Compliance documentation that stays true to the systems it describes.
SecurGarde reads security findings from your cloud accounts and security tools and maps each one across every framework you are held to, at once, in a single operation. Your risk register, control assessments and reports stay in step with that evidence, and the platform tells you when what you have attested is contradicted by what your systems report.
One technical observation, interpreted once, evidencing obligations under every regime that applies to you. Each mapping carries a written rationale, and every control statement traces back to the finding that produced it.
Two systems that never talk
Where the findings live
Cloud consoles and scanners. Updated continuously, owned by engineering, accurate to the minute.
Where the evidence must live
Statements of applicability, risk registers, security plans and audit evidence. Rebuilt by hand each cycle, in each jurisdiction, owned by compliance.
The gap between them is measured in weeks. Every framework you are held to inherits it separately.
Most of that cost is documentation, not security — and most of it is paid more than once, because the same control is evidenced separately for each regime. The Department of Defense's own estimate for a small business to obtain and keep a CMMC Level 2 certification is $104,670 over three years, and that figure assumes NIST SP 800-171 is already implemented and documented.4
1. Drata, The State of GRC 2025, Wakefield Research survey of 300 US IT and security professionals.
2. Elevate Consulting, CMMC Certification Cost, June 2026; Paramify, How Much Does an SSP Cost, December 2025.
3. RateCardPro, Cybersecurity Consultant Rates, March 2026.
4. 32 CFR Part 170, CMMC Program final rule, 89 FR 83092, 15 October 2024, regulatory impact analysis.
One pipeline, from finding to document
A finding enters once. Everything downstream is derived from it, and every output traces back to its source.
AWS Security Hub and Security Lake, Azure Defender for Cloud, Google Security Command Center, any tool through a webhook (JSON or OCSF), CSV import, and SBOMs checked against OSV.dev.
Every finding lands in one shape: source, severity, whether it describes a state or an event, and its original payload.
Controls suggested across every adopted framework in one operation, each with a rationale.
Findings promoted to scored entries with owners and generated mitigation plans.
Your attestation per control, tested against live evidence. A control marked implemented that a finding contradicts is flagged as contradicted.
Scheduled scans record a baseline, then report what regressed or improved. Uploaded evidence expires unless re-attested.
CMMC System Security Plan with an SPRS estimate; FedRAMP SSP as OSCAL 1.1.2 JSON.
SEC Form 8-K materiality determination and CISA/CIRCIA incident reports as STIX.
Compliance, cloud security, executive summary and audit reports as PDFs, on demand or emailed on a schedule, each stating what it was assessed from and when.
A public page that shows only what an administrator switches on, from a snapshot taken at publish time, with gated access for customers and auditors.
Why the output is defensible
Control mapping runs in three stages with a deterministic fallback. This is the part worth understanding properly.
Retrieve
Every loaded framework is flattened into a single control catalogue. The finding is tokenised and scored against the whole catalogue using lexical overlap and weighted domain heuristics across configuration, vulnerability, identity, network, logging and encryption. The top candidates carry forward. This stage is fully deterministic — the same finding always produces the same shortlist.
Refine
Those shortlisted controls, and only those, are passed to a language model together with the finding. It selects the most relevant and writes a rationale for each selection.
Validate
The response is checked against the original shortlist. Any control identifier returned that was not among the retrieved candidates is discarded before anything is displayed.
Fall back
If validation leaves nothing, or the model call fails, the deterministic result from the first stage stands. The pipeline does not depend on the model being available.
The system cannot cite a control that does not exist in the catalogue. In an audit artifact, a fabricated control reference would be worse than no suggestion at all.
The frameworks you are held to, in one catalogue
Every loaded framework sits in a single control catalogue. A finding is scored against all of them at once, which is why one observation can evidence obligations in several jurisdictions without maintaining separate mapping tables.
International
- ISO/IEC 27001:2022Information security management
- ISO/IEC 27002:2022Control guidance
- ISO 22301:2019Business continuity
- ISO/IEC 42001:2023AI management systems
- PCI DSS v4.0.1Payment card data, global
- CSA CCM v4.1Cloud controls matrix
- NIST AI RMF 1.0AI risk management
United Kingdom and Europe
- GDPR and UK GDPRPersonal data protection
- NIS2Network and information systems
- DORAFinancial sector operational resilience
- Cyber Essentials v3.3UK baseline assurance
United States
- NIST CSF 2.0Cybersecurity framework
- NIST SP 800-171 and CMMC 2.0Federal supply chain, with an SPRS estimate
- FedRAMP Moderate (Rev. 5)Cloud authorization, OSCAL export
- HIPAA Security RuleProtected health information
- SOC 2 and SOC 1Trust services and financial reporting controls
- CCPA / CPRACalifornia consumer privacy
- SEC cyber disclosureForm 8-K Item 1.05
Eighteen frameworks and 1,615 controls in one catalogue. Adding a framework to your organisation is a setting, not an upgrade.
