Map once.
Comply everywhere.
Norma turns the policies, procedures and logs you already have into a living, audit-ready record across ISO 27001, SOC 2, CIS v8, CMMC and the NIST frameworks. AI reads and proposes. Where a rule is missing, it drafts one and you decide. Auditors see only what is approved.
See the whole product in fourteen minutes
A new customer goes from sign-up to an audit-ready workspace: real uploads, real AI reading, real reports. Nothing in the film is a mock-up.
From a folder of documents to a defensible record
Five steps. The first three happen on day one; the fourth is how you get ready.
Upload what you have
Policies, SOPs, logs, reports, screenshots. A guided intake names the documents your scope expects, one document per policy.
Norma reads and proposes
Text is extracted, passages are matched to the controls of every framework you selected, and every excerpt is verified verbatim against the source.
People verify and decide
Approve or reject each excerpt on its control, set the status, approve the document as an organisational record. Every decision carries a name and a time.
Close the gaps
Write missing policies from Norma's templates, let Norma complete a rule that falls short, and turn the rest into owned remediation with dates.
Prove it to anyone
Readiness reports, the Statement of Applicability, evidence bundles and a read-only auditor package, generated from the same record.
Know where you stand within the hour
The onboarding wizard takes a new workspace from a short company questionnaire through frameworks and scoping to a first assessment: covered, partial and gaps per control, with Norma's narrative and top priorities, all from the documents you uploaded.
- Norma sorts the 129 universal controls for your profile, every line with a reason
- Every exclusion needs a justification and lands in the Statement of Applicability
- Proposed statuses are applied by you, never automatically
Every control, every framework, one evidence base
What the control asks, its numbered requirements and how far each is proven: defined, because a policy states the rule, and operating, because records show it happens. Verify an excerpt once and it counts in every framework the control serves.
- Verified, if-verified and target confidence on one readiness line
- One plain statement of what is still missing, derived from the evidence, never an AI opinion
- Add remediation where it belongs: on the control, with an owner and a date
When a policy falls short, Norma writes the missing sentences
A written rule that covers only part of a requirement is not a finding to file, it is a paragraph to finish. Norma reads the requirement, keeps what your text already establishes and drafts only the missing elements, right after the passage they complete.
- Every fact Norma cannot know is a highlighted decision in the text
- “We don't do this yet” turns a sentence into a remediation item instead of a claim
- Saving creates a new version that goes through review like any upload; the reader re-reads it and the numbers update
The documents your scope expects, and a template for each
The document inventory lists the policies, procedures and records your in-scope controls expect. Mark what you have, what does not apply and what still needs writing. Every policy and procedure slot carries one of Norma's 46 templates, written to satisfy the controls it covers and readable as an internal document.
- Compare a template with your own document, or start writing from it inside Norma
- Highlighted terms are the decisions you make when adopting it; a counter tracks what is left
- Upload when ready: it becomes evidence, is read against its controls and goes through review
Documents that stay alive
Draft, in review, approved. Edit a policy in Norma or upload a new version: every version keeps its change summary and approvals, and accepted excerpts reopen for re-verification. Point-in-time proof expires; policies come up for their annual review on the calendar.
- Maker-checker approval, with overrides logged
- Single-use review links for people outside the workspace
- Signed, short-lived download links; nothing is ever public
Audit-ready on demand
Generate the readiness report, the Statement of Applicability as PDF and Excel, and a zipped evidence bundle per framework. Hand your auditor a package link instead of a login.
- Only human-approved documents and attested excerpts, never AI content
- Every open of an auditor package is logged
- Same numbers as the dashboard, because they come from the same record
How Norma reads a document
Not “run it through a chatbot”. A reading pipeline built for an audit.
Text first
The document's text is extracted and split into passages before any model sees it. Scans are OCR'd; nothing is summarised away.
Two independent readers
Every passage is judged by two different large language models. Where they disagree, the lower judgement counts. One model's blind spot never becomes your evidence.
Verbatim or nothing
Each proposed excerpt is checked character by character against the source. A quote that is not in the document is dropped before anyone sees it.
A person decides
Nothing counts until someone verifies the excerpt and approves the document. Auditors see only what people approved, and every model call is on record.
Specialised AI, read twice, quoted verbatim
Automated assessment is only useful if an auditor can trust it. Every finding in Norma can be traced, checked and, if needed, disputed.
Specialised AI, one job
Norma reads policies, procedures and logs and maps each passage to the controls of every framework you selected, at once. It classifies the document, extracts the effective date and proposes what each passage evidences.
Every passage, read twice
Two independent AI models assess each passage. Their structured answers are compared by code, not by another model. Where they differ, a referee decides or the passage is read again, and the outcome is recorded, never hidden.
