GRC & compliance automation

Compliance that maps itself.

Lavawall® reads your real posture and maps it to over 160 frameworks at once, generates the policies auditors expect, and collects evidence continuously, so "the auditor is asking" turns into a live compliance score instead of a lost weekend.

Start with the GRC WizardUnder a deadline?

Over 160 frameworks · generated policies · continuous evidence · PCI ASV

▶Watch the GRC walkthroughVideo coming soon

See it in the Lavawall® console

Real screens, shown with example data.

The Compliance Dashboard page in the Lavawall console, showing the summary tiles, risk and check tiles, next best actions and operating profile, with example data.
Compliance Dashboard. Use it to see what is behind a number, set your operating profile, and start new work from the dashboard. How to use the Compliance Dashboard page
The Compliance Wizard page in the Lavawall console, showing the step indicator, tell us about your organization, your applicable frameworks and gap analysis, with example data.
Compliance Wizard. Use it to find the frameworks that apply to you, run the gap analysis, and generate your first policies. How to use the Compliance Wizard page
The Compliance Assessments page, with Start Unified Assessment above a searchable list of framework assessments.
Compliance Assessments. Answer each control question once in a unified assessment and it counts for every framework you follow. How to use the Compliance Assessments page
The PRIV-001 Privacy Impact Assessment control, tagged with the PPCDA, NIST SP 800-53, NIST CSF and PIPEDA requirements it meets, and the wording of each requirement. The NIST CSF line is marked as supporting, not required.
Control Detail. Each control lists the requirement it meets in every framework you follow, in that framework's own words. How to use the Control Detail page

Does this sound like you?

Most organizations don't have one compliance obligation. They have a combination: a control framework or two, one or more privacy laws, and the rules for what they do. Here are a few, and yours will look different. That is the point, because almost nobody has just one.

A 12-person health-tech startup in BC

BC PIPA and PIPEDA for privacy; the BC E-Health Act if it touches a health information bank; PCI DSS for card payments; SOC 2 the moment a health authority asks; two breach clocks.

Six instruments, before twenty staff.

A Calgary accounting firm

Alberta PIPA and PIPEDA for client information; the CPA Canada cybersecurity expectations; FINTRAC when it handles client funds; SOC 2 if it runs any client-facing technology.

Five instruments.

A city of 40,000 in Iowa

The FBI CJIS Security Policy for policing; HIPAA once fire and EMS bill electronically; PCI DSS for utility and parking payments; AWIA for the water system; Iowa chapters 22, 21, and 715C; ADA Title II.

Eight instruments.

An Ontario medical-device company

PIPEDA, Ontario PHIPA, and HIPAA for privacy; FDA section 524B, Health Canada's guidance, and the lifecycle standards for device cybersecurity; SOC 2 or ISO 27001 for hospital IT.

Seven instruments (its quality system is a separate program).

A regulated investment broker in BC

BCFSA, CIRO cyber expectations, and CSA Staff Notice 33-322 from the sector regulators; FINTRAC for financial crime; BC PIPA and PIPEDA for privacy; SOC 2 if it runs client-facing technology.

Seven instruments.

A US SaaS company chasing enterprise deals

SOC 2 and often ISO 27001 for the sales cycle; CCPA and the growing list of US state privacy laws; the HIPAA Security Rule if a customer is in health care; PCI DSS if it takes payments.

Four to six instruments, climbing with each new state.

A US healthcare clinic

The HIPAA Security Rule and HITECH for patient data; state breach-notification laws; PCI DSS for co-pays and billing; and a business-associate agreement with every vendor that touches PHI.

Five instruments.

An MSP with forty clients

Every one of the above, times a book of business: a city, a clinic, a broker, and a manufacturer, each with a different obligation set, run from one console with per-tenant isolation and billing.

One platform, multi-tenant.

Not on this list? If you keep more than one framework, privacy law, or industry rule, whether you are an MSP running forty of these at once or a single business holding your own, you are exactly who Lavawall® is for. The question is never how big you are; it is how many obligations you carry.

From posture to proof

Map once, satisfy many

One control you turn on typically satisfies requirements across SOC 2, CIS, NIST, HIPAA, and more at the same time. Compliance Wizard, assessments, and onboarding guide the way.

Policies & documents, generated

Policies, procedures, and a system description are generated and kept current, not copied from a stale template you'll have to defend.

Continuous, timestamped evidence

Patch logs, MFA status, access reviews, encryption state, and backup records are captured automatically, plus integrated PCI ASV scanning.

A live score and gap list

See exactly which controls are open and how to close them, prioritized, per framework, across every tenant.

