Compliance
A standard is a pack, not a rebuild.
Most compliance software hardcodes one standard and calls it a product. In Rockbase a standard is data — clauses and the rules that find their evidence — riding over the records you already keep. Three frameworks run on that same machinery today, and one of them is not an ISO standard at all.
A standard is data.
Clauses and their evidence rules are a pack. The core knows nothing about ISO, or the UK, or any regulator — which is why the second framework cost a pack and the third one needed no new engine code at all.
Evidence, not attestation.
A clause is met when the evidence for it exists in your account, found by a rule. Nothing goes green because somebody ticked a box, and nothing goes green because we said so.
A jurisdiction is a pack too.
Frameworks that apply in one country say so, rather than sitting on the board looking global. The same shape carries employment rules: a pack records how much of a jurisdiction's law it actually models, so a thin one admits it is thin.
What runs today
Three frameworks, one engine.
Each card says what is packed and what is not. The second column is the one most vendors leave out.
ISO 9001:2015
Quality management
Packed
Fourteen clauses across context, leadership, planning, support, performance evaluation and improvement — riding over the registers, objectives, documents and records you build as you lay your foundation.
Not yet
§8 Operation. Its evidence — product and service requirements, design controls, external providers — has no primitive in the spine yet, so we have not packed it rather than stretch something to fit.
ISO/IEC 27001:2022
Information security
Packed
A deliberate single-clause slice: §4.3, determining the scope of the ISMS. It is the clause that forced the evidence bridge, because no existing record means an ISMS scope has been set.
Not yet
The rest of the standard, and Annex A. This one exists to prove the second framework costs a pack rather than a rebuild — not to imply you are 27001-ready.
Acas Code 2015
Discipline and grievance
Packed
Written procedures, the disciplinary steps, the grievance steps, and a written record of every case. A tribunal may adjust an award by up to 25% either way where the Code was unreasonably not followed, which is why it is more than best practice.
Not yet
The per-case fairness verdict is not readiness. Whether one case established the facts, informed in writing, allowed accompaniment and offered an appeal is judged on the record itself, live, and never stored as a score.
Why the third one mattered most.
ISO 27001 riding the same machinery was close to expected — it is another management standard of the same family. The Acas Code is not: it is a statutory British employment code whose evidence is an HR case file rather than a quality record. It needed no new engine code either. That is the moment the thesis stopped being an argument and became a fact — and it is why a fourth framework, or your industry's, is a pack we author rather than a product we rebuild.
The same shape carries country rules. Where a framework or a rule applies in one jurisdiction only, it says so instead of sitting on your board pretending to be universal.
Questions
Answers.
How it stays honest.
Rockbase cannot fake a record. It can only make true ones easy to create and surface the gaps that remain. Where a clause needs a specific document, an unrelated one will not do — somebody has to deliberately pin the right one, because a rule that counts any document is a rule that reports success for nothing. An accredited body issues the certificate; we get you ready for it and keep you there. See how the underlying records are protected.
Build on solid ground.
We're taking on a small number of founding clients. If your strategy and your work have drifted apart, let's fix the foundation.
Apply for early access