Verbatim or nothing
An excerpt only exists in Norma if it is found character for character in your document. Quotes are checked against the source before anyone sees them, so the evidence in your record is always your own text, with the page it came from.
Built as a system, not a checklist
Each part feeds the others: the inventory says what is missing, templates and completed rules fill it, evidence proves controls, controls roll into readiness, readiness becomes reports, and every step lands in the activity log.
Guided intake & document inventory
The policies, procedures and records your scope expects, one document per policy. Mark what you have, what does not apply and what still needs writing.
Norma's templates
46 policy and procedure templates and 18 record templates, written to satisfy the controls they cover. A decision made once fills every place it appears. Compare with yours, or write yours from one, with every decision highlighted.
Complete the rule with Norma
Where a policy covers only part of a requirement, the missing sentences are drafted into the document. Unknowns become your decisions; nothing counts until it is reviewed.
Verbatim excerpts, human verification
Norma proposes page-referenced excerpts, each verified word for word against the source. A person approves or rejects every one, with name and timestamp.
One control library, every framework
129 universal controls in 19 domains. Implement each once; its evidence counts in every framework requirement it serves.
Evidence library
Every document with owner, version history, effective date, freshness and review state. Point-in-time proof expires; policies renew on a cycle.
Risks, remediation, calendar
A scored risk register, remediation items with owner, due date and tasks, and a calendar derived from your controls: scans, reviews, tests and policy renewals with next-due dates.
Reports & auditor package
Readiness reports, the Statement of Applicability as PDF and Excel, zipped evidence bundles and a read-only auditor link.
Workforce attestation
Publish approved policies to employees; acknowledgements become living evidence for awareness controls without giving anyone workspace access.
Everyone sees exactly what they should
One workspace per client. Roles are enforced by the platform, not by convention.
Your team
Full access, settings, members and invitations. Consultancies switch between client workspaces from the sidebar.
The customer's people
Upload, review and remediate inside their workspace. No member management, no other clients.
Read-only, AI-free
Sees readiness, approved documents and attested excerpts. Never a suggestion, never a draft. Every view is logged.
Employees
A personal link to a minimal attestation page: read the policy, acknowledge it. They never enter the workspace.
Norma proposes. People decide.
Verbatim or nothing
Every proposed excerpt is checked word for word against the document before anyone sees it. If it cannot be found in the source, it is discarded.
Nothing applied automatically
Statuses, approvals, risks entering the register, attestations: each one is a human action with a name and a timestamp in the activity log.
Auditors never see AI
Suggestions, drafts and assistant answers exist only for editors. The auditor package and auditor role show the approved record and nothing else.
Frequently asked
Which frameworks are supported?
ISO 27001:2022, SOC 2 (Trust Services Criteria), CIS Controls v8.1, CMMC 2.0 Level 2, NIST CSF 2.0 and NIST SP 800-53 Rev. 5 ship today, all projected from one library of 129 universal controls. Frameworks are data, so additional regulations are added as packs, not as projects.
What if we do not have a policy yet?
The document inventory tells you which policies and procedures your scope expects and carries a Norma template for each. Write it inside Norma, resolve the highlighted decisions and upload it when ready: it is read against its controls and reviewed like any other document. Where an existing policy covers only part of a requirement, Norma completes the rule in place.
Does the AI write our policies?
Only what is missing, and only as a draft you finish. Templates and completed rules carry a highlighted decision for every fact Norma cannot know, and a saved version still goes through review and approval before it counts as evidence.
Does the AI make compliance decisions?
No. Norma reads documents, proposes excerpts and drafts assessments. A person verifies every excerpt, sets every control status and approves every document. Auditors never see AI-generated content.
How fast is the first gap assessment?
Typically within the hour: create a workspace, pick frameworks, scope the controls, upload what you already have, and the gap assessment is ready as soon as the reading finishes.
Do auditors need an account?
No. You share a read-only auditor package link that shows readiness, approved documents and human-attested excerpts, with short-lived downloads. Every open is logged.
Where is our data stored?
In a dedicated managed Postgres and private object storage with row-level isolation per workspace. Files are served only through signed, short-lived links. Regional hosting is available on request.
Is there a free trial?
Yes. Create a workspace, run your first gap assessment and invite your team. Talk to us when you are ready to bring clients or auditors on board.
Run every client's program from one hub, in your brand
One workspace per client, your consultants in each, Norma doing the reading, and a hub that shows the whole book: readiness per client, the weakest domains, what to tell each client this month, one calendar. Priced per client project, not per seat.
See what your evidence already proves.
Create a workspace, upload what you have, get your first gap assessment today, and close the gaps from there.