1. One review, every framework
Until today, a team running both SOC 2 and ISO 27001 collected the same evidence twice, because the two frameworks name the same control differently. The continuous compliance engine maps an artifact once and answers both.
2. How the mapping works
Every artifact that lands in the evidence vault is parsed for the controls it demonstrates, then attached to each framework that recognises them. NIST 800-53, ISO 27001 and GDPR Article 28 all read the same underlying record, so a gap closes everywhere at once.
- Upload or auto-fetch happens once, per vendor.
- Control coverage is computed per framework, not per upload.
- A lapsed artifact re-opens every gap it was covering.
3. Audit-ready workspaces
When an auditor asks for the evidence behind a control, the workspace is generated from the same records rather than assembled by hand. Nothing is copied, so nothing can be copied wrong.
4. Availability
The engine is on for every workspace today. Existing evidence is mapped in the background; expect coverage numbers to move as the backfill completes.
About Marcus Vance
Marcus runs product at Urengi. He is responsible for the intake, approval and renewal surfaces, and spends most of his time watching security teams use them so the next release removes a step rather than adding one.
