Sable · Compliance automation
Compliance automation that holds up in the audit.
Map a control once and reuse it across every framework. Evidence with expiry dates, readiness you can defend, acknowledgements that chase themselves, and exports your auditor can follow.
14 days · No credit card
See pricing →Sable's framework readiness table for SOC 2, ISO 27001 and NIST CSF; the multi-factor authentication control opened to show its five linked clauses across four frameworks; its evidence tab with expiry dates and one item twelve days from lapsing; the reminder sent to its owner and what readiness would fall to if it lapsed.
What it automates
One control record. Every framework, every piece of evidence, every change.
Sable automates the program work: the mapping, the reuse, the readiness maths, the reminders and the exports. People still decide whether a control is met. Nothing is scored by a model.
- Map onceLink a control to each framework that asks for it. Adding a second framework becomes a gap review, not a new project.
- Evidence onceAttach an evidence item to every control it supports, with an expiry date. The auditor gets a clear path from requirement to proof.
- Current between auditsUpdate a control and every framework it maps to, every linked risk and the audit trail move with it.
From controls to evidence
Process automation that holds controls and evidence in one record.
Sable links frameworks, controls, policies, evidence, risks and tasks in one record. The features below all work on that same record.
01 / 05
The rest of the program
Compliance is one view of the whole program.
The same controls carry the risk register, the policies and the findings. Nothing is re-entered.
Risk management A real risk register and framework assessments, with controls that link to the evidence behind them.
Vendor management Build your vendor inventory, run real security reviews, and stop being surprised by renewals.
Vulnerability management Continuous scans across hosts and apps, deduplicated and ranked by real-world risk.
Managed SOC 24/7 detection and response, triaged by SubRosa analysts, in the same workspace as everything else.
For MSPs & MSSPs
Several clients, one audit season.
Each client gets an isolated workspace on the same control catalogue. The fleet view ranks clients by health, open findings and overdue tasks, so you know who needs attention first and hand each auditor their evidence without rebuilding it.
- Isolated workspacesOne tenant per client, role-based access, nothing shared by accident.
- Fleet viewReadiness, findings and overdue tasks across every client, ranked.
- Per-tenant frameworksSOC 2 for one client, ISO 27001 and CMMC for another. Configured per tenant.
- Your brandClients see views designed for them, under your brand.
See Sable for MSPsPublished per-seat pricing
Pricing
Included in every plan.
Frameworks, controls and evidence are part of every plan: one active framework on Starter, two on Team, unlimited on Growth. Every plan starts with a 14-day trial, no credit card.
- Starter
- $400/month
- Solo operator or very small team running the basics. Or $4,000/yr, 2 months free.
- Team
- $700/month
- Small teams formalizing risk and controls into a real program. Or $7,000/yr, 2 months free.
- Growth
- $1,200/month
- Growing security or GRC team that needs the full GRC stack. Or $12,000/yr, 2 months free.
- Scale
- Custom
- Mid-market and enterprise programs with custom needs. Contact sales for pricing.
Map a framework in the trial and see where you stand.
Open your workspace with no credit card and no sales call. Pick a framework, link the controls you already run, and read the readiness number an auditor would.
Common questions
- What does compliance automation automate in Sable today?
- The program work. A control maps once to every framework that asks for it; evidence attaches to every control it proves and carries an expiry date; readiness is computed from operational controls and unexpired evidence; policy acknowledgements and expiring evidence are chased by reminders; and the auditor's exports are generated from the record. Collecting evidence from connected systems is the next step: the first connector, Microsoft Entra ID, is in progress. Nothing is decided by a model.
- Which frameworks does Sable support?
- The library holds 25+ frameworks, including SOC 2, ISO 27001:2022, NIST CSF 2.0, NIST 800-53 and 800-171, CMMC 2.0, FedRAMP and GovRAMP, PCI DSS 4.0.1, CIS Controls v8, CSA CCM, GDPR, NIS2, Cyber Essentials and the Essential Eight. Frameworks built on NIST 800-53 reuse its control catalogue as overlays, so a control mapped once covers them together. HIPAA is not in the library yet.
- Is Managed SOC part of Sable?
- Managed SOC is a separate module and is not part of the free trial. When you add it, SubRosa analysts watch the environment 24/7 and triage alerts before they reach your team. Alerts and incidents sit in the same workspace as the compliance work.
- Does Sable use AI to decide whether we are compliant?
- No. An auditor wants to see the control and the evidence behind it, and a score from a model does not give them that. Sable builds the record from linked controls and evidence your team reviews. Whatever AI you use elsewhere in your process, check its output before it goes near an audit.
- Does SubRosa do the compliance work, or does my team?
- Your team does, and you never have to buy SubRosa services to use Sable. When you need more, SubRosa's compliance team can run the readiness assessment and support the formal audit. The final SOC 2 report or ISO 27001 certificate still comes from an independent auditor or certification body.
- Can I bring existing compliance work into Sable?
- Yes. Add the controls you already run, link them to your frameworks and attach the evidence you have; upload your policies as they are and set review dates. You can set Sable up next to your current tool while you compare. The Switching to SubRosa page explains how to move from another provider.