One control set, every framework it answers
Controls, policies and documents in one place, each mapped to the obligations it satisfies across every framework you carry.
Request a call →Early access · work email only
Controls, policies and documents in one place
Evidence
What proves each control, and how far each one is from collecting itself.
112
Satisfied and current
11
Failing collection
23
Expiring within 30 days
22
Never collected
68 of 168 collect themselves
A hundred need a person every cycle. Twenty-two of those could stop needing one today — you already run on AWS.
All168Automatic68Assisted24Manual76
Search evidenceFrameworkStatusSourceOwnerAdd evidence
EvidenceCollectionStatusBlockingPersonnelSoonest first
- EV-041Encryption at restCloud infrastructure · CryptographyAWS · APIFailing2 of 12 databasesPCI DSS · 31 daysCloud teamView
- EV-033Container encryption settingsEngineering · CryptographyManual · ScreenshotNever collectedNo record existsPCI DSS · 31 daysUnassignedUpload
- EV-052Backup retention configurationCloud infrastructure · ResilienceAWS · ScreenshotPartial3 of 5 capturedISO 27001 · 24 daysA. FathyCapture
- EV-002Network architecture diagramGRC · Scoping · RegisterManual by nature · RegisterNeeds review3 of 5 checksISO 27001 · 24 daysGRC teamView
- EV-061TLS versionCloud infrastructure · NetworkAWS · APIFailing1 of 4 balancersNot blockingCloud teamView
- EV-007Security committee minutesGRC · Governance · QuarterlyManual by nature · RecordGap foundQ2 quorum sign-offNot blockingGRC teamUpload
- EV-018Quarterly access review exportHuman resources · Access reviewsWebhook · CustomCollectedCurrentNot blockingHR teamView
1–7 of 168Sweep #84 completed 29 Aug · next 28 Sept
A control is not a row in a spreadsheet: it carries the policy text that answers it, the evidence that proves it and the frameworks it satisfies. Change one and the others follow.
Works with PCI DSS v4.0ISO 27001CBEAgentEvidence
Compliance FAQ
- How is a control’s state decided?
- It is derived from the evidence that exists, not set by hand. A control with no current proof cannot read as compliant.
- Does one control really answer several frameworks?
- Yes. The same control is mapped to every obligation it satisfies, so evidence collected once counts everywhere it applies.