# Sted > StedOS is a compliance platform by Sted (Intellassure Ltd). It determines which standards and > regulations apply to a business, using deterministic, auditable logic rather than a language model, > and then helps draft the documentation needed to meet them, grounded in a citable knowledge base. ## Key pages - [Homepage](https://sted.digital/): What StedOS is and who it is for. - [Documentation](https://sted.digital/docs): How StedOS works, what ISO 27001, GDPR, the EU AI Act and other standards ask of you, and step-by-step guides to the tasks auditors check. ## Docs sections - [Product](https://sted.digital/docs/product): How StedOS works, screen by screen: documents, records, tasks and readiness. - [Standards and regulations](https://sted.digital/docs/standards): What each standard asks of you, in plain English, from ISO 27001 to the EU AI Act. - [Sted compared](https://sted.digital/docs/compare): Sted beside the platforms, consultants and templates you might be weighing up, with every fact dated. - [Guides](https://sted.digital/docs/guides): How to do the work auditors check: risk assessments, internal audits, CAPAs and more. - [Glossary](https://sted.digital/docs/glossary): The jargon, translated. Each term defined in a paragraph. - [What’s new](https://sted.digital/docs/changelog): What changed in Sted each month, and where to find it. ## Standards and regulations - [Cyber Essentials](https://sted.digital/docs/standards/cyber-essentials): The UK government-backed scheme that certifies five basic technical security controls: who asks for it, the current edition, cost and how Plus differs. - [EU AI Act](https://sted.digital/docs/standards/eu-ai-act): The EU law on artificial intelligence: who it reaches, how it sorts systems by risk, what applies when, and who enforces it. - [EU MDR](https://sted.digital/docs/standards/eu-mdr): The law every medical device sold in the EU or Northern Ireland must meet: who it binds, how its chapters fit, and how a device reaches its CE mark. - [UK GDPR and EU GDPR](https://sted.digital/docs/standards/gdpr): The data protection law for personal data about people in the UK and the EU: who it binds, how it is organised, who enforces it, and where to start. - [IEC 62304](https://sted.digital/docs/standards/iec-62304): The life cycle standard for medical device software: safety classes A, B and C, the processes each class needs, and how conformity is assessed. - [IEC 62366-1](https://sted.digital/docs/standards/iec-62366-1): The usability engineering standard for medical devices: use specification, use errors, formative and summative evaluation, and how assessors check it. - [ISO 13485](https://sted.digital/docs/standards/iso-13485): The quality management standard for medical devices: who needs it, how its five requirement clauses are laid out, and how certification sits beside EU MDR. - [ISO 14971](https://sted.digital/docs/standards/iso-14971): The risk management standard for medical devices: how the process runs, how EU MDR and UK MDR 2002 rely on it, and why it has no certificate of its own. - [ISO 27001](https://sted.digital/docs/standards/iso-27001): The international standard for an information security management system: who asks for it, how it is structured, and how certification works. - [ISO 42001](https://sted.digital/docs/standards/iso-42001): The international standard for an AI management system: who asks for it, how its clauses and Annex A fit together, and how certification works. - [ISO 9001](https://sted.digital/docs/standards/iso-9001): The international quality management standard: who asks for it, what the 2026 edition changed, how its clauses fit and how certification works. - [SOC 2](https://sted.digital/docs/standards/soc-2): An AICPA attestation report in which a CPA firm gives an opinion on your controls. Who asks for one, how the criteria are organised, and how audits run. - [UK MDR 2002 and UKCA marking](https://sted.digital/docs/standards/uk-mdr-2002): How a medical device reaches the Great Britain market under the Medical Devices Regulations 2002, how long CE marks last, and the Northern Ireland rules. ## Guides - [How to run an access review](https://sted.digital/docs/guides/access-reviews): How to check who can reach each system, remove what is not needed and keep evidence auditors accept, under ISO 27001, SOC 2, Cyber Essentials and UK GDPR. - [Backup and restore testing](https://sted.digital/docs/guides/backup-and-restore-testing): How to prove your backups can be restored in time and intact, with the evidence ISO 27001, SOC 2 and UK GDPR auditors accept. - [Testing your business continuity plan](https://sted.digital/docs/guides/business-continuity-testing): Pick scenarios from your impact analysis, run tabletop or failover tests against recovery objectives, act on findings, for ISO 27001, SOC 2 and DORA. - [Root-cause analysis for a CAPA](https://sted.digital/docs/guides/capa-root-cause-analysis): How to find the cause that stops a nonconformity coming back, with ISO 13485 and ISO 27001 worked examples and an auditor's checklist. - [How to handle a subject access request](https://sted.digital/docs/guides/data-subject-access-requests): How to recognise, time, search, redact and answer a subject access request within the UK GDPR and EU GDPR deadlines, with the UK pause rules. - [Document control](https://sted.digital/docs/guides/document-control): Number, review, approve, publish, change and retire your policies and procedures the way ISO 9001, ISO 13485 and ISO 27001 auditors expect. - [How to carry out a DPIA](https://sted.digital/docs/guides/dpia): How to screen for, run and sign off a data protection impact assessment under UK GDPR and EU GDPR, with a worked example for an AI feature. - [Incident response and breach notification](https://sted.digital/docs/guides/incident-response-and-breach-notification): How to run an incident from first report to closure and decide within 72 hours whether to notify, under ISO 27001, GDPR, SOC 2, NIS2 and DORA. - [How to plan and run an internal audit](https://sted.digital/docs/guides/internal-audit): Build a risk-based audit programme, use impartial auditors, grade findings and act on them, for ISO 27001, ISO 9001, ISO 13485 and SOC 2. - [How to run a management review](https://sted.digital/docs/guides/management-review): Plan, prepare and minute a management review that ends in decisions, for ISO 27001, ISO 9001, ISO 13485 and ISO 42001, with an agenda and checklist. - [Adopting and rolling out policies](https://sted.digital/docs/guides/policy-adoption-and-rollout): Choose, review and approve your policies, then get the right people to read and acknowledge each version, as ISO 27001 and ISO 9001 expect. - [How to run a risk assessment](https://sted.digital/docs/guides/risk-assessment): Set criteria, find and score risks, choose treatments and get owners to accept what remains, for ISO 27001, ISO 9001, ISO 13485, ISO 42001 and UK GDPR. - [How to write a Statement of Applicability](https://sted.digital/docs/guides/statement-of-applicability): Turn your ISO 27001 or ISO 42001 risk treatment into an SoA row by row, with inclusion and exclusion reasons an auditor accepts and honest statuses. - [Supplier due diligence](https://sted.digital/docs/guides/supplier-due-diligence): How to tier, check, contract and re-review suppliers that touch your data or product, under ISO 27001, ISO 9001, ISO 13485, UK GDPR, SOC 2 and DORA. - [Building a training and awareness programme](https://sted.digital/docs/guides/training-and-awareness): How to work out who needs what training, deliver it, check it worked and keep records, for ISO 27001, ISO 9001, ISO 13485, UK GDPR and the EU AI Act. ## Notes - The application itself lives at https://sted.digital/stedos and requires a login; there is no public content there. - Every docs page has a raw Markdown twin: add `.md` to its address. The full text of every published docs page is in https://sted.digital/llms-full.txt. - Docs pages describe what Sted does; they are not evidence of what a standard or regulation requires.