administration, then Users & roles. Give each person the smallest role that lets them do their job.
- 4
Run an assessment. Compliance management, then Assessments. Automated checks run on connected systems; people answer the rest.
- 5
Add evidence and fix findings. Risk & assurance, then Audits & evidence and Findings. Upload proof, assign owners and track the fixes.
- 6
Report. Risk & assurance, then Report centre. Create the report for your leadership or auditor.
Assess a framework
The compliance assessment guide has two parts. Part 1 is a quick start with a 12-item test plan. Part 2 is the detailed method: evidence rules, a step-by-step procedure for each of the 22 controls, a worked example, an evidence register and a calendar.
Compliance Assessment SOPWord document · version 1.0 · 28 October 2026Two-step sign-in
After your password you enter a 6-digit code from an authenticator app. It works with Microsoft Authenticator, Google Authenticator, Authy, 1Password and other apps that support standard codes.
- Open Sessions & MFA and choose Start setup.
- In your app, add an account and scan the QR code. If you cannot scan, type the key shown under it.
- Enter the 6-digit code the app shows, then save your recovery codes in a password manager.
Each code works once, so wait for the next code if one is refused. To change phone, choose Use a new phone or app. If you lose your phone, sign in with a recovery code, or ask an administrator to revoke your authenticator so you can register again.
Evidence
You can upload PDF, Word, Excel, CSV, text, PNG and JPEG files up to 25 MB. Before a file is accepted it is checked:
- It must really be the type it claims.
- Office files may not contain macros or embedded programs.
- PDFs may not contain scripts or launch actions.
- Files already known as malicious are refused when the reputation check is on.
A reviewer then checks each item is relevant, current, complete, attributable and authentic before it counts towards a result.
Roles
| Role | Can | Cannot |
|---|---|---|
| Company owner or admin | Everything in their organisation, including people and connected systems | See other organisations |
| Reviewer | Run assessments, comment, manage findings and evidence | Manage people |
| Auditor | Read assessments, findings, evidence and reports | Change anything |
| Employee | Answer assigned questions and tasks | See other people's data |
Framework coverage
Each framework pack covers a selected set of requirements, not the full standard. Automated checks exist for 10 of the 22 controls. The others rely on uploaded evidence and human review.
| Framework | Coverage | Topics |
|---|---|---|
| ISO/IEC 27001:2022 | 12 Annex A controls | Policies, identity, suppliers, training, physical, privileged access, authentication, vulnerabilities, backup, logging, networks, cryptography |
| SOC 2 (2017 criteria) | 6 criteria groups | Control environment, logical and physical access, system operations, risk mitigation, availability, confidentiality |
| NIST CSF 2.0 | 9 outcome groups | Policy, supply chain, risk assessment, access, training, data security, platform security, monitoring, recovery |
| CIS Controls 8.1 | 8 control groups | Data protection, account and access management, vulnerabilities, audit logs, recovery, training, service providers |
| DPDP Act and Rules (India) | 14 requirements | Notice, consent, safeguards, breach notification, erasure, grievance, children, rights, cross-border transfer, retention, Significant Data Fiduciary duties |
Questions
- Is a result a certification?
- No. AssureLoom measures readiness. A certificate or attestation comes only from an accredited body or auditor.
- Can the AssureLoom team see our data?
- Not unless you approve it. Support access is read-only, time-limited and recorded, and your organisation approves each session.
- Which authenticator apps work?
- Any app that supports standard time-based codes: Microsoft Authenticator, Google Authenticator, Authy, 1Password and others.
- I lost my phone. What now?
- Use one of your recovery codes to sign in, then choose Use a new phone or app. If you have no codes, ask your administrator to revoke your authenticator.
- Why was my evidence file refused?
- The message says why. The usual reasons are a file that is not the type it claims, an Office file with macros, a PDF with scripts, or a file over 25 MB.
Still stuck? Contact us or email hello@assureloom.com. See what changed recently in the release notes.
AssureLoom checks readiness. A result is not a certification, an attestation or legal advice.
See your real compliance posture, not a spreadsheet of it.
Try it free for 15 days on your own environment, with read-only connections, or book a walkthrough on a sample environment first.