Evidence by screenshot
Controls are proven with images pasted into a GRC tool, taken once a year.
Compliance that reads
the same evidence.
A control is satisfied or violated by findings on real entities, not by a screenshot. SecurityVault re-evaluates control status as scans complete, cross-walks it to every framework that shares the control, and gives auditors read-only, signed access to the evidence. SecurityVault maps your controls to frameworks; it holds no third-party certification of its own today.
14
Frameworks mapped
SOC 2, ISO 27001, NIST 800-53, NIST CSF, PCI DSS v4, HIPAA, GDPR, CCPA, CIS, NIS2, DORA, SOX, FedRAMP baseline, HECVAT.
5
Public cross-walks seeded
NIST 800-53 ↔ SOC 2, ISO 27001, PCI DSS, FedRAMP; NIS2 ↔ DORA.
Custom
Frameworks
Same control model, same cross-walk graph.
0
Certifications held by us
We map your controls. We do not attest to ours.
The problem
Why compliance programs still feel manual.
01
02
One framework at a time
The same control is re-evidenced for SOC 2, ISO and PCI because the tools do not know they overlap.
03
Auditors get platform access
Or a spreadsheet export. Neither is signed or scoped.
04
Regulatory change by newsletter
A framework revision becomes work when someone reads about it.
05
Vendors on a questionnaire
Third-party risk is a PDF exchange with no link to what the vendor actually touches.
06
Custom obligations left out
Internal standards and regulator letters never make it into the tool.
How SecurityVault does it
A control is a function of findings.
Map
Findings
violate_control and evidence satisfies controls. Fourteen frameworks ship mapped; custom frameworks use the same control types (preventive, detective, corrective, compensating) and evidence frequencies.Cross-walk
Pair-wise equivalence edges seeded from published crosswalks; the transitive closure is computed on demand so a control satisfied once lights up every equivalent.
Re-evaluate
The continuous-compliance engine enqueues re-evaluation runs as evidence changes, with idempotency keys and locked framework snapshots so two runs never disagree.
Sign
Control decisions are Ed25519-signed over a canonical payload; the audit log is HMAC-chained. Assurance bundles collect the evidence graph behind a control.
Auditor portal
Invitation-based, read-only access with its own key authority and signing; auditors see evidence, never the platform. Questionnaire responses (CAIQ, SIG, HECVAT) are generated from the same evidence.
Regulatory and vendors
Regulatory feed ingestion with impact assessment against your mapped controls; third-party risk with a vendor portal and scoring.
What it rests on
The platform underneath.
GRC
Frameworks, policies, issues
Policy acknowledgement, issue tracking, jurisdiction mapping.
Auditor portal
Signed read access
Invitations, credentials, key authority.
Trust center
Your own portal
Publish posture to customers.
Questionnaires
Auto-responder
CAIQ, SIG, HECVAT from evidence.
Regulatory
Feed and impact
Change becomes work items.
TPRM
Vendor portal
Scoring and evidence exchange.
See it on your stack
Pick one control. See the evidence behind it.
We walk from a framework control to the findings and scans that decide its status, then show what the auditor would see.