Automated posture runs
The posture job builds every framework per tenant and hands the reports to the compliance centre. No manual trigger required.
Compliance
Regulatory Frameworks
Fifteen frameworks mapped over one common control set of 118 controls in 14 domains. US, Canada, India and Europe sit side by side so one programme covers every regulator you answer to.
Frameworks
Frameworks we map
Controls mapped across these frameworks. Mapping supports your audits but it is not a certification.
Security and AI
- SOC 2
- ISO/IEC 27001
- ISO/IEC 42001
- NIST CSF 2.0
- NIST AI RMF
- PCI DSS
United States
- FDCPA and Reg F
- TCPA
- GLBA Safeguards Rule
- HIPAA Security Rule
- CCPA and CPRA
Canada
- PIPEDA
India
- DPDP Act
- CERT-In Directions
Europe and UK
- GDPR and UK GDPR
Common controls
The Common Control Framework
118 controls across 14 domains. Each framework requirement points at a control, so evidence collected once serves every audit.
Map requirements
Each framework's rules point to common controls. A single control may carry requirements from several frameworks.
Collect evidence
The platform writes its own evidence as agents run: approvals, guardrail results, the ledger and configuration records.
Cross-reference
A single control may satisfy SOC 2, ISO 27001 and NIST at once. One piece of evidence answers multiple auditors.
Report per framework
Export what each auditor needs from the same source. The evidence pack is tailored to the framework you are reporting against.
Continuous
Continuous posture
The platform runs posture checks automatically, catches regressions when they happen and tracks remediation to an owner and an SLA.
Quarterly snapshots
Signed per-framework snapshots capture your posture at a point in time, ready for board reporting or auditor handover.
Finding detection
Regressions are caught as they happen. When a control that was passing starts to fail, a finding is opened with a reason.
Remediation tracking
Each finding becomes a task with an owner and an SLA. Safe fixes run automatically. Record-only changes queue for approval.
What we do not claim
Spine maps controls and collects evidence. Certification is a decision for your auditor about your organisation.
See your frameworks on one screen.
Tell us which regulators you answer to. We will show the controls, evidence and gaps for that set.