trio.so

Compliance readiness assessment

21 checks on your devices, accounts and evidence, scored against the frameworks you need. Each gap comes with the commands to verify it, the fix and the control references.

SETUP · Industry01 / 06

What does your company do?

We use it to suggest the frameworks that usually apply. You can change them on the next step.

1–8 to pick · Enter next

How the score works

Scoring runs in your browser, with the same rules for everyone. Not sure counts as not in place, because an auditor would ask you to show it.

1 · 0.5 · 0
Answer points
In place, partly in place, not in place or unsure
3 · 2 · 1
Severity weights
The overall score weights each check by severity
85 · 60 · 35
Score bands
Ready, partly ready, major gaps; below 35 is early stage

Frameworks and versions

Pick the ones that apply. Each answer counts toward every framework it maps to.

SOC 2Trust Services Criteria 2017

For companies whose customers ask for a SOC 2 report.

21 checks
ISO 27001ISO/IEC 27001:2022 Annex A

For companies whose buyers require it, often in Europe and in larger deals.

21 checks
HIPAASecurity Rule, 45 CFR 164

For healthcare providers and the vendors that handle their patient data.

18 checks
PCI DSSPCI DSS v4.0.1

For anyone who takes card payments or stores card data.

14 checks
NIST 800-171 / 800-53SP 800-171 r2 · SP 800-53 r5

For US government contractors and the agencies they work with.

21 checks
GDPRArt. 5, 24, 32

For anyone holding personal data about people in the EU or UK.

15 checks
CIS ControlsCIS Controls v8.1

A practical baseline for any IT team, included in every assessment.

18 checks

The checks cover devices, accounts, updates and evidence, which are the controls IT owns. Each framework also covers things outside IT, like vendor reviews, HR checks and physical security, which this assessment doesn't score.

FAQ

No. It's a self-assessment based on your answers, so it can't replace an auditor or a formal gap assessment. It shows where your device and account controls stand before an auditor asks, so you can fix the obvious gaps first.

Yes. Owning a tool and having every device covered by the right policy aren't the same thing. Tell us which tool you use, and each check shows where to look in it, so you can answer from data instead of memory.

No. Every command in the assessment only reads settings. A few need an admin prompt to read the value, and those are marked.

Your score is calculated in your browser. Before the results show, we ask for your name, company and work email. We then receive those, your answers and your scores, so we can send the report and a link back to it.

No. Every fix is written so you can do it with any tool or by hand. Where trio.so covers a fix, the report says how.

Yes. Run it once per client and share the PDF or the CSV in your next review. If you manage several clients, book a demo of the multi-client console.