SecurGarde

Compliance documentation that stays true to the systems it describes.

SecurGarde is a governance, risk and compliance platform for organisations that carry security compliance obligations without a compliance team. It reads security findings from connected cloud accounts and security tools, maps each finding to the controls of every framework the organisation has adopted, keeps a risk register and control assessments in step with that evidence, and produces the documents regulators and assessors ask for: System Security Plans, FedRAMP OSCAL packages, SEC materiality determinations, CISA incident reports, compliance and audit reports, and a public trust centre.

It exists because most compliance tooling records what an organisation says about itself. SecurGarde records that too, and then tests it against what the organisation's own systems report. When a control marked "implemented" is contradicted by an open finding, the platform says so, on the dashboard, in the monitoring feed and in the report.

Status: in production at app.securgarde.com. Access is by request: hello@securgarde.com. Product site: securgarde.com.

The problem

Security findings live in cloud consoles and scanners, updated continuously and owned by engineering. The evidence those findings are supposed to support lives in statements of applicability, risk registers, security plans and audit packages, rebuilt by hand each cycle, for each framework, owned by compliance. The gap between the two is measured in weeks, and every framework an organisation is held to inherits it separately.

The cost of closing that gap by hand is well documented:

Most of that cost is documentation, not security, and most of it is paid more than once, because the same control is evidenced separately under each framework.

Who it is for

Small and mid-sized organisations with several frameworks to satisfy at once and nobody whose whole job is keeping the documentation current:

• Defence suppliers in the CMMC supply chain and federal contractors handling Controlled Unclassified Information, who need NIST SP 800-171 assessments, an SPRS score and a System Security Plan.
• Cloud service providers pursuing FedRAMP, who need machine-readable OSCAL.
• Healthcare providers under the HIPAA Security Rule.
• Card processors under PCI DSS.
• Software businesses operating across the UK, EU and US, who face ISO 27001, SOC 2, GDPR, NIS2, DORA and Cyber Essentials in parallel.

Established compliance platforms serve the mid-market well and are priced for it. SecurGarde is built for the organisations below that line.

What it does

How it works

One pipeline. A finding enters once and everything downstream derives from it.

  Cloud accounts, security tools, CSV, SBOM
                    │
                    ▼
  ┌───────────┐   ┌───────────┐   ┌───────────┐   ┌───────────┐
  │  INGEST   │ → │ NORMALISE │ → │    MAP    │ → │  ASSESS   │
  └───────────┘   └───────────┘   └───────────┘   └───────────┘
                                                        │
                    ┌───────────────────────────────────┤
                    ▼                                   ▼
             ┌───────────┐                       ┌───────────┐
             │ GENERATE  │                       │  MONITOR  │
             └───────────┘                       └───────────┘
        SSP, OSCAL, PDFs, filings,         baseline, drift, freshness,
        trust centre                        scheduled re-assessment

Ingest. Each source keeps its native fields and metadata. Credentials are read-only and encrypted server-side.

Normalise. Every finding lands in one normalised table with a source, a severity, a class (state or event) and its raw payload, so the rest of the platform has one shape to work with.

Map. Each finding is mapped to controls across every adopted framework in one operation, by the method described below.

Assess. Findings promote into a scored risk register; control status is compared with live evidence; CMMC requirements are scored on the DoD Assessment Methodology weights.

Generate. Documents are produced from the assessed state and carry a methodology footer stating what they were assessed from and when.

Monitor. The first scan of a source records a baseline. Later scans report drift: controls that regressed or improved, findings that are new or resolved. Uploaded evidence ages towards "expiring" and "stale" unless re-attested.

The control mapping method

This is where the design decisions matter, so it is worth explaining properly.

Mapping runs in three stages with a fallback:

1. Deterministic retrieval. Every adopted framework is flattened into one catalogue of framework identifier, control identifier and control text. An incoming finding is tokenised and scored against every control; the eight highest form a shortlist. The same finding produces the same shortlist every time, and the scoring is plain code anyone can read.

2. Constrained refinement. The shortlist, and only the shortlist, is sent to a language model with the finding. The model chooses between one and six of those controls and writes a rationale for each.

3. Validation with deterministic fallback. The model's answer is checked against the shortlist. Any control identifier that was not among the candidates is discarded. If nothing survives, or the model is unavailable, the deterministic shortlist is used as is.

The consequence: the platform cannot cite a control that does not exist in the loaded catalogue.

