Self-assess with your own evidence.
Clause-by-clause ISMS and PCI DSS self-assessments. Every artefact you upload lands in the Evidence Library, already mapped to the controls and clause it supports.
Illustration with sample data
What Framework Self-Assessments does
The ISMS self-assessment covers ISO/IEC 27001 with ISO/IEC 27002 guidance, and the PCI DSS self-assessment covers every requirement. Work clause by clause, recording status and notes and uploading artefacts. Clauses can be marked not applicable with a reason and restored later.
Every artefact is also added to the Evidence Library, pre-mapped to the Secure Controls Framework controls and to the clause it was uploaded against. Evidence gathered for self-assessment therefore counts toward every framework those controls reach. Clause content refreshes on a schedule you set, or on demand.
Key capabilities
ISO 27001 & 27002
ISMS self-assessment across clauses and Annex A controls.
PCI DSS
Requirement-level self-assessment.
Artefacts to the library
Uploads land in the Evidence Library, pre-mapped to SCF controls.
Applicability decisions
Not applicable with reasons; restore at any time.
Scheduled refresh
Clause content refreshes every 1–720 hours or on demand.
Shared evidence
The same evidence supports other frameworks through the crosswalk.
The business case.
Efficiency, multi-framework alignment, reduced complexity and streamlined processes: what Framework Self-Assessments changes for your programme.
Know before the auditor
See clause-level readiness grounded in real records.
Faster readiness assessments
Evidence reuse and pre-mapping replace manual evidence filing.
ISO + PCI from one base
The same artefacts inform both assessments and other frameworks.
Refresh on schedule
Readiness updates as your programme evolves.
Efficiency figures compare the effort of each workflow cycle in RiskVantis with the same work done manually or in a traditional GRC tool. Your result depends on your starting point; we will model it with you in a demo.
From setup to outcome.
Choose the framework
ISMS (ISO 27001/27002) or PCI DSS.
Decide applicability
Mark not-applicable clauses with reasons.
Assess
Record status and notes and upload artefacts.
Reuse
Artefacts appear in the Evidence Library, mapped.
Supports your obligations.
Framework Self-Assessments contributes evidence and coverage to these frameworks and regulations.
Common questions.
Which self-assessments are available?
ISMS (ISO/IEC 27001 with 27002 guidance) and PCI DSS.
Where do uploaded artefacts go?
Into the assessment and the Evidence Library, pre-mapped to the SCF controls and clause.
Can I exclude clauses?
Yes. Mark a clause not applicable with a reason and restore it later if needed.
Works better together.
Enterprise Compliance Posture
Compliance status in RiskVantis is calculated, never typed in. Every requirement, in every organisation, shows its status, why it has that status and what would change…
Learn more →Evidence & Audit ReadinessEvidence Library
Every artefact from every module in one encrypted library, mapped to the controls it proves, reused across every framework those controls satisfy, and kept fresh with…
Learn more →Compliance ManagementCompliance Visualizer
One place for posture, coverage and frameworks: see which requirements are met, by which controls, directly or through the crosswalk, and why, across every organisation…
Learn more →See Framework Self-Assessments in action.
Book a 30-minute walkthrough tailored to your frameworks, vendors and team.