Your tools got you through the audit.Fettle keeps you compliant the other 360 days.

Compliance management software keeps an organization's ongoing obligations current between audits: employee certifications, training records, licenses, recurring reviews, controlled documents, expiration dates, and the evidence behind each one. Fettle automates expiration alerts, tracks recurring reviews on their cadence, holds signed controlled documents, and preserves a dated record you can report on later.

Fettle maps your reviews and documents to CMMC Levels 1, 2, and 3, NIST SP 800-171 Revision 2, ISO/IEC 27001:2022, ISO 9001:2015, and custom frameworks you define. Coverage is reported per control family down to 800-171A assessment objectives. Fettle shows whether a control has a real artifact behind it — a review, a document, an evidence file — and never asserts that a control passes. That judgement belongs to your assessor.

No. Fettle does not author a System Security Plan, manage a POA&M, or calculate and submit a SPRS score, and it does not run automated technical control testing. It is the evidence and personnel layer that sits underneath those tools: the record of who holds what credential, which reviews are on cadence, which documents are signed and current, and what all of that looked like on any given date.

No. Fettle is not FedRAMP authorized and does not accept Controlled Unclassified Information. That boundary is deliberate. What Fettle holds is the compliance record itself — training completions, credential dates, signed procedures, review cycles, and coverage — which is almost never CUI. Your CUI stays in the enclave you built for it.

Fettle continuously monitors expiration dates and automatically notifies employees and administrators as certifications approach expiration. Organizations choose how far in advance notifications begin, how frequently reminders are sent, and which roles receive them. Notifications send through Fettle's platform email by default, so there is no mail server to configure before alerts start working.

A controlled document is a published PDF — your policy, SOP, or form — with signature and data fields placed on it. Approvers sign in-product, and the approved version is stored immutably and rendered exactly as approved. Every fill-out is pinned to the template version it was completed on, so a signed record can never be silently altered by a later revision. Registers add tables whose columns lock once the cover sheet is signed while rows stay open for new entries.

Yes, and it is one of the main reasons teams adopt Fettle. Compliance status is preserved historically, so you can report on any date range — the day of a contract award, a proposal submission, an inspection, or an annual affirmation — rather than reconstructing it from memory. An immutable audit log records who changed what and when.

Yes. Employees upload updated certifications and supporting documents and propose issue dates; supervisors review and approve records before they count toward compliance. Uploading and attesting stay separate, which distributes the work while keeping administrators in control.

Yes. Fettle imports Excel spreadsheets with automatic field detection for employee names, email addresses, certification names, issue dates, and expiration dates, then shows an editable grid mirroring your sheet so you can correct anything before it lands.

Your records leave with you, in formats that open without Fettle. While you are a customer, any admin can download a full evidence archive from Settings: every certificate and review evidence file, organized and dated, with a manifest and a SHA-256 for each file. When you cancel, every admin is emailed a secure link, valid for 30 days and reusable, to a complete export package: your compliance report and Master Certification List as CSV, every certificate document by person, and your whole controlled-document library in the same folders you used in the app. Published documents come with their approval signatures burned in, registers as Excel, completed records as signed PDFs, every superseded version, and the Word source wherever you attached one, so you can keep revising. A manifest records who signed what and when. There is no exit fee and no request to file.

Defense and government contractors carrying CMMC, NIST 800-171, or ISO obligations alongside a real workforce-training burden; security companies tracking licenses and qualifications; construction and staffing firms managing safety certifications; and the compliance managers, operations teams, and quality leads responsible for keeping all of it current.