SOC 2 note: a SOC 2 report is issued only by a licensed CPA firm. Lavawall/ThreeShield gets you audit-ready and works alongside your CPA auditor.

the live compliance score & gaps

The frameworks you need

When a client's questionnaire names a framework, it's already mapped.

A prospect asks for your SOC 2. An insurer wants CMMC 2.0. A hospital needs HIPAA and your Alberta clinic needs the AB HIA. Instead of starting each one from a blank page, Lavawall® maps your real posture to every framework at once, so the control you already turned on counts everywhere it applies.

Frameworks, standards, and regulations Lavawall® maps and evidences include:

The GRC Wizard showing which frameworks apply to your business and which it recommends

Security & governance

Privacy

Payment card

Energy & critical infrastructure

Government & public sector

Healthcare

AI governance

Financial services

One turned-on control typically satisfies requirements across several of these at once. New frameworks are added regularly, and ThreeShield's CISSP/CISA team can scope any of them with you.

Open the full categorized framework directory →

Map my frameworks freeUnder a deadline?

One wizard. Your whole compliance program.

The GRC Wizard asks about your business in plain language, takes your industry and compliance requirements into account, and does the heavy lifting for you.

Built from the data you already collect

The wizard reads the security and IT data Lavawall® already gathers about your environment, so you are not re-entering what the platform can already see.

Policies and action plans, generated

It auto-generates the policies auditors expect and the action plans that tell you what to do next, matched to your industry and the frameworks you need to meet.

Plain language, start to finish

No jargon and no blank templates. Answer a few questions and the wizard turns your requirements into a working compliance program you can hand to an insurer, a client, or an auditor.

Start with the GRC Wizard →

The GRC Wizard asking about your business in plain language

The GRC & Resilience suite

The wizard builds on a full set of resilience tools, each one plain language, each one fed by the security and IT data you already collect.

Business Impact Assessment

Work out which systems and processes matter most, and what it costs you when they stop, in plain language.

Learn more →

Vendor Inventory

Keep a living list of the vendors and tools you rely on, so you know who touches your data and where your risk sits.

Learn more →

Continuity & incident plans

Generate the business-continuity and incident-response plans you need before something goes wrong, and keep them current.

Learn more →

Stakeholder questionnaires

Send and track the security and privacy questionnaires clients, insurers, and partners ask you to fill in.

Learn more →

Trust Centre

Give clients and prospects a single page that shows your security posture, so you answer the same questions once.

Learn more →

AI governance

Set the guardrails and policies for how your team uses AI, and show that you have them in place.

Learn more →

Industry policy packs

Ready-made privacy, acceptable-use, AI, and client-consent documents for your industry, in Canadian and US variants.

Learn more →

Controls that test themselves

Most GRC tools hand you a list of controls and ask you to attest to each one by hand, over and over. Lavawall works the other way around. It reads the live configuration and the user issues it already sees across Microsoft 365, Google Workspace, macOS, Windows, Linux, and more, and fills in the matching controls for you. A misconfiguration or a risky user setting raises an alert and also updates the control it maps to.

The result is evidence that is collected from the system that runs the control, not typed into a questionnaire and hoped to be true. When the posture changes, the control changes with it, so what an auditor sees is what is actually in place today.

An incident response plan that knows every deadline

When something goes wrong, the hard part is often knowing who has to be told, and by when. Visa wants to hear within three calendar days, American Express within 72 hours, NYDFS within 72 hours of determining an incident occurred, a NIS2 entity within 24 hours, and a DORA financial entity within four hours of classifying an incident as major. Each clock starts from a different moment.

Lavawall's plan builder asks a few questions, then writes a plan with every reporting deadline and contact for the rules you follow: PCI DSS and the card brands, PIPEDA and the proposed PPCDA, Quebec Law 25, NIS2, DORA, the GDPR, the FTC Safeguards Rule, NYDFS, CIRO, the Canadian Securities Administrators, CJIS, NERC CIP-008, TSA pipeline directives, HIPAA, Iowa, IRS Publication 1075, and more. Each deadline is checked against the regulator's or card brand's own text and names its source.

When an incident happens, record it and the reporting clocks start counting down from the times you enter. Mark each report filed as you go, and keep a timeline that shows what was known and when. Tabletop exercise guides built from your plan help your team rehearse, and each exercise you record counts toward the yearly testing most of these rules require.

