Evidence by screenshot
Controls are proven with images pasted into a GRC tool, taken once a year.
Compliance evidence
that stays with the work.
Connect controls, findings and remediation to a continuous compliance record. Give security teams and auditors the context behind each decision.
Control review
Framework requirement
Mapped control
Supporting record
Investigation context
01 / Map
Start with the requirement.
- Framework reference
- Control mapping
Connect a framework requirement to the controls used to assess it.
02 / Review evidence
Open the record behind the control.
- Evidence source
- Coverage gap
Inspect supporting evidence and keep gaps distinguishable from passing checks.
03 / Prepare review
Give the reviewer a traceable record.
- Control status
- Review trail
Carry the requirement, control and evidence relationship into the audit discussion.
6
Frameworks seeded
SOC 2, ISO 27001, PCI DSS v4, HIPAA, GDPR and CIS Controls. NIST 800-53, NIS2, DORA and FedRAMP have selected preview mappings, not complete catalogues. See the full framework list.
37
Cross-walk edges seeded
Across 7 framework pairs, bridged through NIST 800-53.
Custom
Frameworks
Same control model, same cross-walk graph.
Read-only
Auditor portal
Signed access to the evidence behind each control.
The problem
Why does compliance still feel manual?
Engineering already produces the evidence every day, in scans, builds and cloud APIs. The compliance programme rarely reads it.
01
02
One framework at a time
The same control is re-evidenced for SOC 2, ISO and PCI because the tools do not know they overlap.
03
Auditors get platform access
Or a spreadsheet export. Neither is signed or scoped.
04
Regulatory change by newsletter
A framework revision becomes work when someone reads about it.
05
Vendors on a questionnaire
Third-party risk is a PDF exchange with no link to what the vendor actually touches.
06
Custom obligations left out
Internal standards and regulator letters never make it into the tool.
How SecurityVault does it
How does SecurityVault evaluate a control?
A control is a function of findings on one graph that runs from code to image to cloud, re-evaluated as evidence changes.
Map
Findings violate controls and evidence satisfies them. Evidence from the repository (SAST, SCA, secrets), the image (SBOM, provenance) and the cloud (CSPM and CIEM posture) all lands on the same control. 6 frameworks ship with seeded catalogues; custom frameworks use the same control types (preventive, detective, corrective, compensating) and evidence frequencies.
Cross-walk
Mappings identify related controls and opportunities to reuse evidence. Reviewers must assess whether that evidence is sufficient for each requirement; a linked control does not automatically establish compliance with another framework. See cross-walk.
Re-evaluate
The continuous-compliance engine re-evaluates affected controls as evidence changes, and repeated runs over the same evidence reach the same result.
Sign
Control decisions are digitally signed over a canonical payload, and the audit log is hash-chained. Assurance bundles collect the evidence graph behind a control.
Auditor portal
Invitation-based, read-only access with signed evidence; auditors see evidence, never the platform. Questionnaire responses (CAIQ, SIG, HECVAT) are generated from the same evidence.
Regulatory and vendors
Regulatory feed ingestion with impact assessment against your mapped controls, and third-party risk management with a vendor portal and scoring.
Outcomes
What do GRC teams and auditors get?
GRC
Evidence collected once
One finding updates every control that depends on it, across frameworks.
Auditors
Signed read access
Scoped invitations, verifiable control decisions, no console accounts.
Customers
Your own trust centre
Publish your security posture to your customers.
Questionnaires
Answers from evidence
CAIQ, SIG and HECVAT responses drafted from the same records.
Regulatory
Change becomes work
Framework revisions arrive as work items against your mapped controls.
Vendors
Third-party risk in context
A vendor portal with scoring and evidence exchange.
Questions auditors and CISOs ask
Continuous compliance questions
- What is continuous compliance automation?
- Control status computed from evidence the platform observes as scans complete, instead of screenshots collected before an audit. In SecurityVault a finding violates a control and typed evidence satisfies it, so status changes the moment the evidence does. See the glossary entry.
- Which frameworks are mapped?
- 6 have seeded catalogues: SOC 2, ISO 27001, PCI DSS v4, HIPAA, GDPR and CIS Controls v8. NIST 800-53, NIS2, DORA and FedRAMP have selected preview mappings. HECVAT has a questionnaire template. NIST CSF, CCPA/CPRA and SOX ITGC require customer-defined controls. Review versions and coverage on the framework list.
- How do cross-walks work?
- 37 mapping links connect 7 framework pairs. They help reviewers identify related requirements and reusable evidence. Scope, implementation and evidence sufficiency still need review for each control. Read framework cross-walks: one evidence chain for every audit.
- What does an auditor actually receive?
- A portal invitation with its own credentials, scoped read access to the controls in the engagement, evidence records with hashes, and the means to verify digitally signed control decisions. Auditors never get console access.
- Does SecurityVault make us SOC 2 compliant?
- No tool can. SecurityVault helps you prepare for a SOC 2 audit by collecting evidence continuously and mapping it to your controls; the attestation comes from your auditor. Read how to automate SOC 2 evidence collection.
- Can we keep our GRC platform?
- Yes. SecurityVault is the evidence and control-evaluation layer; export to your GRC system through the API or SIEM connectors.
Related: compliance frameworks and cross-walks · cloud security posture management · policy-as-code deployment gates · security and compliance by industry · SecurityVault for GRC and audit · SecurityVault for CISOs.
From the blog
Further reading on continuous compliance
- Audit evidence sampling: account for the missing recordsBuild a reviewable audit evidence sample by defining its population, explaining exclusions and reconciling missing records before drawing conclusions.
- Audit evidence freshness: review what still holdsAssess audit evidence freshness using collection scope, change events and accountable review, so an old successful check does not imply current assurance.
- How to automate SOC 2 evidence collection from your pipelineAutomate SOC 2 evidence collection from CI pipelines, cloud accounts and triage decisions, so Type II sampling becomes a query instead of a hunt.
- Continuous compliance: live evidence, not screenshot foldersContinuous compliance re-evaluates control status from scan evidence, so audit preparation becomes a review of signed records, not a screenshot hunt.
See it on your stack
Pick one control. See the evidence behind it.
We walk from a framework control to the findings and scans that decide its status, then show what the auditor would see.