Annex A control coverage
All 93 controls in the library, with coverage derived from your own evidence rather than from a maturity questionnaire.
ISO/IEC 27001
The security evidence you already have.
Most organisations reaching for AI governance are already certified here. That matters more than it sounds: a large share of what ISO 42001 and the EU AI Act ask for is proof you are producing for ISO 27001 today.
Coverage
What ships with the platform.
- 93
- Controls
- ISO/IEC 27001 control library
- 31
- Document requirements
- Mapped to the controls they satisfy
- Yes
- Crosswalked
- Evidence credits equivalent controls in the other frameworks
- Yes
- Document review
- Grade an existing document against this framework
In short
What it actually asks for.
ISO/IEC 27001 is the information security management system standard, with 93 Annex A controls spanning organisational, people, physical and technological themes. Access control, change management, logging, supplier management and incident response are the ones that recur.
The overlap with AI governance is substantial and structural rather than incidental. An access review, a change approval record or a supplier assessment is the same artefact whichever framework is asking for it.
Where the platform helps
The obligations that take the most work.
Reuse into AI governance
Evidence credited here also credits the mapped ISO 42001 and EU AI Act controls, so the second programme starts part-finished.
Access and change records
Read from source control and cloud platforms as posture signals, then stored as control-level evidence.
Supplier and third party
Assessment records held against the controls they answer, with validity dates so they are re-gathered rather than assumed.
Statement of applicability
Drafted from the control set and kept in step with the decisions actually recorded against each control.
Internal audit
Rehearse with a scored simulation across a sample of controls before the certification body arrives.
This is the framework where the crosswalk pays for itself: it holds the largest control set, and its evidence is reused the most widely.
Alongside
Rarely the only framework you run.
Evidence is credited across every framework that asks for the same proof, so overlapping programmes cost far less than running them separately.
Next / evaluate the platform
Bring your frameworks.
See the operating system.
We will walk through the platform against your own governance and compliance needs, and what getting to audit-ready would take.