Compliance evidence from the work you’re already doing.
Your plans, Vault documents and exercises already are evidence. Bastion Comply suggests where each one fits, tracks it across ISO 27001, Cyber Essentials, SOC 2, GDPR and NIS2, and flags when it goes stale.
Compliance tools make you re-collect evidence you already have.
You wrote the incident response plan. You ran the tabletop exercise. The policies are already in your document library. Then the compliance tool asks you to upload it all again, control by control. And enterprise governance, risk and compliance (GRC) platforms are priced and built for companies with a dedicated GRC team.
If you’ve been looking at Vanta alternatives for a UK SME, Comply starts from a different place: the work your team is already doing in BastionIQ. It suggests where that work counts as evidence, tracks it across frameworks, and tells you when it goes stale. AI helps you understand and prepare. A person always signs off.
159 controls across five frameworks.
From the work you’ve done to an evidence pack
Activate your frameworks
Choose from ISO 27001:2022, Cyber Essentials, SOC 2, GDPR and NIS2. Every control is loaded and ready to track.
Confirm suggested evidence
Comply suggests evidence from your existing Vault documents, plans and exercises. The rules are explainable, and you confirm each link.
Reuse it wherever it counts
Evidence you confirm once can be applied to the equivalent controls in your other active frameworks.
Track readiness and export
Follow your readiness score by framework and domain, then export a management posture report or an auditor evidence pack.
What’s included in Bastion Comply
Evidence auto-suggest
Rules-based, explainable suggestions from your Vault documents, plans and exercises. Nothing is linked until a person confirms it.
Cross-framework mapping
Confirm evidence once and apply it to the equivalent controls in your other active frameworks, instead of uploading the same policy five times.
Readiness score
A readiness score for each framework, with a domain breakdown, so you can track progress. Out-of-scope and exception controls are excluded from the calculation.
Stale evidence flags
Know when evidence goes out of date: a document superseded by a newer version, a plan back in draft, an exercise more than 12 months old. Flags prompt a review; they never silently change a control’s status.
Who attested what, and when
Every evidence confirmation records who confirmed it and when, and that record goes straight into your auditor evidence pack.
Exceptions and treatments
An exception register that requires a rationale, where expiry returns the control to in progress. Treatments track remediation with owners, due dates and overdue highlighting.
Certification tracking
Keep track of the certifications you hold, with renewal reminders 90 days ahead.
AI implementation guidance
Plain-English guidance for each control, grounded in your own documents rather than generic advice.
AI readiness interview
Answer questions and the AI proposes a status for each control for you to review. AI can never mark a control as satisfied. That is always a human attestation.
Assessment results alongside evidence
See relevant Bastion Assess maturity results next to your Comply evidence, so document gaps and control gaps are in one view.
What you hand to leadership and your auditor
A PDF summary of your compliance posture for leadership.
A PDF with per-control evidence and who confirmed it and when, a methodology statement, exceptions and open gaps.
Export to CSV, or save any report straight to Bastion Vault.
Where your evidence comes from
Documents are suggested as evidence, and flagged when a newer version supersedes them.
Learn more →Plans and completed exercises count as evidence, flagged if a plan goes back to draft or an exercise is over 12 months old.
Learn more →Risks link to the controls that treat them, with warnings when a serious risk’s controls aren’t in place.
Learn more →Maturity results from AI document assessments appear alongside your Comply evidence.
Learn more →sign-off
AI helps you prepare. A person always signs off.
AI can explain a control in plain English, ground its guidance in your own documents and propose a status, but it can never mark a control as satisfied. Every attestation is made by a person on your team and recorded with who confirmed it and when, so your evidence stands up when an auditor asks.
See how much evidence you already have.
Free 30-day trial with Comply included. On paid plans, Bastion Comply is +£42/month.