Documents + Workspaces

The documents define the rules.
The workspace shows they are followed.

AltShift sells two kinds of product. Document systems are editable Word and Excel files: the policies, procedures and registers a regulation expects you to have. GRC Workspaces are Notion databases where your team runs that programme day to day. This page explains how they connect, and when you need one, the other, or both.

How they connect
1

The documents set the rule

The gap assessment says what is missing. The policies and procedures say what must happen, who does it and how fast. The registers say what must be recorded.

2

The workspace records the practice

Each requirement, control, risk, incident and vendor becomes a linked record. A requirement with no control stays visible as a gap until someone closes it.

3

The evidence returns to the documents

At each review, what the workspace shows — incidents handled, findings closed, vendors reassessed — is what you use to update the policies and registers for the next cycle.

The connection is by design, not by software: you enter in the workspace what the documents specify. There is no automated import between the two.

Which one do you need

Only the documents

You need the policy set and registers, and you already track operations somewhere — a ticketing system, an existing GRC tool, or a consultant who runs it with you.

Only the workspace

Your policies and procedures already exist and are approved. What is missing is one place where requirements, controls, incidents and vendors are linked and visible.

Both

You are starting from zero, or the programme lives in scattered spreadsheets. The documents give you the content; the workspace gives it a place to run.

EU Compliance Workspace

Covers DORA, NIS2 and the EU AI Act. The rows below show where each document system lands in it.

DORA Complete System Workspace database What it becomes
Compliance Gap Assessment Compliance Requirements Each gap becomes a requirement record. Requirements with no linked control surface in the Gaps Only view.
ICT Risk Assessment Framework Risk Register Assessed ICT risks, scored likelihood × impact and linked to the controls that mitigate them.
Incident Classification · Authority Reporting Procedure Incident Register Every incident logged against the 4-hour, 72-hour and one-month reporting fields.
Register of Information · Third-Party Risk Assessment Vendor Risk Register ICT providers tracked one by one, with their Article 30 contractual status.
Audit & Supervisory Readiness Pack Audit Readiness findings recorded against the controls they assess.
ICT Risk Management Policy and other policies Policy Library Approved policies linked to the requirements they evidence.
NIS2 Complete System Workspace database What it becomes
Compliance Gap Assessment Compliance Requirements Each Art. 21 gap becomes a requirement record, visible until a control closes it.
Security Risk Assessment Framework Risk Register Cybersecurity risks scored and linked to the measures that treat them.
Incident Classification · Authority Reporting Procedure Incident Register Every significant incident logged against the 24-hour and 72-hour notification timelines.
Supply Chain & Vendor Due Diligence Pack Vendor Risk Register Direct suppliers assessed and tracked under Art. 21(2)(d).
Internal Audit & Evidence Pack Audit Effectiveness findings recorded against the controls they test.
Security, supply chain, access and cryptography policies Policy Library Approved policies linked to the requirements they evidence.
US Compliance Workspace

Covers SOC 2, HIPAA, NIST CSF and AI governance. The rows below show where each document system lands in it.

SOC 2 Complete System Workspace database What it becomes
Control Matrix Controls Catalogue Your control set becomes the hub every other register links to — already mapped to TSC, NIST CSF 2.0 and HIPAA.
Evidence Tracker SOC 2 Evidence Repository Evidence collected per control across the audit period, ready for the auditor's requests.
Risk Register Risk Register Risks scored and linked to the controls that mitigate them.
Vendor Inventory · Vendor & Third-Party Risk Vendor Risk Register Subservice organisations and vendors tracked, including BAA status.
Incident Response Plan Incident Register Incidents logged and linked to the controls they tested.
PHI Data Handling Procedure HIPAA PHI Data Register Where protected health information lives, who handles it, and under which safeguards.

Where the two do not overlap

The workspaces cover more than the document systems: the EU Workspace also tracks the EU AI Act, and the US Workspace also covers NIST CSF, privacy and AI governance. The Global Workspace has no document-system counterpart today. Buying one never obliges you to buy the other, and there is no combined price.

Single-entity licence Instant download Tax invoice via Gumroad No subscription Refund policy Editable Word & Excel formats

Notion is a trademark of Notion Labs, Inc. SOC 2 is a service mark of the American Institute of Certified Public Accountants. AltShift is not affiliated with or endorsed by either.