Frameworks
Each framework is a static catalog of controls, checked into this platform's code rather than fetched from a live database. 220 controls today, across the 6 frameworks below.
| Framework | Version | Controls | Scope |
|---|---|---|---|
| ISO 27001 | ISO/IEC 27001:2022 Annex A | 93 | All 93 Annex A controls across its 4 themes: Organizational (37), People (8), Physical (14), Technological (34). |
| SOC 2 | AICPA 2017 Trust Services Criteria, 2022 points-of-focus update | 61 | Security (the only mandatory category) plus the 4 opt-in categories: Availability, Processing Integrity, Confidentiality, and Privacy. |
| GDPR | Regulation (EU) 2016/679 | 19 | Scoped to Articles 28, 30, 32, and 35, the obligations this platform's own product and its role as a processor touch, not the full regulation. |
| DORA | Regulation (EU) 2022/2554 | 25 | The 5 pillars: ICT risk management, incident reporting, resilience testing, third-party risk, and information sharing. |
| NIS2 | Directive (EU) 2022/2555 | 19 | Governance, risk-management measures, and incident reporting. |
| EU AI Act | Regulation (EU) 2024/1689 | 3 | Article 50 transparency obligations for an organization building its own AI systems. |
Automation mode
Every control in every catalog carries one of three labels: deterministic (a real check in this platform can evidence it directly), agentic-assisted (the sandboxed browser fallback can gather evidence for it), or human-judgment (a governance, policy, or risk-assessment activity no screenshot or API call substitutes for). Most Organizational, People, and Physical controls across every framework are human-judgment. Technological and infrastructure controls are the ones marked deterministic or agentic-assisted.
How coverage is computed
A control shows as covered on the Frameworks page when at least one of this platform's controlId checks maps to it, and that check has a passing evidence record. A small number of controls per framework map to a real check today. The rest are labeled deterministic or agentic-assisted with no check built for them yet, or human-judgment, which this catalog states as an empty mapping rather than inventing one.