Question 1

Why annual commitment only?

Accepted Answer

ISO 27001 and NIST SP 800-53 compliance is not a one-time event. It is an ongoing programme. An annual commitment reflects how compliance actually works: you assess, remediate, and reassess. Short-term subscriptions encourage checkbox thinking. We built Audit41 Readiness for organisations that are serious about closing their gaps, not just generating a report.

Question 2

What counts as one framework?

Accepted Answer

Each of ISO 27001 and NIST SP 800-53 is one framework. Each project covers one framework. Essentials and Professional include 1 project. Programme includes up to 3 projects, one framework per project.

Question 3

How does the free rerun work?

Accepted Answer

After completing your initial assessment and working on remediation, you can run the full end-to-end assessment again at no additional cost. The rerun produces a fresh gap report that you can compare directly to your original, showing which gaps were closed, which improved, and which remain. Programme includes one free rerun per project.

Question 4

Can I upgrade mid-term?

Accepted Answer

Yes. You pay the difference between your current plan and the new plan, and the contract term remains the same: it does not restart. So if you are 4 months into an Essentials annual plan and upgrade to Professional, you pay the pro-rated difference for the remaining 8 months.

Question 5

Is the free self-check really free?

Accepted Answer

Yes. The self-check (which helps you understand where you stand and which plan fits) is completely free with no credit card required. You only pay when you start a full gap assessment project.

Question 6

What frameworks are supported?

Accepted Answer

Audit41 Readiness supports ISO/IEC 27001:2022 and NIST SP 800-53.

Question 7

We already use Vanta or Drata. Why consider Audit41?

Accepted Answer

Vanta and Drata are built for the US market (SOC 2, HIPAA). Audit41 is built for ISO 27001 and NIST SP 800-53 — the frameworks Brazilian organisations and US-market suppliers actually need. If you are selling into Brazilian and international markets, your enterprise prospects want internationally recognised certification, not a US-shaped checkbox exercise. At scale, Audit41 is 5–10x less expensive.

Question 8

Will our auditor accept Audit41 output as evidence?

Accepted Answer

Audit41 produces structured evidence: gap assessments, control mappings, documentation, not a certificate. The auditor evaluates your controls, not the tool that organised them. The methodology was developed across 600+ real ISO 27001 and cybersecurity audit engagements.

Question 9

We are doing SOC 2 first. Should we wait on ISO 27001?

Accepted Answer

SOC 2 and ISO 27001 controls overlap by approximately 70%. Running them in parallel using Audit41 is faster and cheaper than sequentially. For most enterprise procurement conversations, ISO 27001 carries more weight than SOC 2.

Question 10

Our runway is tight. Is this worth the spend?

Accepted Answer

Annual Professional tier is R$ 11.990, roughly R$ 33 per day. If a single enterprise deal has stalled because of missing ISO 27001, the cost of not certifying is already higher. A traditional consultant engagement costs R$ 60.000–200.000 and takes 6–9 months.

Question 11

Do we still need a consultant to get certified?

Accepted Answer

You need an accredited certification body to issue the certificate. Audit41 prepares your team for that audit: structured evidence collection, gap remediation, and control mapping. Many companies complete preparation entirely internally using Audit41 and then engage a certification body directly for the audit itself.

Question 12

How long does it take to go from gap assessment to audit-ready?

Accepted Answer

It depends on your starting point. Companies with existing security practices typically reach audit-ready in 8–14 weeks. Audit41 structures the work so you know exactly what is done, what is pending, and what the auditor will look for.

Question 13

You are significantly cheaper than traditional consultants. What is the catch?

Accepted Answer

There is no catch, only software economics. The methodology is built once and validated across 600+ audit engagements. The annual fee distributes that development cost across the platform. We offer the efficient version, not the compromised one.

Question 14

What is ISO 27001 and why do companies get certified?

Accepted Answer

ISO 27001 is the international standard for information security management systems (ISMS). Companies get certified to demonstrate to customers, partners, and regulators that they manage information security systematically. In practice, ISO 27001 certification is increasingly required by enterprise procurement teams across Brazilian and international markets before they will sign contracts with technology and service vendors.

Question 15

What is a gap assessment and how does it differ from an audit?

Accepted Answer

A gap assessment identifies the distance between your current security posture and the requirements of a compliance framework. It tells you what evidence you have, what is missing, and what you need to fix before an audit. An audit is a formal examination by an accredited certification body, resulting in a certificate or compliance determination. Audit41 Readiness is a gap assessment tool. It prepares you for an audit but does not conduct or replace the audit itself.

Question 16

How long does ISO 27001 certification typically take?

Accepted Answer

With a traditional consultant: 6–12 months from starting preparation to receiving a certificate. With Audit41 Readiness, companies with existing security practices typically reach audit-ready in 8–14 weeks. The certification audit itself usually takes 1–3 days depending on organisation size.

Question 17

What is OSCAL and why does Audit41 use it?

Accepted Answer

OSCAL (Open Security Controls Assessment Language) is an open standard developed by NIST for representing security controls and assessments in a machine-readable format. Audit41 uses OSCAL-aligned templates to ensure control mappings and evidence documentation are structured, auditor-readable, and portable across frameworks.

Perguntas frequentes

Sobre o Audit41 Readiness

Antes de decidir

Fundamentos da ISO 27001 e do NIST SP 800-53