How to use ISMS Copilot with Scrut

Overview

Scrut is a security-first GRC platform designed for fast-growing businesses, offering automated compliance management, continuous monitoring, and risk assessment tools across 50+ frameworks including SOC 2, ISO 27001, and GDPR. ISMS Copilot complements Scrut by providing specialized compliance expertise for the judgment-intensive "last mile" tasks that automation can't fully address: customizing policies for your industry, interpreting framework-specific requirements, reviewing evidence quality, and getting expert guidance on implementing controls in your unique organizational context.

Who This Is For

This guide is for:

• Security-first teams using Scrut who need expert guidance on control implementation approaches

• Compliance professionals managing Scrut deployments who want AI assistance for policy customization

• Growing companies leveraging Scrut's automation but lacking deep in-house compliance expertise

• Consultants supporting clients on Scrut who need AI tools for quality assurance and advisory work

How Scrut and ISMS Copilot Work Together

What Scrut Does Best

Scrut excels at automating compliance operations with a security-first approach:

• Unified control framework: Manage multiple compliance frameworks with pre-mapped controls to reduce redundancy and centralize policies, tests, and evidence

• Automated compliance tasks: Hundreds of prebuilt tests automatically run vulnerability scans and compliance checks with real-time gap detection

• Continuous monitoring: 24/7 device compliance monitoring and security protocol oversight to ensure ongoing adherence

• Documentation management: Auditor-vetted policy templates with version tracking and automated updates keep documentation current

• Collaborative audits: Streamlined audit workflows facilitate faster resolution and communication with auditors

• Employee training: Tailored security training programs with automated onboarding to build security culture

• Risk assessment module: Built-in tools for identifying gaps and opportunities with quantitative and qualitative risk libraries

• 70+ integrations: Connects with cloud applications for automated evidence collection and continuous visibility

• Trust Center: Customizable portal showcases compliance posture and security measures to customers

Where ISMS Copilot Adds Value

ISMS Copilot complements Scrut's automation with specialized expertise for judgment-based compliance tasks:

1. Policy and Procedure Customization

Scrut provides auditor-vetted templates, but every organization needs industry-specific customization:

• Industry requirements: "I'm using Scrut's Access Control Policy template for a fintech company. What financial services-specific requirements should I add beyond the template?"

• Procedure depth: "Scrut's Incident Response Policy covers requirements but lacks operational detail. What step-by-step procedures should I add for SOC 2 Type II compliance?"

• Policy completeness review: Upload Scrut policy and ask "Review this Data Protection Policy for GDPR compliance. What's missing or needs more specificity for a SaaS company?"

• Multi-framework alignment: "We maintain SOC 2, ISO 27001, and GDPR policies in Scrut. How should I structure them to meet all three without redundant documents?"

2. Control Implementation Guidance

Scrut monitors controls and runs automated tests, but doesn't tell you how to implement them in your specific environment:

• Implementation planning: "Scrut flagged that we need to implement ISO 27001 control A.8.10 (information deletion). We use AWS, Google Workspace, and Salesforce. How should we implement secure deletion across these platforms?"

• Tool-specific guidance: "We're implementing segregation of duties for SOC 2. Scrut monitors role assignments, but what's the actual role design we should implement in Okta?"

• Gap remediation: "Scrut identified a gap in our vendor risk management. What evidence do auditors expect to see, and what process should we establish?"

• Custom framework mapping: "We're using Scrut to create a custom compliance framework for our industry regulator. What controls should we map from ISO 27001 as our foundation?"

3. Risk Assessment and Management

Scrut provides risk assessment tools, but risk analysis requires compliance judgment:

• Risk scenario identification: "What are the typical information security risk scenarios I should document in Scrut's risk register for a healthcare technology company?"

• Risk scoring methodology: "Scrut provides risk heatmaps. What risk scoring methodology (likelihood × impact) should I use that aligns with ISO 27001:2022 requirements?"

• Risk treatment planning: "I have 15 medium-risk items in Scrut. How should I prioritize risk treatment for ISO 27001 vs. SOC 2 vs. HIPAA requirements?"

• Risk acceptance criteria: "What criteria should I use in Scrut to determine when risk acceptance is appropriate vs. requiring mitigation controls?"

