ISO 27001: implement findings and prove them end to end.
An ISO 27001 audit produces findings — and each needs a measure, an owner and a proof. Bricksta makes sure measures are actually implemented and evidenced, long before the auditor returns.
- Each finding is one case
- Evidence right at the step
- Audit-ready at any time
Finding A.5.18 · Kessler Metallbau
Created after the audit
- ITReview access rights — doneRemove old accounts — in progress
- HRReport leavers — doneAdjust process — waiting
- ComplianceCollect evidence — at riskCheck effectiveness — waiting
- ManagementApprove measure — done
Early warning
Evidence missing, due in 9 days
Owners and information security notified automatically.
After the audit, the real work begins.
Every finding spreads across IT, HR, Compliance and management — and today mostly runs on spreadsheets, email and manual follow-ups.
What it costs if nothing changes
- Open findings can turn into nonconformities in the follow-up audit
- The certificate, and the orders that depend on it, are at risk
- Before every date, the scramble ties up a lot of time
Measures in spreadsheets
The list of measures lives in a spreadsheet no one likes to maintain. Who does what by when sits in a column, at best.
Evidence scattered across drives
Screenshots, exports and confirmations sit in inboxes and folders. Where exactly is often known only to whoever filed them.
A rush before the next date
The auditor comes back. Then the scramble begins: what was implemented? And where's the proof?
The problem isn't the audit. It's the execution afterwards.
A spreadsheet, a task tool, GRC software or a ticket system? What really gets your measures done?
These are the usual ways to implement findings across several teams.
Here you see, point by point, what each of them can do.
| What a process needs | Business as usualSpreadsheet of measures, chasing by email | Task toolA board with one task per measure | GRC softwareISMS software for policies and risks | Ticket systemOne ticket per measure in the IT ticket system | BrickstaOne case per finding, with evidence at the step |
|---|---|---|---|---|---|
| Every measure has a person and a deadline | partly | can do it | can do it | can do it | can do it |
| IT, HR and Compliance work on it in parallel | can't do it | can do it | partly | partly | can do it |
| The evidence is attached to the measure itself | can't do it | partly | can do it | partly | can do it |
| Overdue measures stand out on their own | can't do it | partly | can do it | partly | can do it |
| External partners deliver their evidence directly | can't do it | can't do it | partly | can't do it | can do it |
| Your team changes the process itself | can do it | can do it | partly | partly | can do it |
| Runs within days, without an implementation project | can do it | can do it | can't do it | partly | can do it |
| Manages policies, risks and controls | can't do it | can't do it | can do it | can't do it | can't do it |
| Meets | 2 of 8 | 4 of 8 | 4 of 8 | 1 of 8 | 7 of 8 |
| Verdict | Familiar. But whether a measure is done and evidenced only shows when someone chases it. | Good for handing out work. But evidence sits elsewhere, and no one checks deadlines on purpose. | Strong for the ISMS itself. Execution across teams and external partners often stays outside, and rollout takes time. | Good for IT. HR, management and external partners rarely work in it. | Every finding as a case across all teams, with evidence at the step. Policies stay in your ISMS. |
Spreadsheet of measures, chasing by email
How remediation runs with Bricksta.
Every finding becomes a case with clear steps, owners and deadlines — and with the evidence exactly where it's created.
- 1
Each finding becomes a case
For each finding you create a case — with a measure, owners and a deadline, instead of one more spreadsheet row.
- 2
Teams work in parallel
IT, HR and Compliance get their tasks at the same time. Everyone sees only their part, and ownership stays unambiguous.
- 3
Evidence at the step
Files, links or confirmations are captured right at the task. If the evidence is set as a required field, the task can only be completed with it.
- 4
Audit-ready without the scramble
The history of every measure is fully traceable and can be exported as a PDF per case — everything is ready for the auditor.
One case, four views.
Everyone sees exactly what concerns them — and the status of every measure is the same for all.
Sees every open finding at a glance. Anything overdue or missing evidence is right at the top.
Real views from Bricksta, with sample data.
What changes.
Audit-ready without a final sprint
Readiness builds continuously, not in a rush just before the date.
Clear ownership
Every measure has an owner and an evidenced status.
Evidence in one place
Proof is attached to the measure, not scattered across drives.
Repeatable for every audit
The same process carries every follow-up audit instead of starting over.
Your first process: Monday start, Friday live.
Rolling out workflow or industry software usually takes three to six months. With Bricksta, your first process runs after five working days: Monday start, Friday live. Live means: from then on, your team handles real orders in the new process.
¹ A conservative estimate: process software typically takes 3 to 6 months with ready-made templates and 9 to 18 months as a toolkit (KMWorld). The five working days start on the agreed project start date and apply to a clearly scoped first process your team takes part in.
Hosted in Frankfurt
German and European law
Rights per role
Everyone sees only what concerns them
Complete history
Every step stays traceable
Connects to your systems
Start via email, CRM or form
Frequently asked questions
What teams most often want to know before they start.
Your question isn't here? Write to usIs Bricksta an ISMS or GRC replacement?
No. Bricksta replaces no ISMS, no policy library and no asset inventory. Bricksta runs the operational implementation of findings and measures and captures the evidence for them.
How is evidence captured?
Proof such as files, links, screenshots or confirmations is captured right at the respective task. Completing a measure can be tied to the presence of the required evidence.
Which companies is this for?
Organisations under active ISO 27001 certification or audit pressure, where findings are implemented across several teams (IT, HR, Compliance, management) — typically mid-sized companies.
Does the history stay traceable?
Yes. Every assignment, every status and every piece of evidence is captured in a structured way. The entire implementation history is visible and auditable at any time.
How quickly is it ready to use?
A clearly scoped first process goes live in five working days — from a jointly agreed start and with your involvement. Larger projects get their own schedule.
More solutions
The same principle, other processes: one case, several teams, one shared status.
All solutionsCustomers & sales
Customer onboarding
From the won deal to a productive customer: Bricksta runs every team through one case — with early warning, before a customer escalates.
View solutionPeople & organization
Leave & stand-ins
Request and approval with the team in view, and a stand-in who really stands in: tasks keep moving while someone is on holiday.
View solutionYour process isn't listed?
Bricksta runs any process with steps, owners and deadlines. We'll look at yours in the first conversation.
How do you coordinate the implementation of audit findings today — and how confident are you that everything is fully evidenced?
Personal, no obligation and based on your real process.