See how incident response works

Bring your own auditor

An audit gets slow and expensive when the auditor works at arm's length, asking for screenshots and waiting on emailed evidence. Lavawall gives your external auditor a direct, controlled way in: they access the GRC, review the controls and the evidence behind them, evaluate your posture, and sign off, all inside the same system. Less back and forth, a shorter engagement, and a lower bill.

You are not locked to one firm, either. Bring the auditor you already trust, or have ThreeShield's CISSP- and CISA-credentialled team run the examination with you. See how Lavawall compares as a GRC audit tool.

The documents Lavawall writes for you

Lavawall® uses data you already have, led by your Business Impact Assessment, and writes each of these in plain language, auto-filled from your records rather than typed from a blank page.

  • Incident Response Plan · who to tell and by when, with your contacts, acquirer and regulator deadlines, and playbooks for the services you use filled in for you, and live reporting clocks during an incident.
  • Disaster Recovery Plan · recovery priorities, backup expectations, and restore order, auto-filled from your BIA recovery targets.
  • Business Continuity Plan · the umbrella policy that keeps the business running and ties the other two plans together.
  • Foreign Processing Disclosure · a Canadian outside-Canada privacy disclosure, built from the services that move your data across the border.
  • Data Flow Documentation · what information moves between your systems and how, mapped from the apps Lavawall detects.
  • Privacy Policy addendum · your service providers, AI use, and international processing, written into one addendum.
  • Industry Privacy Policy packs · ready-made privacy documents matched to your industry, in Canadian and US variants.

Want the audit run with you?

ThreeShield, the CISSP/CISA team that builds Lavawall®, scopes the framework, operationalizes controls, and prepares you so the examination is fast and predictable.

Book my free consultation

Pricing, published

Almost nobody in this category publishes a number. Here is ours, beside how the rest of the category answers the question.

Lavawall® Complete

$89.50 /seat/year

Annual, two months free. A seat is the greater of your managed devices or your Microsoft 365 / Google Workspace licensed users, never both.

Starts at $2,237.50/year for the first 25 seats, and every compliance framework in the catalogue is included, along with the business-continuity module, your policies, and a Trust Centre.

No per-framework fee: the whole catalogue is in Complete. Volume discounts start at 51 seats.

The rest of the category

Quote only / book a call

Most GRC platforms publish no public price; you request a quote to find out. Lavawall lists its number here and on the pricing page.

A published number is the first thing a buyer can check.

Volume discount, by seat

1–50 seatslist price
51–250 seats5% off
251–1,000 seats10% off
1,001–5,000 seats15% off
5,001+ seats20% off

A few scenarios

OrganizationAssumptionsLavawall / year
20-person BC health-tech 25 seats (the minimum), every framework it needs included $2,237.50
50-person services firm 50 seats, every framework included $4,475
250-seat organization 250 seats at the 5% volume tier, every framework included $21,256.25

Lavawall®’s number is on this page and on the pricing page; most of the category makes you ask for it.

For most of these buyers, though, the real alternative to Lavawall is not another compliance platform at all. It is a consultant at $15,000 to $40,000 and a spreadsheet, repeated every year, with nothing left behind between engagements. See the full pricing page for the calculator.

Common questions

Who is Lavawall GRC for?
Any organization whose compliance is a combination rather than a single framework: a health-tech startup, an accounting firm, a municipality, a medical-device manufacturer, an investment broker, or an MSP running all of these for its clients. The common thread is carrying more than one framework, privacy law, or industry rule at once.
Is Lavawall only for MSPs?
No. Lavawall is multi-tenant, so an MSP can run a whole book of clients from one console, and it works the same way for a single organization holding several obligations of its own.
Which frameworks are supported?
Over 160, including CIS v8.1, NIST CSF 2.0, NIST 800-171, SOC 2, HIPAA, PCI DSS (all SAQs), ISO 27001:2022, CMMC 2.0, Canada's CPCSC, PIPEDA, Alberta/BC health & privacy acts, Quebec Law 25, CPA Canada, OSFI, IIROC/CIRO, EU GDPR/NIS2/DORA, UK Cyber Essentials, and Australia's Essential Eight.
Can Lavawall issue our SOC 2 report?
No. Only a licensed CPA firm can. Lavawall gets you audit-ready and works alongside your auditor.
Do you include PCI ASV scanning?
Yes. Lavawall integrates Clone Systems PCI ASV scanning, with missed-scan notifications and report inclusion.

Start with the GRC WizardStart my free trial

We use privacy-friendly, cookieless analytics to count visits, and one cookie to run our live chat. Both load only if you accept. We do not use advertising trackers, and we do not profile you across other websites. The essential cookies that keep the site working are always on. See our privacy policy.