LorvarisCompliance operating system
Sign up
Connect or answer

Every connector, and how each route is scored.

What Lorvaris reads, what it asks you, and what happens when you connect nothing at all.

Connectors

Bring whatever you already run.

Every connector is read-only, and each one maps to controls across all the standards you have added. Connect one, connect six, or connect none.

Identity, mail and cloud

Accounts, sign-in policy, admin roles, sharing and retention.

  • Microsoft 365
  • Entra ID
  • Intune
  • Google Workspace
  • Okta
  • AWS
  • Google Cloud

Endpoint, antivirus and EDR

Coverage, real-time protection, definitions, isolation and alerting.

  • Microsoft Defender
  • CrowdStrike Falcon
  • SentinelOne
  • Sophos
  • ESET
  • Bitdefender
  • Trend Micro
  • Jamf

Backup, patching and vulnerability

Job success, restore evidence, patch age and open findings.

  • Veeam
  • Datto
  • Acronis
  • Qualys
  • Tenable
  • Rapid7
Standalone

No connectors? Still a real score.

Plenty of customers start with nothing connected. You add your standards, answer the questions, attach the proof you already have, and Lorvaris gives you a dated position you can put in front of an auditor. Connect something later and those questions simply stop being asked.

  • CurrentAnswered controls36 answers · oldest 2 months
  • CurrentPoliciesv3 · published 12 Sep
  • CurrentEvidence files18 attached · 4 expiring
  • Not connectedConnected systemsNone · not required

Freshness is tracked the same way on both routes. An answer that has aged out is flagged exactly like a system we could not read — because a number for your board is only useful if it is true today.

Example tenant, shown with no connectors attached.

Features

Everything the auditor will ask for, already answered.

01

The part software can’t check.

Policies, staff training, backup tests. Lorvaris asks the question, records who answered and when it last happened, and counts the answer for a year from that date.

Do you test restoring from backup at least every three months?
YesNoNot applicable
When did you last do this?12 Sep 2026
restore-test-2026-09.pdfProof · 412 KB

Example data.

02

Old data is not a score.

If we haven’t been able to read part of your environment recently, or an answer your team gave has aged out, the controls that depend on it are marked Not assessed and the page says so. A number for your board is only useful if it’s true today.

Compliance score72%
CurrentMicrosoft 365Everything read
CurrentEntra IDEverything read
UnavailableIntuneData is 4 days old
UnavailableDevicesNot assessed
We couldn’t read your devicesA permission is missing. Your admin is told exactly which one and where to turn it on.

Example data.

The audit cycle

Lorvaris helps you before, during and after the audit.

One system for the whole cycle, not just the run-up to a certificate.

Example data.

Before the audit

See where you actually stand

Connect Microsoft, or answer the questions yourself. Lorvaris runs every check the standard asks for and shows what passes, what fails, and why.

Example data.

During the audit

Hand over the proof, not a spreadsheet

Export an evidence pack for any standard: every control, its status, the reason, the people who answered and the files they attached.

Example data.

After the audit

Fix it, and prove it stayed fixed

Raise an action against a failing control, give it an owner and a date, and Lorvaris closes it when the next check passes.

Audit memory

Perfect memory of what changed, and why.

Every score change, every answer, every exclusion is recorded with who did it and when. When the auditor asks “why did this drop in March?”, you already have the answer.

  1. ISO 27001 score 74% → 72%Weekly check · one admin account lost its multi-factor sign-in
  2. Exclusion added for an emergency admin account, review due 9 DecJ. Jose · Break-glass account
  3. “Do you test restoring from backup?” answered Yes, with proof attachedS. Patel · counts until 3 Oct 2026
  4. Rule updated: Security Administrator role now included in the admin checkLorvaris

Every customer you look after, in one place.

For MSPs. Switch between customers without switching tools. Each one has its own team, standards and proof. Your staff see all of them, and what is failing across the lot.

31Failing

Failing across 5 customers

Admins without multi-factor sign-in3 of 5 · Non-compliant
Old sign-in methods still allowed2 of 5 · Non-compliant
Devices not reporting in2 of 5 · Partially compliant

Example data.

Getting started

Three ways in. All of them end in a score.

Pick whichever matches what you have today. None of them lock out the others.

Start with Microsoft

One sign-in, read-only, and your first score in about three minutes. The fastest route if you are already on Microsoft 365.

Start with Microsoft

Connect something else

Tell us what you run. We will show you exactly which controls it would answer, and exactly what we would read, before you connect anything.

See what we read

Start with no connection

Add your standards and answer your way in. Connect a system whenever you are ready and those answers become automatic.

Start without connecting

Start where you are.

Connect Microsoft, connect something else, or answer your way in. All three end in a score you can put in front of an auditor.

Start with Microsoft Book a demo