Compliance documentation that stays true to the systems it describes.
SecurGarde reads security findings from your cloud account and maps each one across every framework you are held to — at once, in a single operation. The evidence, risk records and reports come out the other side derived from the infrastructure, not typed alongside it.
One technical observation, interpreted once, evidencing obligations under every regime that applies to you. Each mapping carries a written rationale, and every control statement traces back to the finding that produced it.
Two systems that never talk
Where the findings live
Cloud consoles and scanners. Updated continuously, owned by engineering, accurate to the minute.
Where the evidence must live
Statements of applicability, risk registers, security plans and audit evidence. Rebuilt by hand each cycle, in each jurisdiction, owned by compliance.
The gap between them is measured in weeks. Every framework you are held to inherits it separately.
Most of that cost is documentation, not security — and most of it is paid more than once, because the same control is evidenced separately for each regime.
One pipeline, eight steps
A finding enters once. Everything downstream is derived from it, and every output traces back to its source.
Live findings read from the connected account, with native fields and source metadata preserved.
Controls suggested across every loaded framework in one operation, each with a rationale.
Findings promoted to scored entries with owners and mitigation plans.
Scored against the control set, with evidence attached.
Summary plan reflecting the environment as assessed.
OSCAL JSON for authorization review and downstream tooling.
Materiality assessment and structured regulatory submission.
Audit evidence packages an assessor can follow.
Why the output is defensible
Control mapping runs in three stages with a deterministic fallback. This is the part worth understanding properly.
Retrieve
Every loaded framework is flattened into a single control catalogue. The finding is tokenised and scored against the whole catalogue using lexical overlap and weighted domain heuristics across configuration, vulnerability, identity, network, logging and encryption. The top candidates carry forward. This stage is fully deterministic — the same finding always produces the same shortlist.
Refine
Those shortlisted controls, and only those, are passed to a language model together with the finding. It selects the most relevant and writes a rationale for each selection.
Validate
The response is checked against the original shortlist. Any control identifier returned that was not among the retrieved candidates is discarded before anything is displayed.
Fall back
If validation leaves nothing, or the model call fails, the deterministic result from the first stage stands. The pipeline does not depend on the model being available.
The system cannot cite a control that does not exist in the catalogue. In an audit artifact, a fabricated control reference would be worse than no suggestion at all.
The frameworks you are held to, in one catalogue
Every loaded framework sits in a single control catalogue. A finding is scored against all of them at once, which is why one observation can evidence obligations in several jurisdictions without maintaining separate mapping tables.
International
- ISO/IEC 27001Information security management
- PCI DSS v4.0Payment card data, global
- NIST CSF 2.0Widely adopted outside the US
United Kingdom and Europe
- GDPR and UK GDPRPersonal data protection
- NIS2Network and information systems
- DORAFinancial sector operational resilience
- Cyber EssentialsUK baseline assurance
United States
- NIST SP 800-171 and CMMCFederal supply chain
- FedRAMPCloud authorization
- HIPAA Security RuleProtected health information
- SEC cyber disclosureForm 8-K Item 1.05
Adding a framework carries no marginal cost, which is why coverage is included rather than sold as a per-framework upgrade.
Organisations carrying compliance obligations without the staff to absorb them
Operating across jurisdictions
primaryA software business selling into the UK, Europe and the United States.
What they face
ISO 27001 certification because enterprise buyers require it. GDPR because they process European personal data. PCI DSS if they touch card payments. SOC 2 for North American procurement. NIS2 or DORA if they fall in scope.
The same encryption control is evidenced four times, in four documents, by the same two people.
Worked example
An unencrypted database is found. SecurGarde maps it to ISO 27001 A.8.24, GDPR Art. 32(1)(a), PCI DSS 3.5 and CSF PR.DS-01 in one operation.
One remediation closes an obligation in three jurisdictions, and the evidence for each is generated from the same record.
What comes out
- A statement of applicability reflecting the environment as it is
- A single risk register serving every framework in scope
- Evidence packages per regime, from one set of findings
- A defensible audit trail from control statement back to source
Federal supply chain
United StatesA 40-person precision machine shop supplying a Tier 1 prime.
What they face
Controlled Unclassified Information under DFARS 252.204-7012. Self-assessment against 110 NIST SP 800-171 controls, a score posted to SPRS, a security plan and remediation plan maintained, and annual affirmation.
No compliance staff. The quality manager owns it alongside their day job.
Worked example
The same unencrypted database maps to 800-171 3.13.16 and the corresponding CMMC practice, with a rationale for each.
The finding is promoted to the risk register, scored, assigned an owner, and given a mitigation plan naming the exact resource.
What comes out
- A System Security Plan reflecting the environment as assessed
- A remediation plan derived from the unmet controls
- An SPRS-ready score
- An audit evidence package traceable to the originating finding
Healthcare
regulated industryA hospital group running clinical systems in the cloud.
