Standards

The overview lists each standard with its Version, Scope, the number of requirements Assessed, the AI estimate of readiness and the date it was Adopted on. The Kind filter shows only standards, or only laws and frameworks. The Why column shows why you follow a framework: a legal obligation, certification, or a contract with a customer, with that customer's name. You change it on the standard's own screen. The established Statement of Applicability names the reason as it was then. The catalogue currently holds the full requirement set of ISO 27001:2022, including the controls of Annex A, written in Trustbird's own words in English and Dutch.

Adding a standard

You choose the standard you start with when you create the workspace. You add the next one here with Add standard. Before you confirm, the window says what the standard does to your price. Trustbird sets up every requirement of the current version as not yet assessed, and you assess them as you did for your first standard. How an extra standard is charged is under Billing. Where the catalogue links a requirement to one of a standard you already have, Related requirements shows which measures are already attached.

Ending a standard

Open the standard and click End standard. The window says when the standard ends and what that does to your price. If a paid period is running, the standard ends on your renewal date and you can use it as usual until then; until that date you can Withdraw ending. Without a paid period it ends right away. You cannot end your last standard: to stop, cancel your subscription.

An ended standard is kept, but only to view. You find it with the Status filter set to Ended, with your established statements and exports. If you add it again later with Add standard, your earlier decisions come back.

The requirements table

Requirements are shown as a tree: sub-requirements sit indented under their parent. For each one you see the Code, the Requirement, the Applicability, the Implementation status, your Justification and the Measures linked to it. When you click Assess, the form often shows a question in plain language and what an auditor usually wants to see. Your justification is your own reasoning; Trustbird never fills it in for you.

The column AI opinion on the evidence shows what the AI thinks of the current evidence for that requirement. Hover over it to read why. It is a suggestion next to your own decision, never instead of it.

Statement of Applicability and exports

Each established version is fixed. Later decisions go into the next version, so you can always show an auditor what applied when. Under Exports for the auditor you put together one ZIP file with a summary, the established Statement of Applicability, the evidence files with an index, the AI judgments and the audit trail of the period you chose. The download link is available for a limited time and only works for members of the workspace.

Documents for your statement

After you establish it, Trustbird proposes the documents that our document list ties to the requirements that apply, and says which you already have. A document that only belongs to requirements you excluded is not proposed. Nothing is drafted until you choose: Draft with AI makes one draft, Write it myself makes an empty document. An AI draft only becomes valid when an owner establishes it on Documents. Skip leaves the proposal alone.

Linking measures and other versions

You link measures and evidence to requirements from the Measures and Evidence screens; the linked measures then show up here. If a newer published version of your standard becomes available, Switch version creates a new adoption on it and carries over decisions for requirements the catalogue marks as equal. Related requirements appears only when your workspace has adopted a second standard with requirements the catalogue links to this one.

Suggestions from the interview

If the interview suggested that a requirement applies, the requirement shows AI suggestion: applies, with the reasoning when you hover over it. Take over marks the requirement as applicable with that reasoning, Take over with changes lets you write your own reasoning, and Reject leaves the requirement as it was. A requirement you take over only enters the Statement of Applicability once you establish it.