Set policy, manage risk, and prove compliance from one connected model. Map a control once and satisfy every framework — and see the gaps before your auditor does. Built for ISO 27001, NIST CSF 2.0, and SOC 2, not for vendor checkboxes.
People, process, and technology. Most platforms ship the technology and leave you the other two. We make all three measurable inside one platform — so the methodology is the product, not a slide.
Six GRC roles out of the box — risk manager, control owner, auditor, compliance officer. Permissions map to how your team divides the work.
Planned and event-driven assessments with capacity-aware annual planning. Evidence requests, reminders, and sign-off without the spreadsheet relay.
Map a control once; satisfy ISO 27001, NIST CSF 2.0, and SOC 2 together. Change a control, watch coverage recompute across all of them.
Governance, risk, and compliance most tools split across separate modules — unified under one connected model, so a policy sets a control, a control closes a risk, and the same evidence feeds the audit.
Inherent and residual scoring, heatmaps, treatment plans.
R-001 … R-240Map one control to every framework it satisfies, at once.
ISO · NIST · SOC 2Engagements, working papers, findings, and follow-up.
planned + event-drivenCapture, triage, and link incidents to the risks they prove.
SEV-1 … SEV-4Tie coverage to residual risk so the gap is the policy line.
cover ↔ residualThe register of what you are actually protecting, scored.
CIA-ratedObligations and DPAs surfaced as controls, with renewals.
DPA · SLA · renewalThe workflows that carry it all, owned and measurable.
owned · timed| ID | Risk | Severity | Mapped control | Effectiveness | Owner |
|---|---|---|---|---|---|
| R-042 | Unencrypted PII in legacy data lake | CRITICAL | ISO-A.8.24 | 41% | S. Okafor |
| R-017 | No MFA on privileged admin accounts | HIGH | ISO-A.5.17 | 63% | M. Chen |
| R-091 | Vendor offboarding lacks access revocation | HIGH | ISO-A.5.19 | 58% | J. Patel |
| R-008 | Incident response plan untested in 14 mo | MEDIUM | ISO-A.5.24 | 71% | R. Adeyemi |
| R-103 | Backup restore not verified quarterly | MEDIUM | ISO-A.8.13 | 77% | L. Novak |
| R-055 | Physical media disposal logging gaps | LOW | ISO-A.7.10 | 88% | D. Rossi |
Field notes from people who have sat on both sides of the audit table — methodology, opinions, and practical framework crosswalks.
If nobody reads it between audits, it is not a control — it is a liability. Three ways to make the register a living document.
7 min read · by S. VisserFeature-grid procurement is how you end up with eleven modules and no coverage. Buy the model, not the menu.
5 min read · by M. ChenThe overlap is bigger than vendors admit. A practical crosswalk you can run in an afternoon.
9 min read · by J. PatelNo deck. We load a framework, map a control to a policy and a risk live, and show you the gaps. Free, no obligation.