Use cases

What you can try in your first 15 days

Each use case says what the trial does today and what it does not cover yet, so you know before you start.

ISO/IEC 27001 readiness

Teams preparing for a first ISO 27001 certification or a surveillance audit

See where your controls stand against a set of ISO/IEC 27001:2022 Annex A controls, with evidence and owners.

Try this

In the trial today

Assess a representative set of Annex A controls with automated checks where a system is connected
Attach evidence, review each result and sign off a frozen snapshot
Generate a readiness report for your leadership or auditor

Not covered yet

The pack models 12 of the 93 Annex A controls, not the whole standard or the management-system clauses
Certification is issued only by an accredited certification body

Frameworks involved: ISO 27001

SOC 2 readiness

SaaS and service companies whose customers ask for a SOC 2 report

Track readiness against the Trust Services Criteria and keep the evidence your CPA firm will ask for.

Try this

In the trial today

Assess a representative set of Security, Availability and Confidentiality criteria
Collect and date-stamp evidence, with expiry tracking
Share an evidence pack with your auditor

Not covered yet

Several criteria groups are not modelled yet (for example CC2 to CC5, Processing Integrity and Privacy)
A SOC 2 report can only be issued by a licensed CPA firm

Frameworks involved: SOC 2

DPDP Act readiness (India)

Organisations in India that process digital personal data

Plan for the Digital Personal Data Protection Act with an assessment workflow, consent records and a request tracker.

Try this

In the trial today

Run a DPDP assessment workflow and record gaps against modelled obligations
Keep notices, consent practices and data-principal requests in one place
Track policy and evidence needs by domain

Not covered yet

The DPDP pack is still being reconciled with the official Rules text and models selected obligations only
Commencement is phased, and this is planning support, not legal advice

Frameworks involved: DPDP (India)

CIS baseline for AWS, Azure or Microsoft 365

IT and security teams that want a baseline across their cloud accounts

Benchmark your cloud and Microsoft 365 against CIS Controls v8.1 with read-only checks.

Try this

In the trial today

Connect AWS, Azure or Microsoft 365 with read-only access
Run checks such as storage encryption and exposure, activity logging, backup settings and identity coverage
See automated, partial and manual coverage per requirement, so you know what the checks can and cannot prove

Not covered yet

The CIS pack models 8 of the 18 Controls
Full per-platform CIS Benchmark configuration scans are not included

Frameworks involved: CIS Controls

Microsoft 365 and Entra ID identity checks

Anyone who wants to know where multi-factor sign-in and admin accounts really stand

One approval from your Microsoft administrator, then read-only checks on identity hygiene.

Try this

In the trial today

One-click, read-only connection approved by a Microsoft Global Administrator
Multi-factor registration coverage, privileged accounts and inactive users
Findings you can assign, track and re-check

Not covered yet

Registration is not enforcement: Conditional Access policies and just-in-time admin access are not proven by these checks

Frameworks involved: CIS Controls, ISO 27001

Third-party and vendor risk

Teams who must show how they oversee suppliers

Keep a vendor register with assessments, owners and review dates.

Try this

In the trial today

Register vendors and record assessments and outcomes
Link vendor oversight to the controls that require it
Include vendors in your audit evidence

Not covered yet

Vendors are assessed by people; there is no automated scanning of suppliers

Frameworks involved: ISO 27001, SOC 2

Audit preparation and evidence

Anyone with an audit date on the calendar

Gather evidence once, keep it current, and hand your auditor a clean pack.

Try this

In the trial today

An audit workspace with requests, evidence and control status
Evidence with source, date and validity period
PDF, Excel and CSV reports, and a tamper-evident activity record

Not covered yet

AssureLoom prepares and organises evidence; it does not replace your auditor

Frameworks involved: ISO 27001, SOC 2, DPDP (India)

Managing several clients (consultancy)

Consultancies and assurance partners running programmes for more than one client

Separate workspaces per client with one portfolio view and your own report branding.

Try this

In the trial today

Isolated workspaces, one per client
A portfolio view across clients
Reports with your branding

Not covered yet

Tell us how you work today; we will say honestly whether the trial fits

Frameworks involved: ISO 27001, SOC 2, DPDP (India)

Banking, insurance or capital-markets obligations

Regulated entities looking at RBI, SEBI, IRDAI or CERT-In requirements

We track these regulators in our library, and your interest helps us decide what to build next.

Try this

In the trial today

See these standards in the Framework Library, with their authority and edition
Use ISO 27001, CIS and NIST packs as the technical baseline today

Not covered yet

Content packs for RBI, SEBI, IRDAI and CERT-In are on the roadmap and cannot be assessed yet

Frameworks involved: RBI, SEBI, IRDAI, CERT-In

AssureLoom shows how ready you are and what to fix. It does not certify your organisation: certification and attestation come from your auditor or certification body. The 15-day trial ends read-only, and nothing is deleted.

See your real compliance posture, not a spreadsheet of it.

Try it free for 15 days on your own environment, with read-only connections, or book a walkthrough on a sample environment first.

Start your free trial Book a demo