Built by the people who sit beside you in the audit.

Whitesec One is not a generic task list with a framework label. It is the system Whitesec's consultants use to take organisations through certification, attestation and maturity assessments, opened up to your own team.

Five reasons organisations choose it

Practitioners built it
Whitesec One started inside a consultancy whose team holds CISSP and ISO/IEC 27001 Lead Auditor credentials. Every workspace follows the structure of its standard, because that is how the people who built it run engagements.
One set of registers
Risks, suppliers, incidents, policies, access reviews and changes are kept once on the ISO 27001 registers. SOC 2 maps them to the Trust Services Criteria and ISO 27701 reads the supplier register for its processors. Nothing is copied between frameworks.
Evidence an auditor recognises
The Statement of Applicability, risk treatment plan, PBC requests, bridge letters and maturity assessments come from the records you keep during the year, and every register exports to CSV, Excel and PDF.
Controls that are enforced, not assumed
A second person approves system descriptions and bridge letters, a sample's reviewer must differ from its tester, risk owners sign off treatment, and every change lands on the audit trail.
Two home teams
Whitesec ID in Jakarta works with organisations in Indonesia and the region, alongside UU PDP. Whitesec AU in Perth works with Australia and New Zealand, alongside the ACSC Essential Eight.

How working with us runs

From the first call to the audit, with the same team throughout.

1
Demo and scoping
A walkthrough of the workspaces for your frameworks with the team for your country, ending in an agreed scope.
2
Workspace set-up
The Owner creates the workspace, records the organisation profile shown on reports, picks the dashboards it subscribes to and names the teams in scope.
3
Registers and controls
Scope, risks, the Statement of Applicability and the registers are built, with Whitesec consultants working on the same records as your team.
4
Operating the year
Items due within 30 days or overdue appear as notifications and in a daily email digest to the workspace's Owners and Editors, approvals and sign-offs are recorded, and incidents, changes and reviews land on their registers as they happen.
5
Audit
Your auditor receives the Auditor access level: everything readable and exportable, audit work and findings recorded, nothing else changeable.

SGS system certification mark for ISO/IEC 27001

Held to the same standard

Whitesec ID is certified to ISO/IEC 27001 by SGS under UKAS accreditation and is registered with Komdigi as a private electronic system operator (PSE Lingkup Privat).

Our certifications