What they face
HIPAA Security Rule safeguards in the United States, or GDPR Article 9 obligations for health data in Europe, with a risk analysis that must be current rather than annual. Breach notification timelines leave no room to reconstruct evidence afterwards.
Worked example
The same finding maps to HIPAA 164.312(a)(2)(iv) or GDPR Art. 32 depending on where the data sits, alongside ISO 27001 A.8.24 — without maintaining separate mapping tables per region.
Financial services
regulated industryAn institution processing card data and subject to operational resilience rules.
What they face
PCI DSS v4.0 evidenced continuously rather than at audit. DORA operational resilience obligations in the EU. Where publicly traded in the US, disclosure of material cyber incidents within four business days.
Worked example
A disclosed vulnerability on a public-facing instance maps to PCI DSS 11.1 and CSF ID.RA-01 together. If it becomes an incident, materiality is assessed against the same evidence record rather than assembled separately under time pressure.
One system, separate accounts
Multi-tenant by design
A single codebase and deployment. Each customer holds a separate account and sees only their own data. Isolation is enforced at the database layer through PostgreSQL row-level security, not in application logic alone. Adding a customer means creating an account, not deploying anything new.
Shared framework catalogue
Every framework sits in one catalogue that each account draws on, rather than as separate modules. An additional framework carries no marginal cost to serve — which is why a single finding can map across several at once, and why frameworks are included rather than sold as add-ons.
What SecurGarde needs, and what it holds
A compliance tool asking for access to your cloud account should say plainly what it does with it.
Read-only access, nothing more
SecurGarde reads security findings and configuration metadata. It does not require write permissions, and it cannot change your infrastructure, alter security groups or touch workloads.
Findings, not payloads
What is ingested is the finding record — the control that failed, the resource identifier, the severity and the source metadata. Application data, database contents and customer records are never read.
Isolated per account
Each organisation's records are separated at the database layer through row-level security, not in application logic alone. One account cannot reach another's data even if the application were misconfigured.
Credentials held server-side
Integration credentials and model API keys are held in server-side environment configuration. They are never exposed to the browser, and no inference call is made from the client.
What practitioners ask first
How do I know the control mappings are right?
Every suggested control is retrieved from the loaded framework catalogue before a language model sees it, and the model's response is validated against that shortlist. Anything returned that was not a retrieved candidate is discarded. The system cannot cite a control that does not exist. Each mapping also carries a written rationale you can read and reject.
Does it replace an auditor or an assessor?
No. It produces the evidence and documentation an assessment runs on. The assessment itself remains with your auditor, certification body or assessment organisation — and in some schemes, anyone who assisted with implementation is barred from assessing the same organisation.
What if a framework I need is not loaded?
Frameworks sit in a shared catalogue rather than as separate modules, so adding one carries no marginal cost to serve. Tell me which you need and it can be added.
Which cloud providers are supported?
AWS today, via Security Hub and Inspector. Azure and Google Cloud ingestion are on the roadmap.
Can I export the output, or is it locked in?
Documents export as PDF and CSV, and authorization packages export as OSCAL JSON — a machine-readable open standard your other tooling can consume. Nothing is held in a proprietary format you cannot leave with.
What happens if the AI service is unavailable?
The pipeline continues. Control retrieval and scoring are deterministic and run without a model. If the model call fails, the deterministic result stands rather than the operation failing.
What runs today, and what follows
Built and validated against a live AWS environment using genuine Security Hub and Inspector findings.
Available today
- Cloud telemetry ingestion (AWS)
- Cross-framework control mapping
- Risk register with mitigation plans
- Framework assessment and security plan generation
- Machine-readable OSCAL export
- Incident materiality determination
- Structured regulatory incident reporting
- Compliance and audit evidence reporting
- Artifact traceability to source telemetry
Roadmap
- Remediation plan generation from unmet controls
- Expanded control narrative coverage
- SBOM correlation against live CVE data
- Azure and GCP telemetry ingestion
- Continuous monitoring and re-assessment
- Production hardening and scale testing
Built by a practitioner
SecurGarde was designed and built by Akintunde Akinbo, a cybersecurity governance and compliance professional with a decade of experience implementing and auditing security control frameworks in regulated enterprise environments.
The problem it addresses is one encountered directly rather than observed: documentation that cannot keep pace with the infrastructure it describes, and organisations paying repeatedly to evidence the same control under one regime after another.
MSc Cyber Security, Sheffield Hallam University · ISO 27001 Lead Auditor · ISC² Certified in Cybersecurity
Request a trial account
Connect a test environment and run the pipeline end to end against the frameworks you are actually held to. If the output would not stand up to your auditor, that is the most useful thing you can tell me.
Happy to put an NDA in place before anything is shared.