Solutions / GRC

Governance, risk and compliance reviews, grounded in your own sources

Normain reads your standards, policies and client evidence and returns structured, verifiable answers, each one linked to the exact clause it came from. Your team reviews and signs off in a fraction of the time.

Book a demo Explore the product

Your documents

SOC 2 Type II

ISO 27001 cert

SIG Lite

Question

Any exceptions or deviations noted in this SOC 2 report?

2 minor exceptions, both with management responses.

High confidenceSource p.42

GRC use cases

Framework gap analysisThird-party and vendor riskPolicy and control framework reviewRisk assessment and risk registerDPIA and data protection riskDORA ICT and third-party risk

How it works

Add your knowledge

Standards, policies and the evidence under review. Normain reads and understands each source.

Define the questions once

Tell Normain what to extract, how to analyze it and what the output should look like. It handles the framework logic and scoring.

Get verified output

Structured answers in seconds, every finding backed by a citation, so your team reviews, challenges and signs off with confidence.

A Notebook for GRC

From client policies to a gap report in one run

Map the policies to Annex A, check the Statement of Applicability against that mapping, then write the gap report. Each step builds on the one before, and every gap links back to the clause or cell it came from.

Click any step to open it, or any citation to jump to the source it came from. Press Run to watch the steps feed each other.

Gap check

Map the policies to Annex A

Find the gaps, using 01

Write the gap report from 01 and 02

Instruction

Write a gap report in Word from 01Map the policies to Annex A and 02Find the gaps, using 01. One section per gap with the control, what is missing and the evidence to ask for.

Result

Wrote ISO 27001 gap report.docx (3 pages). It covers the 3 gaps from step 02, starting with the backup conflict because internal audit has already raised it.

ISO 27001 gap report.docx

ISO 27001 gap report: Northwind Logistics

A.8.13 Information backup

The SoA records 90-day backup retention.

Policy §9.4 sets 30 days.

Ask for the backup job settings and agree which period is correct.

A.5.23 Cloud services

Marked implemented in the SoA with no supporting policy.

Ask for the cloud provider list and any cloud security standard in use.

A.8.28 Secure coding

Partially implemented, no document referenced. Ask for the development standard or code review procedure.

High confidence

Built for GRC teams

Recognize the work you do every day

These are the reviews GRC teams run by hand today: the same documents, the same questions, the same matrices. Normain does the reading and gives you structured, cited answers to check and sign off.

Spreadsheet analysis

Framework gap analysis

Built forISMS managers · GRC analysts · advisory consultants

Assess your current state against a target framework, control by control, and produce the gap matrix that feeds your Statement of Applicability and remediation roadmap.

Data sources

ISO 27001:2022 Annex A

Statement of Applicability

SOC 2 (Trust Services Criteria)

NIST CSF 2.0

Interactive — try it out

Question

Assessment

Explanation & evidence

Does A.8.16 Monitoring activities meet its stated purpose?

—

If partially met, what remediation is required and who owns it?

—

A.5.15 Access control — is a documented access policy in place and enforced?

—

A.8.24 Use of cryptography — are key management responsibilities defined?

—

A.5.7 Threat intelligence — is a feed collected and acted on?

—

Example questions

For every control assessed as partially implemented, identify the specific sub-requirement not met and cite the evidence reviewed.
Which controls satisfy both ISO 27001:2022 Annex A and the SOC 2 Common Criteria, so we can consolidate to a single control statement?
Where a control is applicable but no implementing policy exists, flag it as a documentation gap and propose a remediation owner.
Which 2022 Annex A controls are new versus our previous SoA, and are they addressed?

…and any others you write.

Repeat analysis

Third-party and vendor risk

Built forThird-party risk analysts · DPOs · procurement

Review each vendor's evidence against the same checklist, so onboarding and periodic re-reviews take minutes instead of an afternoon of reading each report.

Interactive — try it out

Data source

Opinion

Exceptions

Cert

Acme Cloud — SOC 2

—

Meridian LLP — SOC 2

—

Northwind — SOC 2

—

Example questions

From the test-of-controls table, list every control with an exception, the auditor's testing method, and management's response.
Which subservice organizations are carved out, and do any of them process our regulated data?
Extract the Complementary User Entity Controls (CUECs) we must implement, and map each to an internal owner.
Does the coverage period leave any gap since the previous report, and is the ISO certificate in scope and valid?

…and any others you write.

Simple analysis

Policy and control framework review

Built forGRC analysts · policy managers

Ask a set of pointed questions across your policy library at once, to prove coverage, catch contradictions, and find what is overdue for review.

Data sources

Information Security Policy

Access Control Policy

Incident Response Plan

BCDR plan

Interactive — try it out

Access Control Policy

Instruction

Is phishing-resistant MFA required for privileged access?

Answer

—

Policy register

Instruction

Which policies are overdue for review?

Answer

—

Example questions

Does our Access Control Policy require phishing-resistant MFA for privileged access, and which clause states it?
Which framework requirements have no backing policy clause?
Where do two policies conflict, for example on password length or data retention?
Which policies are past their stated review date as of today?

…and any others you write.

Testimonials

Trusted by GRC teams

Normain is a tool that helps us scale our high standard without compromising our methodology.

Peter Wrenfelt

Founder & Senior Partner, U&We

Normain allows us to multiply decades of human insight by the scale and speed of AI

Ian Roe

CEO, Black Sun Global

We're seeing a 35% reduction in research time thanks to Normain

Nadya Kamenkovich

Consultant, Black Sun Global

Normain completely stood out in the market for their relevance and usability. It's very intuitive, powerful, and understandable by my team—engineering is not the bottleneck

Charlie Forcey

CTO, Sustainability Roundtable, Inc.

The volume and quality of this benchmark would have been impossible without Normain's AI technology

Frederik Otto

Managing Partner, AvS Advisors

Normain fits directly into our current business processes and made an impact from day one

Mattias Ullsten

Founder & Managing Director, Advisense

Analysis types

When the question is the same across hundreds of files

Some GRC work is one structured question asked at scale. Analysis types answer it across a stack of policies, once per supplier assessment, or across a whole control matrix, with a citation behind every answer.

Read across a stack of documents

Point Normain at a pile of files and ask your questions once. It reads all of them and gives you one combined answer, with a citation behind every point.

Run the same questions across many items

One row per file, folder, vendor or company. The same questions run across every item, so you can compare and rank a whole set side by side.

Fill in a grid or scorecard

Your questions down one side, your sources along the other. Ideal for questionnaires, scoring grids and readiness assessments.

See the analysis types →

See it on your own documents

Bring a standard and a client file. In minutes, watch Normain work through them with the reasoning and citations in view, all the way to cited answers you can sign off on.

Book a demo Try for free