4. Evidence Quality and Completeness

Scrut collects evidence automatically, but auditors evaluate evidence quality:

• Evidence adequacy review: "Scrut collected our quarterly access review logs. Is this sufficient evidence for SOC 2 CC6.1, or do auditors typically expect additional documentation?"

• Manual evidence identification: "What manual evidence might auditors request that Scrut's automation can't collect for ISO 27001 certification?"

• Testing evidence evaluation: "Our vulnerability scan reports are in Scrut. What do ISO 27001 auditors specifically look for in these reports, and what additional context should I provide?"

• Evidence narrative development: "I need to write control description narratives for our SOC 2 report. What should these narratives include beyond what Scrut tracks automatically?"

5. Framework-Specific Interpretation

Scrut supports 50+ frameworks, but each has unique interpretation nuances:

• Framework nuance understanding: "Scrut maps SOC 2 CC8.1 to ISO 27001 A.12.1.2. What are the subtle differences in auditor expectations between these change management controls?"

• Applicability decisions: "Which ISO 27001 Annex A controls can I legitimately exclude from my Statement of Applicability for a fully cloud-native SaaS company?"

• Regulatory guidance: "We're using Scrut for GDPR compliance. What are the GDPR Article 32 requirements that go beyond Scrut's automated security controls?"

• Emerging frameworks: "We need to prepare for the EU AI Act. Can our existing Scrut ISO 27001 and GDPR programs be adapted, or do we need additional AI-specific controls?"

6. Audit Preparation and Response

Scrut streamlines audit workflows, but audit success requires understanding auditor expectations:

• Mock audit questions: "Generate 25 likely ISO 27001 Stage 2 audit questions for a SaaS company, focusing on areas where auditors typically probe beyond automated evidence"

• Auditor question interpretation: "The auditor asked 'How do you ensure data confidentiality in cloud environments?' What are they actually looking for, and what Scrut evidence should I reference?"

• Exception documentation: "Scrut flagged a control exception for one legacy application. How should I document this exception and compensating controls for the auditor?"

• Control effectiveness demonstration: "Beyond Scrut's automated monitoring, what additional evidence demonstrates control effectiveness to ISO 27001 auditors?"

7. Strategic Compliance Planning

Scrut provides the platform, but strategic decisions require compliance expertise:

• Framework selection: "We have SOC 2 in Scrut. Should we add ISO 27001, HITRUST, or industry-specific frameworks for healthcare customers?"

• Scope definition: "How should we define our ISO 27001 certification scope in Scrut for a multi-product company with different customer segments?"

• Timeline planning: "What are realistic milestones for ISO 27001 certification using Scrut, and where do organizations typically encounter delays?"

• Resource allocation: "What compliance activities still require dedicated staff time vs. what Scrut's automation handles independently?"

Common Workflows Combining Both Tools

Workflow 1: Policy Deployment and Customization

Scenario: You're deploying Scrut's policy templates for your organization.

1. In Scrut: Generate policy set from Content Library templates for your selected frameworks

2. Export for review: Download policies for customization review

3. In ISMS Copilot: Upload each policy: "Review this Information Security Policy for a 100-person healthcare SaaS company. What HIPAA-specific requirements and healthcare best practices should be added to Scrut's template?"

4. Customization: Edit policies based on ISMS Copilot recommendations

5. In ISMS Copilot: Validate completeness: "Does this revised policy meet HIPAA Security Rule, SOC 2, and ISO 27001:2022 requirements?"

6. In Scrut: Upload finalized policies, deploy to employees with automated onboarding, track acknowledgments

Workflow 2: Risk Assessment Design

Scenario: You're conducting your first ISO 27001 risk assessment in Scrut.

1. In ISMS Copilot: Get risk scenario guidance: "What are the typical information security risk scenarios for a B2B SaaS company that I should document in my ISO 27001 risk assessment?"

2. In ISMS Copilot: Design risk methodology: "What risk scoring approach (likelihood × impact) should I use that meets ISO 27001:2022 requirements?"

3. In Scrut: Build risk register using ISMS Copilot's scenario library and scoring methodology

4. In Scrut: Use risk assessment module to conduct assessments, generate heatmaps, and track treatment

5. In ISMS Copilot: Validate approach: "Review this risk assessment methodology. Does it meet ISO 27001 Clause 6.1 requirements?"

6. In Scrut: Maintain ongoing risk monitoring and periodic reassessment

Workflow 3: Multi-Framework Expansion

Scenario: You have SOC 2 in Scrut and you're adding ISO 27001.

