Every Framework, One Control Set
AQUILA GRC holds the resident controls, the evidence behind them, the frameworks mapped onto them and the attestations signed against them. A framework is a view over that one set, never a second program running beside it.
Three Frameworks.
Three Programs.
One Set of Controls.
Most organizations run each obligation as its own project, with its own evidence, its own owner and its own calendar. The controls underneath are largely the same controls.
One customer asks for ISO 27001, another for SOC 2, the regulator for a privacy regime. The same artifact is gathered, renamed and filed again for each, and the three copies drift apart.
Renewal dates, review dates and attestation dates live in inboxes and spreadsheets. The organization finds out a policy is past review when someone asks for it.
A policy that is approved and adopted is evidence of a decision, not of an operating control. Nothing in a compliance tool can tell the difference.
See It Live.
GRC's own world: eight governance surfaces feeding the compliance posture core, and the posture it publishes up to AQUILA C4I. Press the core or any surface to read what it hands over.