Requirements Management
See every requirement you face - across every standard, plus your own contracts and policies - traced to the documents, evidence and processes that satisfy it.
Bring every requirement you face, from the standards you follow and the contracts that bind you, into one traceable view - each linked to the document, evidence and process behind it. See the gaps first.
Follow every requirement to the work and evidence behind it
Requirements Management brings standard, customer, vendor and internal obligations into one traceable view. Provisioned standard requirements sit alongside the ones a contract or a customer imposes, and each can be filtered by scope, source, criticality and how well it is covered.
Coverage is not one number. Documentation links, supporting evidence and approved operating processes are tracked independently, because a procedure that mentions a clause, a record that evidences it and a process people actually run are three different claims. What an association proves, and what still needs a reviewer, stays visible.
What it looks like
Find requirements by scope, source and coverage. Provisioned standard requirements are browsable alongside customer and internal ones.
Use cases
Several standards, one register
Running more than one standard means meeting the same obligation under different clause numbers. A curated cross-standard crosswalk shows you where the reuse genuinely is - each link with a written rationale - while every requirement keeps its own place in the gap list, so you see the overlap without anything being quietly marked as done for you.
Obligations beyond the standards
A contractual demand, an internal policy, a customer-specific requirement - add your own and they sit alongside the standard ones, counting toward coverage and gaps exactly like a built-in requirement, instead of living in a separate spreadsheet nobody opens.
A deliverable you can hand the auditor
Export the traceability matrix as a CSV or a branded PDF - the same rows in the same order as the screen, generated from live data. When an auditor asks how you address a clause, the answer is a document you produce on the spot, not a hunt through folders.
Scope out, with the justification an auditor will ask for
Not every clause applies to every organisation. Mark what does not apply, with a written justification captured against it - directly addressing one of the most common audit findings, unexplained exclusions.
Traceability, coverage and control in one module
Traceability from clause to proof
One row per requirement, showing the documents and sections that address it, the evidence that proves it and the live process that performs it - expandable to the exact detail, and exportable as an audit deliverable.
Gaps you can see coming
Two gap lists - requirements nothing documents, and requirements no live process performs - with the critical ones surfaced first, so remediation is prioritised rather than discovered at the worst moment.
Every standard, plus your own
The requirements from your standards and the obligations from your contracts and policies live in one register, each traced to the same evidence - so nothing you are bound by is tracked off to the side.
Traceability
Keep the gaps visible, and decide what to work on next
The traceability matrix lays requirements against the documents, evidence and processes that cover them, and it shows the gaps rather than averaging them away. The matrix above has uncovered requirements in it, which is the normal state of a system still being built and the reason the view is useful.
Documentation gaps and control gaps are separated, scope exclusions are explicit, and the gaps connect to the work that closes them - a document to write, a process to approve, or an item on an implementation plan. Reuse across standards is supported through central crosswalks and organisation equivalences, with direction, strength and rationale recorded, so credit taken by equivalence stays distinguishable from direct coverage.
- Documentation, evidence and process coverage tracked independently
- Direct coverage and equivalence credit kept distinguishable
- Scope exclusions stated rather than quietly counted as covered
- AI verification is source-backed review support, not a certification decision