1. In Scrut: Add ISO 27001 framework and review unified control framework showing control overlap

2. In ISMS Copilot: Analyze gaps: "I have SOC 2 Type II. What ISO 27001 Annex A controls require additional implementation beyond my SOC 2 controls?"

3. In ISMS Copilot: Get implementation guidance: "How should I implement ISO 27001 A.5.7 (threat intelligence) for a SaaS company? What tools and processes are typically used?"

4. In Scrut: Configure monitoring and automated tests for new ISO 27001-specific controls

5. In Scrut: Deploy updated policies and track compliance across both frameworks using unified control framework

Workflow 4: Control Gap Remediation

Scenario: Scrut's continuous monitoring identified a control gap.

1. In Scrut: Review the control failure alert from automated compliance checks

2. In ISMS Copilot: Get remediation guidance: "Scrut flagged that we don't have adequate password complexity enforcement. We use Azure AD and Google Workspace. What password policies should we configure to meet SOC 2, ISO 27001, and NIST requirements?"

3. In ISMS Copilot: Document the control: "Create a password policy procedure document that explains our Azure AD and Google Workspace password requirements for audit evidence"

4. Implementation: Configure systems based on guidance

5. In Scrut: Upload procedure document, mark control as remediated, verify automated monitoring shows compliance

6. In Scrut: Continuous monitoring confirms ongoing compliance

Workflow 5: Audit Preparation

Scenario: Your ISO 27001 certification audit is in 30 days.

1. In Scrut: Review compliance dashboard, address any flagged control gaps, ensure all evidence is current

2. In ISMS Copilot: Prepare for questions: "Generate 30 likely ISO 27001 Stage 2 auditor questions for a cloud-based SaaS company, focusing on areas auditors typically investigate beyond automated evidence"

3. In ISMS Copilot: Review evidence completeness: "What manual evidence might ISO 27001 auditors request that Scrut's automation doesn't automatically collect?"

4. In Scrut: Organize all evidence, prepare collaborative audit workspace, ensure auditor access

5. During audit: When auditors ask complex questions, consult ISMS Copilot for interpretation and response guidance

6. In Scrut: Track audit progress, submit evidence, manage to completion

Practical Examples

Example 1: Customizing Scrut's Policy Templates

Situation: You need to customize Scrut's Data Classification Policy for your industry.

Ask ISMS Copilot: Upload Scrut's Data Classification Policy and ask: "Review this policy for a financial services company handling payment data. What PCI DSS-specific requirements and financial industry classification levels should be added?"

ISMS Copilot guidance: Provides financial services classification levels (Public, Internal, Confidential, Restricted, Cardholder Data), PCI DSS data handling requirements, and retention/disposal requirements specific to financial regulations.

Example 2: Designing Risk Assessment Methodology

Situation: You need to design a risk scoring methodology for Scrut's risk module.

Ask ISMS Copilot: "I'm setting up ISO 27001 risk assessment in Scrut. What risk scoring methodology (likelihood × impact) should I use, and what likelihood and impact scales meet ISO 27001:2022 requirements?"

ISMS Copilot guidance: Explains appropriate 5-level likelihood and impact scales, how to calculate risk scores, acceptable risk thresholds for treatment decisions, and documentation requirements for ISO 27001 compliance.

Example 3: Understanding Framework Differences

Situation: Scrut shows control mapping, but you need to understand implementation differences.

Ask ISMS Copilot: "Scrut maps SOC 2 CC6.1 to ISO 27001 A.9.2.1. Both address user access, but what are the specific differences in what auditors expect to see for each framework?"

ISMS Copilot guidance: Explains that SOC 2 emphasizes logical access controls and monitoring, while ISO 27001 requires formal user registration and deregistration procedures with documented approval, helping you tailor Scrut's monitoring to satisfy both.

Example 4: Evidence Completeness Validation

Situation: You want to validate evidence quality before your audit.

Ask ISMS Copilot: "Scrut has collected 6 months of vulnerability scan reports from our automated testing. What additional evidence or context might ISO 27001 certification auditors request beyond what Scrut automatically collects?"

ISMS Copilot guidance: Identifies manual evidence like vulnerability remediation tracking, risk-based prioritization documentation, exception approvals for unfixed vulnerabilities, and evidence that critical vulnerabilities are remediated within SLA timeframes.