Organisations carrying compliance obligations without the staff to absorb them
Operating across jurisdictions
primaryA software business selling into the UK, Europe and the United States.
What they face
ISO 27001 certification because enterprise buyers require it. GDPR because they process European personal data. PCI DSS if they touch card payments. SOC 2 for North American procurement. NIS2 or DORA if they fall in scope.
The same encryption control is evidenced four times, in four documents, by the same two people.
Worked example
An unencrypted database is found. SecurGarde maps it to ISO 27001 A.8.24, GDPR Art. 32(1)(a), PCI DSS 3.5 and CSF PR.DS-01 in one operation.
One remediation closes an obligation in three jurisdictions, and the evidence for each is generated from the same record.
What comes out
- A statement of applicability reflecting the environment as it is
- A single risk register serving every framework in scope
- Evidence packages per regime, from one set of findings
- A defensible audit trail from control statement back to source
Federal supply chain
United StatesA 40-person precision machine shop supplying a Tier 1 prime.
What they face
Controlled Unclassified Information under DFARS 252.204-7012. Self-assessment against 110 NIST SP 800-171 controls, a score posted to SPRS, a security plan and remediation plan maintained, and annual affirmation.
No compliance staff. The quality manager owns it alongside their day job.
Worked example
The same unencrypted database maps to 800-171 3.13.16 and the corresponding CMMC practice, with a rationale for each.
The finding is promoted to the risk register, scored, assigned an owner, and given a mitigation plan naming the exact resource.
What comes out
- A System Security Plan reflecting the environment as assessed
- A remediation plan derived from the unmet controls
- An SPRS-ready score
- An audit evidence package traceable to the originating finding
Healthcare
regulated industryA hospital group running clinical systems in the cloud.
What they face
HIPAA Security Rule safeguards in the United States, or GDPR Article 9 obligations for health data in Europe, with a risk analysis that must be current rather than annual. Breach notification timelines leave no room to reconstruct evidence afterwards.
Worked example
The same finding maps to HIPAA 164.312(a)(2)(iv) or GDPR Art. 32 depending on where the data sits, alongside ISO 27001 A.8.24 — without maintaining separate mapping tables per region.
Financial services
regulated industryAn institution processing card data and subject to operational resilience rules.
What they face
PCI DSS v4.0 evidenced continuously rather than at audit. DORA operational resilience obligations in the EU. Where publicly traded in the US, disclosure of material cyber incidents within four business days.
Worked example
A disclosed vulnerability on a public-facing instance maps to PCI DSS 11.1 and CSF ID.RA-01 together. If it becomes an incident, materiality is assessed against the same evidence record rather than assembled separately under time pressure.
One system, separate accounts
Multi-tenant by design
A single codebase and deployment. Each customer holds a separate account and sees only their own data. Isolation is enforced at the database layer through PostgreSQL row-level security, not in application logic alone. Adding a customer means creating an account, not deploying anything new.
Shared framework catalogue
Every framework sits in one catalogue that each account draws on, rather than as separate modules. An additional framework carries no marginal cost to serve — which is why a single finding can map across several at once, and why frameworks are included rather than sold as add-ons.
What SecurGarde needs, and what it holds
A compliance tool asking for access to your cloud account should say plainly what it does with it.
Read-only access, nothing more
SecurGarde reads security findings and configuration metadata. It does not require write permissions, and it cannot change your infrastructure, alter security groups or touch workloads.
Findings, not payloads
What is ingested is the finding record — the control that failed, the resource identifier, the severity and the source metadata. Application data, database contents and customer records are never read.
Isolated per account
Each organisation's records are separated at the database layer through row-level security, not in application logic alone. One account cannot reach another's data even if the application were misconfigured.
Nothing shared by default
The public trust centre shows only the elements an administrator switches on, from a snapshot written at publish time. The public page has no path to live data: the anonymous database role holds no grants on any application table.
Credentials held server-side
Integration credentials and model API keys are held in server-side environment configuration. They are never exposed to the browser, and no inference call is made from the client.
