From requirement to proof, in one connected place.
Frameworks, controls, audits, and evidence live in one model. Map a control once, test it once, and show every assessor exactly how it addresses their requirements.
Every framework, through one set of objectives.
- 30+Compliance frameworks in the library, including SOC 2, ISO 27001, and NIST 800-53
- ~400Control objectives that every record connects through
- 1×Evidence collected once satisfies every requirement mapped to it
Every requirement, explained and connected.
Subscribe to the frameworks you answer to from a global catalog. Open any requirement to see what addresses it, what's open against it, and how to test it.
Where a framework adds its own attributes to a requirement, Libero shows that layer too, each tied to the control objectives that address it. Status comes from your active controls and is labeled for what it is: advisory, not an attestation.
Lux explains what the requirement is really asking for, and Libero adds implementation guidance for each requirement. Both are marked advisory — never an attestation.
Each requirement lists how an assessor would test the control, so you can test it first.
Controls that match how your business actually runs.
One control objective, many instances: one per system, environment, or business unit, each with its own owner, narrative, and effectiveness. Effectiveness comes from explainable rules, not AI opinion.
Objectives document what you need to do. Instances let you customize controls based on how your organization operates.
A confirmed issue marks the instance Not Effective. When the issue closes, effectiveness is recalculated from current evidence and attestation.
Implement the same objective for a new system, scope, or location, with its own owner and effectiveness.
Run every audit in one workspace.
Internal testing, external audits, and self-assessments share one flow. Scope follows from what you choose, and findings never get lost on the way to remediation.
Pick the frameworks, products, and business units in scope. The associated control instances are mapped automatically.
Every evidence request has an owner, a due date, and a status, tracked on the engagement itself.
- Assessors get a scoped portalThey see the requests, evidence, and observations for their engagement, nothing more.
Observations get a Lux-suggested severity with its reasoning. Confirmed observations become issues when the engagement closes, and it can't close while findings are still in draft or review.
Collect once. Reuse across audits.
Every artifact is typed, owned, versioned, and tracked for freshness, so you know what's current before an assessor asks.
EA.000214 carries its owner, source system, the control instances it supports, and a currency window.
Open any requirement to see the accepted artifacts on the control instances it reaches. Each one is marked Current or Stale.
When a new request arrives, Lux points to evidence you already have. Nothing attaches until a reviewer confirms.
- Suggests observation severityWith its reasoning and a confidence score.
- Matches existing evidenceNothing attaches until a reviewer confirms.
- Explains requirementsPlain-language intent and guidance per requirement.
- Suggests framework mappingsScored, and waiting for Accept or Reject.