When to Use Each Tool

Integration Best Practices

1. Maximize Scrut's Automation

• Connect all integrations: More integrations = more automated evidence collection and monitoring

• Use prebuilt tests: Leverage Scrut's hundreds of prebuilt compliance tests before building custom ones

• Enable continuous monitoring: Let Scrut run 24/7 device and security compliance monitoring

2. Enhance Policy Quality with ISMS Copilot

• Template foundation: Use Scrut's auditor-vetted templates as your starting point

• AI-powered customization: Upload policies to ISMS Copilot for industry-specific enhancements

• Multi-framework validation: Verify policies meet all framework requirements when maintaining multiple certifications

3. Design Effective Risk Assessments

• Methodology design: Use ISMS Copilot to design risk scoring methodology that meets framework requirements

• Scenario library: Get risk scenario templates from ISMS Copilot, then track in Scrut's risk module

• Treatment planning: Use ISMS Copilot for risk treatment strategy, implement and monitor in Scrut

4. Organize Multi-Framework Work

• In Scrut: Manage all frameworks, controls, and evidence in unified control framework

• In ISMS Copilot: Create framework-specific workspaces for focused guidance without context confusion

• Cross-reference: When ISMS Copilot provides implementation guidance, execute and track in Scrut

Cost and Resource Considerations

Investment Overview

• Scrut: Security-first GRC platform with pricing based on company size and frameworks

• ISMS Copilot: Specialized compliance AI starting at $20/month individual or team plans for organizations

Combined Value Proposition

Organizations using both tools report:

• Reduced consultant dependency: Handle complex compliance questions in-house instead of hiring consultants at $150-300/hour

• Better policy quality: Industry-specific customization reduces auditor questions and findings

• More effective risk assessments: Framework-aligned risk methodologies that auditors accept without question

• Faster multi-framework expansion: Confidently add new frameworks with AI-guided gap analysis and implementation

• Smaller compliance teams: 1-2 person teams manage compliance that previously required larger teams or external support

Limitations and Boundaries

What This Combination Doesn't Replace

• External auditors: You still need independent auditors for SOC 2, ISO 27001 certification, and third-party assessments

• Executive accountability: Leadership must still own compliance strategy and risk decisions

• Legal expertise: Complex regulatory interpretation may require compliance attorneys

• Technical implementation: Both tools provide guidance and monitoring, but your team implements controls

When You Might Still Need Consultants

• First-time certifications: Organizations pursuing their first ISO 27001 or SOC 2 often benefit from consultant guidance

• Complex environments: Multi-national operations with varied regulatory requirements may need specialized advisors

• Significant gaps: Organizations with major compliance deficiencies may need consultant-led remediation

• Industry-specific nuances: Certain regulated industries may require specialized consultants for complex scenarios

Getting Started

If You're Already Using Scrut

1. Identify knowledge gaps: What questions do you currently ask consultants or research extensively?

2. Try policy enhancement: Export a policy from Scrut and upload to ISMS Copilot for customization recommendations

3. Design risk assessment: Use ISMS Copilot to design your risk assessment methodology before building it in Scrut

4. Prepare for audit: Ask ISMS Copilot to generate likely auditor questions for your frameworks

5. Evaluate value: Track how often ISMS Copilot answers questions that would have required consultant time

If You're Evaluating Both Tools

1. Start with Scrut: Scrut provides the operational foundation—continuous monitoring, automated testing, unified control framework

2. Add ISMS Copilot for expertise: Layer on ISMS Copilot for policy enhancement, risk assessment design, and implementation guidance

3. Define integration workflow: Establish when you use each tool and how they complement your compliance program

What's Next

• Welcome to ISMS Copilot - Get started with ISMS Copilot

• Organizing Work with Workspaces - Create framework-specific workspaces

• How to Create ISO 27001 Policies Using AI - Enhance Scrut policies with AI customization

• How to Conduct Risk Assessments Using AI - Design risk assessment methodologies

• How to Conduct ISO 27001 Gap Analysis Using ISMS Copilot - Supplement Scrut's unified controls with detailed framework analysis

Getting Help

Questions about using ISMS Copilot alongside Scrut?

• Contact ISMS Copilot support for guidance on integrating AI expertise with Scrut workflows

• Join the ISMS Copilot community to connect with other compliance professionals using both tools

• Check the Help Center for workflow templates and integration best practices