Guided questionnaire
Answered once for the organisation and per site. Every answer saves as you go.
IAM-02 · Identity & Access
Is multi-factor authentication enforced for every email and admin account?
GRC simplified with AI
Close Security Gaps.
Stay Audit-Ready.
Grcly checks your organisation against ISO 27001, SOC 2, GDPR and the DPDP Act, shows exactly where the gaps are, and turns them into a month-by-month plan your team can follow.
74%ISO 27001
Not ready
Weakest areas
Switch frameworks. Hover or tap a segment to see the area.
Governance & riskIdentity & MFAPrivileged accessEndpoint securityPendrives & data leakagePatchingNetwork & firewallsLogging & SIEMCloud securityEmail securityEncryptionBackup & recoveryIncident responseAwareness trainingPhysical securitySupplier riskSecure developmentData privacy
Features
Everything a gap assessment needs, in one place
Try the pieces below. They work the way Grcly does.
Control library
Every control mapped to the frameworks it satisfies.
Security baseline
Everyday rules for the basics. Tick what is already in place.
2 of 5 in place
Documents and evidence
Policies, procedures and records, with owners and reviews.
Information security policyIn place
Access control procedurePartly
Backup & restore logTo create
Asset registerPartly
Every site in one view
Compare locations and see which one needs attention first.
Head office78%
Branch office54%
Data centre31%
How it works
From first question to a clear plan
- 1
Profile the organisation
Locations, people, servers, cloud services and the frameworks in scope.
- 2
Answer the questionnaire
Controls by area. Answers fill in from your profile where they can.
- 3
See gaps and readiness
Scores by area, site and framework, every gap ranked critical to low.
- 4
Follow the plan
Work month by month and re-assess at each checkpoint.
Implementation plan
A plan that fits your pace
Pick one, two or three years. Grcly lays every action across the months and re-aligns the moment you change it.
- Critical gaps first, related work kept together
- About the same amount of work each month
- Move any action; the rest re-aligns
- Checkpoints for reviews, internal audit and management review
Month by month
96 actions over 12 months
LighterBusierCritical itemsCheckpoint
Audit readiness
Know when you are ready for the audit
Each framework gets a clear Ready or Not ready, based on four checks you can act on. Click them to see it change.
3/4
ISO/IEC 27001:2022
Not ready
Frameworks
One assessment, every framework you need
Answer once. Each control counts toward every framework it maps to. Add or remove a framework at any time.
ISO/IEC 27001:2022Annex A controls and the management-system clauses
SOC 2The AICPA Trust Services Criteria
EU GDPRSecurity and privacy duties for EU and UK personal data
DPDP Act 2023India's data protection law and the DPDP Rules 2025
Reports
Reports management can read, registers teams can use
Gap AssessmentPDF report
A short, readable overview for management.
- Score, maturity and top priorities
- Audit readiness per framework
- Scores by area and location
- Month-by-month plan
- Every control and rule with its status
Excel gap register
The working plan your team tracks every month.
- Every gap with risk, owner and month
- What to do and what counts as done
- Evidence to keep and tools that help
- Target dates and remediation status
See where you stand, and what to fix first
Talk to the Vaeto team about a Grcly gap assessment for your organisation.