One workspace for ISO 27001, ISO 27701, UU PDP and SOC 2.
Whitesec One is the GRC dashboard we use with clients. Risks, controls, incidents, internal audits and the evidence behind them live in one place, not scattered across spreadsheets and email.
Screenshot of the live dashboard with sample data.
- Frameworks
- ISO 27001:2022, ISO 27701:2025 with UU PDP, SOC 2 Type II
- Built by
- Whitesec ID (PT Topi Putih Siberindo)
- Interface
- English, with Indonesian regulatory terms kept in their official form
- Works on
- Desktop and mobile browsers
A workspace laid out the way the standards are written.
Each framework gets its own workspace. Underneath, your organisation keeps one set of records: a risk is entered once, owned by a person, rated, treated and signed off, and the same record shows up wherever another framework needs it.
- 01
Evidence ready for audit
An auditor, regulator or customer asks for proof. Registers export to CSV, Excel and PDF from the same data the dashboards read, so what you hand over is the program you actually run.
- 02
One set of records for several frameworks
SOC 2 reads your own risk, supplier, incident and policy registers, and so does the ISO 27001 workspace. Adding a framework does not mean re-entering what you already hold.
- 03
Your consultant works in your records
Whitesec ID consultants work alongside your team inside the workspace, not on copies sent by email, so what the auditor sees is what you actually keep.
The real dashboard, on desktop and on a phone.
These are screens from the application, not illustrations. The same pages reflow on a phone, so a consultant or an auditor can check a register from anywhere.
Certification readiness for clauses 4 to 10, with the next action for each.
Screenshot of the live dashboard with sample data.
The standards and regulation Indonesian organisations are asked about most.
Subscribe to the frameworks you need. They read the same underlying registers, so evidence is kept once.
ISO/IEC 27001:2022
Clauses 4 to 10 · 93 Annex A controls
The registers, reviews and approvals an information security management system keeps: a risk register with appetite and owner sign-off, a versioned Statement of Applicability, internal audit, management review and corrective actions.
ISO/IEC 27701:2025 and UU PDP
78 Annex A controls · 48-article UU PDP register
Privacy management on the same registers as your ISMS, plus the records Law No. 27 of 2022 asks for: records of processing, DPIAs, data subject requests on the statutory clock, and breach notification in hours.
SOC 2 Type II
61 criteria · Type I and Type II
A Type II engagement from scope to bridge letter: the system description in DC 200 order, a control matrix with criteria coverage, samples planned from control frequency, exceptions with management responses, PBC requests and bridge letters. The report and its opinion come from your independent service auditor.
The Essential Eight, the ASD maturity model for Australian organisations, is also available in the Whitesec One workspace.
Workflows that leave a record an auditor can test.
The rules below are enforced by the application, so the records stand up when an auditor samples them.
Risk register with appetite
A 5x5 likelihood and impact scale, an appetite threshold and treatment options. A risk cannot close while its residual score sits above appetite, and the risk owner signs off the treatment plan.
A Statement of Applicability that stays honest
All 93 Annex A controls with applicability, owner and review date. An exclusion needs a real justification, and each approved version is kept as a frozen snapshot.
Approval by a second person
Risk criteria, each Statement of Applicability version, policies and continuity plans are approved by someone other than their author. Evidence is accepted only by someone other than the person who collected it.
Findings become corrective actions
An audit finding is recorded as a nonconformity and becomes a corrective action with an owner, a due date and the evidence that closed it.
Reminders before things lapse
Anything due within 30 days, or overdue, appears as a notification in the app, from treatment dates to privacy deadlines.
Exports for the auditor
Registers export to CSV, Excel and PDF from the same data the dashboards read.
- app.whitesec.one/iso27001/reports
Reports and risk heat map
Compliance score, risk heat map and the state of audit findings in one view.
- app.whitesec.one/iso27001/soa
Statement of Applicability
All 93 Annex A controls with applicability, status, owner and review date.
- app.whitesec.one/soc2/control-matrix
Control matrix
Controls mapped to criteria, with frequency, owner, design conclusion and latest result.
Screenshot of the live dashboard with sample data.
Customers, suppliers and staff see only what you publish.
Trust Center
A public page you publish from the workspace: certifications, control summaries, subprocessors, answers to common questions and documents released on request.
Vendor portal
Suppliers answer their assessment through a private link that expires. They need no account, and the answers land on your supplier register.
Training and awareness
Participants read the material, take a quiz in Indonesian or English and receive a completion certificate, with the results recorded against the program.
Each person opens only the dashboards they are given.
Dashboard access follows the workspace plan and each member, and is enforced on the server.
- Owner
- Sets up the workspace, invites members and decides which dashboards each person can open.
- Editor
- Adds, edits, approves and archives records in every dashboard they can open.
- Auditor
- Reads everything in full and exports evidence. Records audit work, findings and corrective actions, and changes nothing else.
- Viewer
- Reads only. Emails, phone numbers and data subject names are masked by the database.
Platform and consultants, working in the same records.
We prepare you; an independent body assesses you. The platform is where that preparation is kept.
- 01
Scope the program
We agree the frameworks, the boundary and the date an auditor, regulator or customer needs the evidence.
- 02
Set up your workspace
Your plan, your members and their access levels, so each person opens only what they should.
- 03
Build the records together
Risks, controls, policies and evidence are entered with your team and a Whitesec ID consultant, inside your workspace.
- 04
Pre-audit before the assessor
An internal audit and a management review run before the external assessment, so Stage 1 or fieldwork holds no surprises.
- 05
Independent assessment
An accredited certification body or your independent service auditor assesses you. Preparing you and certifying you stay separate.
Stated plainly, so you can plan around it.
- It does not issue certificates or SOC 2 reports. Those come from an accredited certification body and from your independent service auditor.
- It does not connect to or scan your systems. It records assessments, evidence and patch status.
- It does not replace your auditor or your judgement. It keeps the records they examine in a form they can test.
- It makes no hosting-region promise on this page. Where the data sits is confirmed with you during scoping.
Built by a team that is audited too.
Whitesec ID, which builds and operates Whitesec One, is certified to ISO/IEC 27001 (verified by SGS under UKAS accreditation) and registered with Komdigi as a private electronic system operator.
- Each workspace is isolated in the database with row-level security, and a test plants canary records to prove one workspace cannot read another.
- Personal data is masked by the database for the read-only Viewer level.
- Changes to records are logged with who made them and when.
Before you ask for a demo
See your own registers in Whitesec One.
We walk through the workspaces for the frameworks you need with the team in Jakarta. Already a client? Sign in at app.whitesec.one.