Frameworks & regulations
ISO 27001SOC 2NIST CSF
GRC & COMPLIANCE
One compliance program.
Many requirements.
Bring framework requirements, shared controls, evidence and audit preparation into a single, accountable workflow.
Product direction · In developmentBrowse the compliance library ↓PART OF MODELO PLATFORM
From technical risk
to compliance readiness.
Threat modeling examines what can go wrong. GRC & Compliance connects those findings to the obligations, controls, evidence and reviews that keep a compliance program moving.
One accountable control set
Map applicable requirements to controls, owners and review decisions.
Evidence & audit readiness
Reuse relevant evidence, identify gaps and follow remediation through review.
Conceptual workflow. Framework coverage, mappings and automation are in development.
THE COMPLIANCE WORKSPACE
PRODUCT SCOPEStart with your obligations.
Select the standards, regulations and assurance programs that apply to your organization. Track versions, scope and assessment requirements.
- Framework library and applicability
- Versioned requirements and assessment scope
- Readiness and gap assessments
Map once. Review in context.
Connect requirements across frameworks to a shared control set. Keep differences, applicability and reviewer judgment visible.
- Multi-framework control cross-mapping
- Control ownership and implementation status
- Traceability from requirement to control
Build a reviewable evidence record.
Link evidence to controls and assessments, with collection responsibilities, review dates and renewal needs.
- Evidence collection and review workflows
- Reusable evidence with freshness tracking
- Monitoring and connector direction
Prepare the work behind the audit.
Organize assessments, findings and supporting records so internal teams and external reviewers can follow the reasoning.
- Audit and assessment workspaces
- Findings, remediation tasks and deadlines
- Review history and reporting exports
Bring risk into the program.
Connect security findings and business impact to treatment decisions, residual risk and third-party review.
- Enterprise risk register and treatment
- Third-party risk review
- Risk acceptance and reassessment
Keep ownership explicit.
Manage policy responsibilities, exceptions, approvals and follow-up as part of the compliance workflow.
- Policy lifecycle and acknowledgments
- Exceptions and human approvals
- Executive and audit reporting
COMPLIANCE LIBRARY
Frameworks & requirements.
Initial coverage targets across standards, regulations and assurance programs. Each entry links to its authoritative source; operational mappings are in development.
14 library entries
ISO/IEC 27001
Information security management
Official source ↗SOC 2
Trust services assurance
Official source ↗NIST CSF
Cybersecurity risk outcomes
Official source ↗NIST SP 800-53
Security and privacy controls
Official source ↗PCI DSS
Payment account data security
Official source ↗HIPAA
Health information safeguards
Official source ↗GDPR
Personal data protection
Official source ↗DORA
Financial-sector digital resilience
Official source ↗NIS2
Cybersecurity across critical sectors
Official source ↗CMMC
Defense contractor cybersecurity
Official source ↗NIST AI RMF
AI risk management
Official source ↗ISO/IEC 42001
AI management systems
Official source ↗EU AI Act
Risk-based AI obligations
Official source ↗CIS Controls
Prioritized security safeguards
Official source ↗No matching requirements. Try another search or topic.
The library keeps laws, standards, control sets and assurance programs distinct. Coverage is evaluated per version and scope; a listed name does not establish a completed integration or certification.
Security modeling and compliance, connected.
Explore how architecture and threat analysis feed the broader Modelo Platform.