ISMS CopilotISMS Copilot vs Claude Code: use both for compliance work
Use both. Keep Claude Code for code and orchestration, and connect the ISMS Copilot MCP server so Claude Code can consult a GRC specialist on compliance steps (policies, control mappings, SoA entries, gap analyses) and have that work checked before you sign. Compliance teams who do not work in a terminal use the ISMS Copilot web workspace directly.
Claude Code, one line, then /mcp to sign in
claude mcp add --scope user --transport http ismscopilot https://account.ismscopilot.com/v1/account/mcpGRC engineer? Keep Claude Code.
If you live in Claude Code or Cursor, you do not need to leave: keep the harness for orchestration, and add ISMS Copilot when the task becomes compliance. Account MCP runs on your existing chat subscription; the Model API uses prepaid credits on a separate product plane, with framework modules injected and disclosed per response. The web workspace, the Account MCP, and the Model API are three doors to the same specialist engine.
ISMS Copilot for GRC engineers →How the hand-off works
Add the ISMS Copilot MCP server to Claude Code with a personal access token from Settings, Connected apps. When a task reaches a compliance step, Claude Code opens an ISMS Copilot conversation, sends the question, and reads back the answer. The specialist's framework sources and working context stay on ISMS Copilot's side. Only your question and the answer or draft it returns pass through Claude Code's context, and that answer can itself quote framework text.
Connect ISMS Copilot to Claude Code →Claude Code alone vs Claude Code with ISMS Copilot
| Feature | Claude Code + ISMS Copilot | Claude Code alone |
|---|---|---|
| Who does what | Claude Code runs the task; ISMS Copilot answers the compliance step | One coding agent writes the code and the compliance text |
| Framework knowledge | Curated, versioned text for 140+ frameworks, including ISO 27001, SOC 2, NIS 2, DORA, and GDPR | General model knowledge; verify control numbers and versions yourself |
| Context between sessions | Your ISMS Copilot workspaces, memories, and company context, reachable over MCP | What lives in the repo, CLAUDE.md, and the session |
| Claude Code's own context | The specialist's framework sources and working context stay on ISMS Copilot's side; Claude Code reads the answer or draft | Framework text, working notes, and drafts all sit in Claude Code's context |
| Audit outputs | Structured gap analyses, control mappings, SoA entries, and policies | Free-form text you structure for the audit |
| Data handling | The compliance step can run under ISMS Copilot's optional Advanced Data Protection (AI only on Mistral AI in Frankfurt; off by default) | Anthropic's data terms for your Claude plan or API account |
| Billing | Your Claude plan or API usage, plus your ISMS Copilot chat plan (no separate agent plan) | Your Claude plan or Anthropic API usage |
What to ask ISMS Copilot from Claude Code
- Draft and refine audit-ready policies
- Run ISO 27001, SOC 2, NIS 2, DORA, GDPR, and multi-framework gap analyses
- Generate control mappings and Statement of Applicability content
- Ask which controls a change or a process touches
- Let your agent read your company context and save what it learns as memories
- Keep the specialist's framework sources and working context on ISMS Copilot's side
Not a terminal user? Use the web workspace
A compliance project spans days or weeks: you collect evidence, compare frameworks, revise policies, review risks, and prepare for audits. Compliance managers, consultants, and auditors who do not work in a terminal run that project in the ISMS Copilot web workspace, with uploaded files, per-client workspaces, and the same specialist engine. Engineers reach the same account from Claude Code over MCP.
More than the model
A coding agent brings the model and the orchestration. The compliance layer on top (framework-by-clause coverage, audit-ready output formats, sectoral regimes, and EU data handling options) is what turns model capability into finished ISMS work, and that is the part to consult on.
Frequently Asked Questions
Can I use Claude Code and ISMS Copilot together?
Yes, that is the setup this page recommends. Add the ISMS Copilot MCP server to Claude Code with one command and a personal access token, and Claude Code can open ISMS Copilot conversations, send compliance questions, and read the answers mid-task.
Is Claude Code bad for compliance work?
No. Claude Code is a strong agent for software work and for running multi-step tasks. What it lacks on its own is a curated, versioned framework source and a place where compliance context persists between sessions. Connecting ISMS Copilot adds both without leaving the terminal.
Does calling ISMS Copilot use my Claude usage?
Some. Claude Code still sends the question and reads the answer or draft it gets back, which can itself quote framework text. The specialist's framework sources and working context stay on ISMS Copilot's side. ISMS Copilot turns count against your ISMS Copilot chat plan.
Do I need a separate plan for agent access?
No. The Account MCP runs on your ISMS Copilot chat subscription and shares its usage window with the chat app. There is no separate agent plan.
Who is this page for?
GRC engineers and developers who work in Claude Code, and compliance teams deciding whether to run an ISMS from a coding agent. Engineers: keep Claude Code and connect ISMS Copilot. Compliance managers and auditors who do not use a terminal: use the web workspace.
Ready to do compliance work faster?
Built for speed, accuracy, and audit-ready output.