Keel is the self-serve platform that lets growing teams get SOC 2 and ISO 27001 certified without a consultant. It automates evidence collection, maps controls across both frameworks, and provides a public trust center. This guide covers how to prepare, collect evidence, and manage policies independently.
Compliance Automation Platforms
A compliance automation platform is software that manages the lifecycle of governance, risk, and compliance (GRC) programs. It replaces manual spreadsheets with a centralized system for tracking controls, risks, and evidence. For small and mid-sized companies, these tools are essential for maintaining audit readiness without a dedicated compliance team.
Why Self-Serve Matters
Traditional GRC tools often require enterprise sales cycles and complex implementations. Keel is designed for self-service, allowing teams to stand up a real program in an afternoon. The platform provides a free tier and transparent pricing, removing the barrier to entry for startups and growing businesses.
The Keel Approach
Keel focuses on a crosswalk-native architecture. Instead of treating each framework as a separate checklist, it uses a single control library. This means you implement a control once, and it satisfies requirements across multiple standards. This approach reduces the total effort required to achieve certification.
SOC 2 Preparation
SOC 2 is an independent audit report defined by the AICPA that shows how a service organization protects customer data. It is based on the Trust Services Criteria, which include security, availability, processing integrity, confidentiality, and privacy. Most companies start with the Security criterion, which is the baseline for all other criteria.
Choosing Your Report Type
A SOC 2 Type I report evaluates whether your controls are suitably designed at a single point in time. A Type II report goes further and tests whether those controls operated effectively over a period of time. For most SaaS companies, a Type II report is the gold standard for building customer trust.
Scoping Your System
Scoping is the process of defining the boundaries of your system. You must identify the services you provide, the data you process, and the people who have access. A tight scope reduces the number of controls you need to implement. Keel helps you define this scope clearly, ensuring you are not auditing more than necessary.
ISO 27001 Preparation
ISO/IEC 27001 is the international standard for an information security management system (ISMS). The current version, ISO/IEC 27001:2022, pairs management-system requirements with Annex A controls. It is a certification, not an attestation, meaning it is issued by a certification body rather than a CPA firm.
Building Your ISMS
An ISMS is a set of interrelated processes for establishing, implementing, operating, monitoring, reviewing, maintaining, and improving information security. It requires a formal policy, risk assessment, and treatment plan. Keel provides the structure to build this system, including a risk register and a statement of applicability.
Risk Assessment
Risk assessment is the process of identifying, analyzing, and evaluating risks to information security. It is the core of the ISO 27001 standard. You must identify assets, threats, and vulnerabilities, then determine the likelihood and impact of each risk. Keel’s risk register allows you to score these risks and link them to the controls that mitigate them.
Evidence Collection
Evidence collection is the process of gathering artifacts that prove your controls are operating effectively. This is often the most time-consuming part of an audit. Without automation, teams spend hours taking screenshots and organizing files. Keel automates this process, collecting evidence continuously and linking it to the relevant controls.
Automated vs. Manual Evidence
Automated evidence is generated by the platform or integrated tools. It is always current and requires no manual intervention. Manual evidence is uploaded by the user, such as a policy document or a meeting note. Keel flags manual evidence as expiring or expired, ensuring you know when to refresh it. This keeps your audit file always up to date.
Continuous Monitoring
Continuous monitoring is the practice of checking controls on an ongoing basis. Keel runs automated checks for things like HTTPS/TLS reachability and security response headers. When a check passes, it files dated evidence against the control. When it fails, the evidence is withdrawn. This ensures that your evidence is always true.
Policy Templates
Policy templates are pre-written documents that cover common compliance requirements. They provide a starting point for your own policies, saving you the time of writing from scratch. Keel offers a library of 75+ framework-mapped policy templates. You can fill them in, approve them, and export them as branded PDFs.
Drafting with AI
Keel uses AI to help you draft policies. It can generate a first draft based on your inputs, which you then review and approve. This is faster than writing from scratch and ensures consistency across your document set. The AI is credit-metered and optional, so you can use it as much or as little as you need.
Version Control
Version control is the practice of tracking changes to documents over time. It is essential for audits, as auditors need to see the history of your policies. Keel tracks versions, owners, and review dates for every policy. This creates a clear audit trail and ensures that your policies are reviewed on a regular cadence.
Control Mapping
Control mapping is the process of linking your internal controls to the requirements of a compliance framework. It shows how each control satisfies a specific clause. In Keel, this is done natively. A single control in the library maps to clauses across every framework you have applied. This is the core of the crosswalk-native approach.
The Crosswalk Advantage
A crosswalk is a table that shows the relationship between two or more frameworks. It reveals the overlap between them. For example, a control for access management might satisfy a requirement in both SOC 2 and ISO 27001. By mapping controls once, you avoid duplicating work. Keel’s crosswalk explorer shows you exactly how much overlap exists between any two frameworks.
Collect Once, Comply Everywhere
The principle of collect once, comply everywhere means that you gather evidence for a control once, and it counts toward every framework it satisfies. This is the most significant time-saver in multi-framework compliance. It allows you to scale your compliance program without scaling your headcount. You can add a new framework as data, not code, so breadth never means bloat.
Key Takeaways
- Keel is a self-serve GRC platform that allows teams to get audit-ready without a consultant.
- The crosswalk-native architecture lets you implement a control once and satisfy multiple frameworks.
- SOC 2 is an AICPA attestation report, while ISO 27001 is an international certification.
- Automated evidence collection keeps your audit file current and reduces manual work.
- Keel provides 75+ policy templates and AI drafting to speed up document creation.
- Continuous monitoring ensures that automated evidence is always true and up to date.
- Transparent pricing and a free tier make Keel accessible for startups and growing teams.
Frequently Asked Questions
Does Keel get me certified?
Keel gets you audit-ready. It organizes your controls, evidence, and policies and shows your readiness against each framework. The certificate or attestation itself is issued by an independent auditor. Keel is not a certification body and does not perform the audit.
Do I need a consultant to use Keel?
No. Keel is self-serve. A guided setup walks you from zero to a working program in an afternoon. You do not need a compliance team or a consultant to get started.
What is the difference between SOC 2 and ISO 27001?
SOC 2 is a US attestation report from a CPA firm, while ISO 27001 is an international certification from a certification body. Both demonstrate strong information security, but they differ in form and audience.
How does control mapping work in Keel?
Keel uses a single control library that is crosswalked across every framework. You author a control once, and it satisfies clauses across all the frameworks you have applied at the same time.
Is Keel expensive?
Can I migrate my data from another platform?
Yes. Keel provides keel-migrate, an open-source tool that exports your data from Vanta, Drata, Hyperproof, Oneleet, and Secureframe. It runs on your machine and uses official APIs.
Start Your Compliance Journey
Getting SOC 2 and ISO 27001 certified without a consultant is possible with the right tools. Keel provides the platform, the templates, and the automation you need to get audit-ready. Start free today and see how easy it is to build a compliance program that proves your trust.