Adfirma reads your policies, procedures and records the way a certification auditor reads them, and grades every clause and control in the vocabulary they will use. Not a gap assessment you commission once a year. A workspace you keep.
Bring your real document set. Thirty minutes in you are reading your own findings, not a demo tenant.
Adfirma proposes. You confirm, or you overrule it and say why — and that reasoning is what an auditor is actually asking for.
Your evidence is prose — policies, procedures, minutes, records. A tick cannot grade prose. Every requirement gets one of five verdicts, the same five you will hear at the closing meeting.
No readiness percentage. No invented score. Coverage is a count of confirmed judgments, and the backlog is whatever is not green — ordered by severity.
The ISMS manager. The quality manager. The digital mental health provider carrying NSQDMH. Usually one person, holding it together with a spreadsheet, a SharePoint folder and a calendar reminder.
Somewhere in ninety-three controls there is a finding waiting, and if you also carry a sector scheme that is a second set of criteria nobody has read since it was written.
Every copy you upload elsewhere is stale the moment a colleague edits the original. Review dates lapse quietly. Nobody notices until someone external does.
“Show me how you meet A.8.12.” The answer exists, in a document, somewhere — and every request becomes another thread, another attachment, another wrong version.
Ask what an auditor would ask. Every sentence comes back with the document and the paragraph it came from — and when your evidence does not support an answer, Adfirma says so instead of writing one.
Access is revoked within twenty-four hours of termination. HR raises the ticket, IT confirms removal from the identity provider, and the quarterly access review checks the closure.
Nothing in your documents covers revocation for third-party contractors. That is the gap, and it is yours to close while it is still private — not a finding with your name on it.
SharePoint, OneDrive, Google Drive, Dropbox — read in place, versioned immutably. When a colleague edits the risk methodology, exactly the assessments resting on it flag themselves. Not the whole programme. Not nothing.
They request; you disclose exactly what they asked for; both sides keep the same record. Your working drafts stay working drafts.
A programme is one standard, because that is how you are certified and assessed. Your organisation can run several, and they read the same policies and records — each keeping its own scope, dates and findings.
ISO/IEC 27001:2022 · ISO 9001:2015 · NSQDMH:2020 today. SOC 2 and Essential Eight next. NSQDMH is assessed in Australia against Australian expectations, and Adfirma is hosted here, in Sydney.
Connect the drive your documents already live in. You do not need a tidy document set to start — the first grading runs on what is actually there, which is the point.
In-region hosting in Sydney · your evidence stays yours · originals stored immutably.