For ISO 27001 and KSC auditors and consultants

Who it is for

Certification auditors who look at vulnerability management during ISO/IEC 27001 audits, and consultants who set that process up on the client side. Two groups, one account, the same conditions.

What you will see in the account

• A partner account is active from the moment the application is accepted and has 10 machine slots, so scanning can be tested on your own infrastructure.
• The Evidence Pack is an archive with the management report, the ISO 27001 report, the EOL report, the risk acceptance register, the remediation plan, the audit log, the dataset and a manifest with SHA-256 checksums of the other files.
• The audit log records decisions: risk and false-positive acceptances, owner assignment, EOL plans and acceptances, threshold changes, evidence freezes and reviews, incidents and account security operations. Export to CSV.
• A risk acceptance requires a justification, a risk owner, a review date and information on compensating controls. The technical role can submit a request, which the account owner or administrator approves; they can also accept a risk directly.
• Time to remediate is measured from the first observation of a vulnerability to its disappearance from a later full scan, not from a click in the interface.
• Reports: the Evidence Pack, the audit log, EOL, ISO 27001, the management report, the compliance map, an editable vulnerability management policy template and frozen datasets with a checksum.

Conditions

• The account carries 10 machine slots and the full functionality of the Starter plan. There is nothing to pay, now or later, and no payment screens appear anywhere in it.
• The account is meant for testing and learning the tool. It is not meant for running production infrastructure, yours or anyone else's.
• Access to a client's account is added to the same login only when that client invites you using the same e-mail address you give here. An invitation sent to another address will not be linked to that login.
• The programme pays nothing. There is no commission, no revenue share and no payment of any kind for mentioning Secvalis to anyone.
• We look at every application by hand and we may decline one without giving a reason. When the account is created, we set its review date 12 months ahead.