In compliance tooling this property matters. A fabricated control reference inside an audit artifact would be worse for an organisation than no suggestion at all. Constrained generation with validation and a deterministic fallback is the design choice that closes that gap.

Ideas the product is built on

• Evidence can contradict self-attestation. A control marked "Full" is a claim. An open finding that maps to it contradicts the claim, and the platform reports the contradiction wherever the control appears.
• Detection events are not gaps. An EDR alert that fired proves a detective control operated. Event findings are kept out of posture totals and shown as control effectiveness instead.
• Baseline, then drift. A control that was clean and is now failing is the signal that matters, so that is what monitoring reports.
• A live-monitored posture, not a snapshot. A report can say "assessed as current, last scan on this date" rather than "true on the day a form was filled in".
• Evidence has a shelf life. Files expire on a window the organisation sets and can be re-attested without re-uploading.
• Nothing is shared by default. The trust centre publishes only what an administrator switches on, and the public page has no path to live data.

Frameworks

Eighteen frameworks and 1,615 controls in one shared catalogue that every organisation draws on. Adding a framework to an organisation is a setting, not a deployment.

Security and tenancy model

One multi-tenant deployment. Each customer is an organisation and sees only its own data; adding a customer means creating an organisation, not deploying anything.

• Row-level security on all 49 application tables, enforced by 154 policies in PostgreSQL rather than in application code.
• The anonymous database role has no grants on any application table. It can call four functions: SSO domain lookup, trust centre read, trust centre access request, and one trigger.
• The public trust centre reads a snapshot table that is written at publish time from an allowlist of fields. A database trigger rejects any snapshot with a field outside the allowlist. Gated access uses hashed 30-day tokens.
• Cloud credentials are encrypted before they are stored; the key is held in project secrets and never returned to a client.
• Privileged operations run as database functions that record their outcome, so a refused action is audited as well as a completed one.
• Viewers cannot write anywhere. Owners alone can transfer or delete an organisation.
• SAML single sign-on per organisation domain.
• The language model is called only from server-side functions, receives only the prompt it needs, and can be switched off per organisation.

Architecture

Size at 22 September 2026:

Validation

In a controlled test against a live AWS account, the end-to-end workflow of reviewing findings, documenting them as risks, mapping across frameworks and assembling a framework summary took approximately 120 minutes manually and around 10 minutes through the platform.

That measurement covers one environment and one workflow. It is not a benchmark and should not be read as one.

Every feature is verified before it ships by a headless-browser pass against a throwaway organisation seeded for the purpose, and by direct queries against the database for anything the browser cannot see, such as what the anonymous role can reach.

Roadmap

• Auditor workspace: a scoped, time-limited view for an external assessor.
• More sources: SIEM and EDR connectors beyond the webhook path.
• Deeper ISO/IEC 42001 and NIST AI RMF assessment for the AI registry.
• Continuous OSCAL validation against the published schemas on every export.

Sources

1. Drata, The State of GRC 2025: From Cost Center to Strategic Business Driver. Survey conducted by Wakefield Research among 300 US IT and security professionals. https://learn.drata.com/hubfs/The_State_of_GRC_2025.pdf
2. Coalfire, Coalfire Compliance Report, 10 May 2023, survey of 300+ security leaders. https://www.prnewswire.com/news-releases/coalfire-compliance-report-unveils-the-next-horizon-in-compliance-301820384.html
3. Elevate Consulting, CMMC Certification Cost: Hidden Level 2 Expenses in 2026, 1 June 2026. https://elevateconsult.com/insights/cmmc-certification-cost-breakdown-hidden-level-2-expenses-defense-contractors-miss-in-2026/
4. Paramify, How Much Does a System Security Plan (SSP) Cost in 2026?, December 2025. https://www.paramify.com/blog/ssp-cost
5. RateCardPro, How Much Does a Cybersecurity Consultant Cost in 2026?, 12 March 2026. https://ratecardpro.com/blog/cybersecurity-consultant-cost
6. Department of Defense, Cybersecurity Maturity Model Certification (CMMC) Program, final rule, 32 CFR Part 170, 89 FR 83092, 15 October 2024. https://www.govinfo.gov/content/pkg/FR-2024-10-15/pdf/2024-22905.pdf

Author

Designed and built by Akintunde Akinbo: cybersecurity governance and compliance practitioner, MSc Cyber Security, ISO 27001 Lead Auditor, with a decade of experience implementing and auditing security control frameworks in regulated enterprise environments.