What practitioners ask first
How do I know the control mappings are right?
Every suggested control is retrieved from the loaded framework catalogue before a language model sees it, and the model's response is validated against that shortlist. Anything returned that was not a retrieved candidate is discarded. The system cannot cite a control that does not exist. Each mapping also carries a written rationale you can read and reject.
Does it replace an auditor or an assessor?
No. It produces the evidence and documentation an assessment runs on. The assessment itself remains with your auditor, certification body or assessment organisation — and in some schemes, anyone who assisted with implementation is barred from assessing the same organisation.
What if a framework I need is not loaded?
Frameworks sit in a shared catalogue rather than as separate modules, so adding one carries no marginal cost to serve. Tell me which you need and it can be added.
Which cloud providers are supported?
AWS through Security Hub and Security Lake, Azure through Defender for Cloud, and Google Cloud through Security Command Center. Any other tool can send findings to a token-authenticated webhook endpoint, as plain JSON or OCSF, and findings can be imported from CSV.
Can I export the output, or is it locked in?
Documents export as PDF and CSV, and authorization packages export as OSCAL JSON — a machine-readable open standard your other tooling can consume. Nothing is held in a proprietary format you cannot leave with.
What happens if the AI service is unavailable?
The pipeline continues. Control retrieval and scoring are deterministic and run without a model. If the model call fails, the deterministic result stands rather than the operation failing.
What runs today, and what follows
In production at app.securgarde.com. Every feature is verified against a live environment before it ships.
Available today
- Findings from AWS, Azure and Google Cloud, webhooks (JSON and OCSF), CSV and SBOM
- Cross-framework control mapping across 18 frameworks
- Risk register with generated mitigation plans; vendor and AI system registers
- Control assessment tested against live evidence; control effectiveness from detection events
- CMMC 2.0 Level 2 readiness with SPRS estimate and System Security Plan
- FedRAMP SSP as OSCAL JSON; SEC 8-K materiality; CISA/CIRCIA reports as STIX
- Compliance, cloud security, executive and audit reports as PDFs, on demand or on a schedule
- Scheduled scans, baseline and drift, remediation workflow, evidence freshness
- Public trust centre with gated access; SAML single sign-on; audit log; roles
Next
- An auditor workspace: a scoped, time-limited view for an external assessor
- SIEM and EDR connectors beyond the webhook path
- Deeper ISO/IEC 42001 and NIST AI RMF assessment for the AI register
- OSCAL validation against the published schemas on every export
Built by a practitioner
SecurGarde was designed and built by Akintunde Akinbo, a cybersecurity governance and compliance professional with a decade of experience implementing and auditing security control frameworks in regulated enterprise environments.
The problem it addresses is one encountered directly rather than observed: documentation that cannot keep pace with the infrastructure it describes, and organisations paying repeatedly to evidence the same control under one regime after another.
MSc Cyber Security, Sheffield Hallam University · ISO 27001 Lead Auditor · ISC² Certified in Cybersecurity
Published pricing, every framework included
One product, the same for every customer, priced by organisation size. Every tier includes all eighteen frameworks in the catalogue. No framework is sold as an add-on. Prices in US dollars, licensed on annual subscription.
Core
Billed annually, $1,788 per year
Organisations of up to 25 staff
- All 18 frameworks, including NIST SP 800-171 / CMMC, NIST CSF 2.0, ISO 27001, PCI DSS and FedRAMP
- Cloud and tool ingestion: AWS, Azure, GCP, webhook, CSV and SBOM
- Cross-framework control mapping and continuous monitoring with drift detection
- Risk register, CMMC readiness with SPRS estimate, OSCAL System Security Plan export and PDF reports
Standard
RecommendedBilled annually, $5,388 per year
Organisations of 26 to 200 staff
- Everything in Core
- Built for multi-framework programmes with larger teams
- Role-based access (owner, admin, member, viewer) and immutable audit log
Enterprise
Annual agreement
Organisations above 200 staff
- Everything in Standard
- SAML single sign-on
- Multiple connected environments
- Public trust centre and volume terms
Licensing is available independently of any advisory engagement. Organisations can use SecurGarde without engaging its founder. To start, request a trial account below.
Request a trial accountRequest a trial account
Connect a test environment, or bring a CSV of findings, and run the pipeline end to end against the frameworks you are actually held to. If the output would not stand up to your auditor, that is the most useful thing you can tell me.
Happy to put an NDA in place before anything is shared.